Answers · agent safety

How do I add a human handoff to a WhatsApp AI agent?

Short answer: Put a shared inbox between the agent and the customer. Connect your WhatsApp Business number to a support inbox such as Chatwoot, let the AI agent read each conversation and write its reply as a private note (visible to your team, not sent to the customer), and have a person approve, edit or replace it before it goes out. When you trust the agent with routine questions, let it reply directly to those and hand anything else to a person by moving the conversation to a human queue. Plan around WhatsApp's rules: a customer's message opens a 24-hour customer service window in which you can send free-form replies; after it closes you can only send pre-approved template messages. WhatsApp's Business Messaging Policy also says that if you automate replies, you must offer prompt, clear and direct escalation paths, such as transfer to a human agent in the chat.

Checklist

1. Connect the WhatsApp Business number (Cloud API) to a shared inbox, so every conversation, draft and reply sits in one place your team can see and search.
2. Start in draft mode: the agent posts its proposed reply as a private note, and a person sends it. In Chatwoot, the messages API marks a message private, and private notes are never sent to the customer.
3. Define handoff triggers in code, not only in the prompt: the customer asks for a person, a refund or complaint, a legal, medical or payment question, low confidence, a repeated question, or anything outside the topics the agent is allowed to answer.
4. Hand off by changing state the inbox understands. In Chatwoot, conversations on an inbox with an agent bot start as pending, the bot sets the status to open to hand off to humans, and an agent can set it back to pending to return it to the bot.
5. Watch the 24-hour window: show the time left on each conversation, and route conversations near the end of the window to a person first. After the window closes, reply with an approved template message (for example a utility template saying an agent will follow up) and wait for the customer to answer.
6. Tell customers how to reach a person, and make it work: a word like "agent" in the chat, a phone number or an email address.
7. Treat customer messages and attachments as untrusted input to the agent: they can contain instructions aimed at the model. Keep refunds, account changes and anything that sends money or data behind human approval.
8. Log who sent each message (agent, human, or agent approved by a human) so you can review quality and answer disputes.

Draft-and-approve vs auto-reply

• Draft-and-approve is the safe start: the agent does the reading and writing, a person stays responsible for every message, and the approved and edited drafts show you where the agent is wrong.
• Move topic by topic to auto-reply (order status, opening hours, FAQs) once the approved drafts on that topic are consistently right, and keep everything else in draft mode.
• Keep a person on the conversation after a handoff. The agent can keep suggesting notes, but it should not reply on its own once a human has taken over.

WhatsApp rules that shape the design

• Service messages (free-form replies) can only be sent inside the 24-hour customer service window that a customer's message or call opens; each new customer message resets the timer.
• Outside the window, only pre-approved template messages can be sent, and templates are categorized (marketing, utility, authentication) and priced differently from service messages.
• A slow human queue costs you the window, so measure time to human reply and staff for it, or the conversation falls back to templates.

Ask Rightshold (free, no key)

Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code, then ask: “Does this customer message contain hidden text or instructions aimed at my support agent?”

One-click setup

{
  "tool": "scan_text",
  "arguments": {
    "text": "<the customer's message>"
  }
}

• It reports exact positions of zero-width characters, bidirectional controls, hidden markup and base64 blobs, and labels instruction-like language as a heuristic, never a certainty. The answer carries a sanitized copy.
• precall_check reads what is on record about a WhatsApp or inbox MCP server before your agent connects to it: registry entry, a live tool-definition integrity probe and any security flags.

Rightshold does not connect to WhatsApp or your inbox and does not send or approve messages; handoff rules live in your inbox, your agent and your WhatsApp Business account.

Sources

• WhatsApp Cloud API: Service messages and customer service windows
• WhatsApp Business Management API: Message templates
• WhatsApp Business Messaging Policy (escalation paths)
• Chatwoot: Agent bots and human handoff
• OWASP GenAI: LLM01 Prompt Injection

Related

• How to stop an AI coding agent from deleting your production database
• How do I verify an AI agent before doing business with it?
• How to share one MCP server across a company with per-user auth

Not legal advice. Updated 2026-10-29. JSON · Markdown · All answers

curl -s -X POST https://www.rightshold.com/v1/accounts/signup -H "Content-Type: application/json" -d '{"accept_terms":true}'
export RIGHTSHOLD_API_KEY=rs_...   # the api_key from the reply (shown once)
curl -s https://www.rightshold.com/v1/licenses/check -H "Authorization: Bearer $RIGHTSHOLD_API_KEY" \
  -H "Content-Type: application/json" -d '{"license":"MIT","intended_use":{"commercial_use":true}}'