To stop customers' personal AI agents gaming retention offers and goodwill credits, take the discretion out of the conversation: set every offer and credit in code from account data, tie each one to a verified account and a usage limit, and let a polite or persistent message change nothing. Then detect agent traffic, give agents a front door with permissions the customer approves, and keep cancellation easy so there is nothing to win by pushing. Blocking agents outright tends to strand the real customer behind them.

Key takeaways

• Money is where agents show up first. In Lorikeet's survey of 1,966 US consumers, 55.5% were comfortable sending an AI agent to get a better price, against 38.5% for making a booking.

• Offers decided by conversation are offers decided by the most persistent party. Put eligibility, amounts and frequency limits in code that reads account data, not in prompts.

• Self-reported identity is not enough. Cloudflare notes that agent traffic has historically been classified by user agent and IP address, and these fields can be spoofed. Signed requests and customer-approved permissions are the stronger signals.

• Do not turn retention into a wall. The FTC's 2025 Amazon settlement included a $1 billion civil penalty, $1.5 billion in refunds and an easy way to cancel using the same method customers used to sign up.

Which tools help stop AI agents gaming retention offers?

Lorikeet's agent traffic detection, in beta, reads the customer side of each conversation after it ends and tags suspected agent traffic, so you can branch workflows or verify harder on those tickets. Other options:

• Decagon lists detection of personal agents and a dedicated channel to serve them, with permissions you control.

• Sierra is developing the Personal Agent Protocol with Meta and partners, where consumers decide what access their agents get and companies set what those agents can do.

• Cloudflare verifies signed agent requests for Visa's Trusted Agent Protocol and Mastercard's Agent Pay.

How we chose and checked these

The eight measures below follow the order an agent's request moves through: offer rules, account binding, detection, permissions, cancellation, pressure, fabricated claims and measurement. Lorikeet's B2A material, including The Agent Economy report, supplies the consumer data; standards points link to the IETF, OWASP and the FTC; and every vendor fact was checked on the vendor's own public pages on 23 Oct 2026. Lorikeet publishes this guide and is one of the tools listed. We have tried to describe every product, including our own, using only what each vendor publishes, and we link to the source for each claim.

1. Put offer eligibility in code, not in the conversation

The weakest retention design is a support agent, human or AI, with a range of discounts and the discretion to pick one. A personal agent can ask again, ask on another channel, or keep asking until the top of the range appears. The B2A launch post describes agents that engage businesses "persistently, repeatedly and ruthlessly", and cites one user whose agent took a bill from $80 a month to $40 a month, plus three months free.

Write the offer ladder as data: which segments qualify, which offer each segment gets, the maximum value, and how often. The AI agent calls a tool that returns the offer for this account, and can present it, but cannot change it. Goodwill credits work the same way: the amount comes from a rule tied to evidence (an outage, a late delivery, a failed payment on your side), not from how upset the message sounds. If the answer is identical no matter who asks or how often, there is nothing to game.

2. Bind every offer and credit to a verified account, once

An offer that is not tied to an account can be claimed repeatedly. Issue each retention offer or credit against a verified account, record it, and enforce limits in the same tool: one retention offer per account per period, a cap on goodwill credit per account per quarter, and idempotency so a retried request does not issue twice.

Verification should match the action. A sound default is two factors of different types for anything that changes an account, with the AI collecting answers and your own systems deciding whether they pass. The AI should never hold the correct answers, because anything it knows it can be talked into revealing. GiveCard's flow shows the pattern in practice: each intent triggers its own workflow, which already knows whether the question needs verification before the agent acts. For regulated businesses, see what changes when AI agents contact fintech support for the regulated version of this problem.

3. Detect agent traffic and tag it

You cannot set rules for agents you cannot see. The agent traffic detection post describes four shapes of agent traffic: a consumer agent acting openly for a person, an agent impersonating the user, a person pasting AI-written text, and machine mail. It also estimates that, depending on definition, up to 3 percent of inbound support traffic comes from AI agents and other automated systems. Text-based detection is a judgement, so tags should say "suspected" and start in observation mode.

At the network edge there are stronger signals. RFC 9421 defines HTTP Message Signatures, and the IETF's web bot auth working group has an active draft on HTTP message signatures for automated traffic. Cloudflare says Visa's and Mastercard's agent protocols build on this so merchants can identify a registered agent and link it to a consumer identity. For more detection signals, see signs AI agents are contacting your support team.

4. Give agents a front door with permissions the customer approves

An agent that signs in as the customer can do anything the customer can, including accept every offer. A better model separates the two. The Personal Agent Protocol site describes a user signing in on the company's own page and choosing whether their agent can view the account, make changes, or both, and both sides declaring whether a person or an AI is speaking.

Lorikeet supports the Personal Agent Protocol alongside WebMCP and A2A, labels each conversation with the protocol and the agent, and lets you allow or block specific agents; the support is live, and its documentation says an assistant cannot use anything that might touch the account until the customer signs in. Whatever you use, make agent access read-only by default, and send anything that moves money, including accepting a credit or a discounted plan, back to the customer to approve. For background on the channel itself, see what B2A (business to agent) means.

5. Keep cancellation easy so there is nothing to win by pushing

Many retention offers get gamed because cancellation is hard: the customer, or their agent, learns that threatening to leave produces a discount. The regulatory direction runs the other way. In its 2025 settlement with Amazon, the FTC required an easy way for consumers to cancel Prime, using the same method that consumers used to sign up, and a clear and conspicuous button to decline Prime.

A clean rule helps both sides: when an account is eligible, present one offer, once, in plain terms; if the customer or their agent declines, cancel and confirm in writing. The Agent Economy report found that getting a better price is the job consumers are most ready to hand to an agent, so a fast, honest answer to "what can you offer?" serves more people than a negotiation. See AI agents for refunds and cancellations for the mechanics.

6. Do not let pressure move the offer

Threats to cancel, claims of a competitor's lower price, and repeated contacts across channels should not change the result of step 1. The offer depends on account signals such as tenure, plan and payment history, not on the words in the message. If your policy includes price matching, require evidence your systems can check, and treat it as its own rule rather than a reason to escalate the discount.

Count contacts per account across chat, email and voice, because an agent can open all three in minutes. The B2A launch post notes that rate limits cap agent volume and that a retry should avoid opening a second ticket; the same idea stops one customer collecting one offer per channel. If the same account asks for the same thing three times, the answer should be the same three times.

7. Check every claim against your own records

Agents, like people, may assert things that are not true: "your colleague promised 50% off", "I was told the credit was approved", or instructions aimed at your AI agent hidden inside the message. OWASP ranks prompt injection first in its Top 10 for LLM applications and notes that injected content does not need to be human-readable to affect a model.

So the AI agent should never act on a claimed promise; it should look up the record. If no record exists, the claim does not change the offer. Lorikeet's guardrails run message checks on incoming messages, including for prompt-injection attempts, and check every reply before it is sent, with the design goal that a successful manipulation is limited to a single conversation. Goodwill credits should require evidence from your systems, such as an outage log or delivery record, not from the conversation.

8. Measure agent traffic separately and review what it gets

Report offers accepted, credits issued and average credit value for suspected agent traffic and for humans, side by side. If agent-tagged accounts receive more or larger credits than comparable human accounts, a rule is leaking. Keep a record of what each assistant did and what the customer approved, so you can answer "I didn't ask for that".

Expect the numbers to grow. The Agent Economy report found two in three consumers interested in an agent that deals with companies for them, while at most 1 in 16 say an AI tool has contacted a company itself on their behalf. Most of that demand has not arrived yet.

Tools that help

Lorikeet publishes this guide and is one of the tools listed. Each row uses only the vendor's own page.

Questions to ask before you pick a tool

• Can offer and credit amounts come only from a tool reading account data, never from the model?

• Are limits enforced per account across chat, email and voice?

• How is agent traffic detected, and can we see the evidence behind each tag?

• Can agents get read-only access by default, with money-moving actions sent back to the customer?

• Can we report credits and offers for agent traffic separately?

What still needs a human?

People should decide large or unusual goodwill credits, formal complaints, disputes where an agent says the customer approved something the records do not show, and any customer in financial difficulty or a vulnerable situation, whether they write themselves or send an agent. Product and legal teams own the offer ladder and the cancellation flow. The AI agent's job is to apply those rules the same way to everyone, quickly, and to escalate the exceptions with the evidence attached.

To see how agent traffic shows up in your own tickets, Lorikeet offers a 30-day free trial with self-serve sign-up.