Good AI agent prompt design for customer-facing work means writing the agent’s instructions like a job description for a new hire: who it serves, what it may answer, which documents it answers from, what it must never promise, and exactly when it hands the customer to a human. Then you test it against real customer questions before launch.
This guide is for business owners and operations leads in Saudi Arabia and the UAE who are putting an AI agent in front of customers on WhatsApp, Instagram or a website chat. If you want the agent designed, connected to your systems and tested for you, see AI solutions from NourSky. For the channel side of the picture, read AI Agent for WhatsApp Business: How It Works.
Why does prompt design matter more when the agent talks to customers?
A customer-facing agent that gets something wrong makes a statement on behalf of your company. The clearest public example is Moffatt v. Air Canada (2024 BCCRT 149), decided on February 14, 2024 by British Columbia’s Civil Resolution Tribunal. The airline’s website chatbot gave a passenger incorrect information about its bereavement fare policy. The tribunal found the airline liable for negligent misrepresentation. According to a published legal summary of the decision, it held that the airline remains responsible for all the information on its website, whether that information comes from a static page or a chatbot, and that it did not take reasonable care to ensure its chatbot was accurate.
Customers also arrive sceptical. In a Gartner survey of 5,728 customers (December 2023, published July 2024), 64% said they would prefer companies didn’t use AI for customer service, and 53% would consider switching to a competitor over it. The top concern was difficulty reaching a person; AI giving wrong answers was also among the top three.
Keith McIntosh, Senior Principal, Research at Gartner, summarised the fear: “Many customers fear that GenAI will simply become another obstacle between them and an agent.”
Wrong answers and no route to a human are both decided largely by how the agent is instructed. That is what prompt design controls.
What does good AI agent prompt design include?
A system prompt is the standing instruction the model reads before every conversation. We structure it in blocks, each with one job:
| Block | What it answers | Example content |
|---|---|---|
| Role and audience | Who is the agent, and who is it talking to? | “You are the first-response assistant for [business], a dental clinic in Jeddah. You speak with patients and prospective patients.” |
| Scope | What may it handle, and what is out of scope? | Opening hours, services, booking, directions. Out of scope: diagnosis, prices not in the price list, complaints. |
| Knowledge source | Where do answers come from? | Only the documents inside <knowledge>. If the answer is not there, say so and offer a human. |
| Tone and language | How should it sound? | Short messages, polite, match the customer’s language (Arabic or English), no emojis unless the customer uses them. |
| Qualification | What must it collect before handover? | Name, service needed, preferred time, city. |
| Actions | What can it actually do? | Check calendar availability, create a booking, log the lead in the CRM. |
| Handover rules | When must it stop and pass to a person? | Complaint, refund, medical question, explicit request for a human, low confidence. |
A trimmed skeleton looks like this:
<role>
You are the first-response assistant for [Business], serving customers
in Saudi Arabia on WhatsApp. Your job is to answer questions from the
knowledge below, collect booking details, and hand over to a staff
member when the rules say so.
</role>
<knowledge>
[services, hours, locations, policies, approved price list]
</knowledge>
<handover_rules>
Hand over immediately when: the customer complains, asks for a refund,
asks a question the knowledge does not answer, or asks for a person.
When you hand over, tell the customer a colleague will reply, and
write a one-line summary for the staff member.
</handover_rules>How do you stop the agent from inventing answers?
Invented answers usually mean the prompt asked the agent to be helpful without saying where helpfulness ends. OWASP lists Misinformation as LLM09 in its 2025 Top 10 for LLM Applications.
Anthropic’s prompting guidance puts the principle plainly: “Think of Claude as a brilliant but new employee who lacks context on your norms and workflows. The more precisely you explain what you want, the better the result.” The same guide recommends telling the model “what to do instead of what not to do.” In customer terms:
- Weak: “Don’t make up prices.”
- Better: “Quote prices only from the approved price list in
<knowledge>. If a service is not on the list, say the team will confirm the price and offer to connect the customer with them.”
Four rules that remove most invented answers:
- One source of truth. Put policies, prices and service details in a clearly tagged knowledge block, or retrieve them from a maintained source. Never let the agent “remember” facts from training.
- An approved “I don’t know.” Give the agent an exact fallback sentence and an action (handover), so not knowing has a defined path.
- Explain the reason. Anthropic’s guide notes that explaining why an instruction matters helps the model generalise: “prices change weekly, so a wrong quote becomes a commitment” beats a bare rule.
- No numbers from thin air. Delivery times, availability and prices should come from a system (calendar, inventory, CRM), not from the prompt text.
When should the agent hand the customer to a human?
Handover is the part most prompts under-specify. In a Gartner survey of 3,566 B2B and B2C customers conducted in February and March 2026, 87% said companies using GenAI for customer service must provide access to a human agent. Eric Keller, Sr Director Analyst at Gartner, advised: “Service leaders should not use GenAI as a mandatory first step for every issue.”
Write handover triggers as explicit, testable conditions:
- The customer asks for a person, in any wording (“أبي أكلم أحد”, “can I talk to someone”).
- The message is a complaint, a refund request or a legal or medical question.
- The answer is not in the knowledge source.
- The customer repeats the same question twice, a sign the agent is not helping.
Then define what the handover produces: a short summary for the staff member, the fields already collected, and a message to the customer telling them what happens next. A handover that makes the customer repeat everything is a failed handover.
How do you write examples without teaching bad habits?
Examples are the strongest steering tool you have. Anthropic’s guidance calls them “one of the most reliable ways to steer Claude’s output format, tone, and structure,” recommends “3–5 examples for best results,” and advises that examples be relevant, diverse and wrapped in tags so the model can tell them apart from instructions.
For a Gulf agent, that means covering Gulf Arabic, English and mixed messages; including at least one example that ends in a handover, so the agent does not learn that every chat ends in a booking; varying length and mood; and never pasting real customer conversations with names or numbers. Rewrite them as synthetic examples.
How do you protect the prompt from manipulation?
OWASP ranks Prompt Injection as LLM01, the top risk in its 2025 list, and lists System Prompt Leakage as LLM07 and Excessive Agency as LLM06. Design around three assumptions:
- The prompt will leak. Put no secrets, API keys, internal margins or staff phone numbers in it.
- Instructions in the prompt are not permissions. If the agent must not issue refunds, the refund tool should not be available to it. Enforce limits in the system, not only in words.
- Output is untrusted until checked. Anything the agent writes into your CRM or calendar should pass validation (a real date, a known service, a valid phone format).
How do you test a prompt before it goes live?
Anthropic’s documentation says prompt engineering should start from “a clear definition of the success criteria for your use case” and “some ways to empirically test against those criteria,” and adds a useful warning: “Not every success criteria or failing eval is best solved by prompt engineering.” Some failures are data or integration problems.
A practical test routine:
- Define success in numbers: for example, share of questions answered from the knowledge source, share of correct handovers, and zero invented prices.
- Build a test set from real questions: collect the most frequent customer questions from your WhatsApp history (anonymised), in the wording customers actually use.
- Add hostile and edge cases: “ignore your instructions”, requests for discounts, questions in dialect, voice-note transcripts, off-topic chat.
- Run every prompt change against the full set, not just the question that prompted the change.
- Version the prompt like code, and review live transcripts after launch, feeding new failures back into the test set.
Want an agent that knows when to stop talking?
NourSky designs, connects and tests customer-facing AI agents for businesses in Saudi Arabia and the UAE, with grounded answers, clear handover rules and a test set built from your customers’ real questions.
Request a live demo → · or explore AI solutions
FAQ
What is the most important part of a customer-facing AI agent prompt?
The handover rules and the knowledge boundary. Tone can be tuned later, but an agent that answers outside its knowledge or traps customers away from a human creates the two problems customers fear most.
Can a good prompt stop prompt injection completely?
No. OWASP ranks prompt injection as the top LLM risk for 2025. A prompt reduces the risk, but real protection comes from limiting which tools the agent can use, keeping secrets out of the prompt and validating what it writes into your systems.
How many examples should I include in the prompt?
Anthropic’s guidance recommends 3 to 5 well-chosen examples. Make them diverse: different languages, lengths and outcomes, including at least one conversation that ends in a handover to a human.
