A Prompt Is Not a Control: What My AI Phone Agent Taught Me

What did I tell my AI phone agent, and why did it not hold?

Most owners who set up an AI agent treat the instruction box like a rulebook. You type what the agent must never do, you read it back, and it feels handled. I did the same thing, even after twenty years in executive roles in enterprise banking risk and governance.

At Garage Force of Greater Charlotte, my concrete coatings business, an AI voice agent named Mark answers the calls I miss. It tells the caller in its first sentence that it is an AI assistant, answers basic questions about floors, and books a consultation or a discovery call. It never quotes prices. When a caller wants to speak with me, it texts my phone and I call back.

I told the agent not to transfer calls to me unless it was necessary. It still could, because the transfer action existed. So I deleted the action, and now a transfer is impossible by design. The full story of that system, including what else went wrong, is in the Garage Force case study.

The instruction was a request. Removing the ability was a control. That difference is the whole of this post.

Why is a prompt a request and not a rule?

An AI agent reads its instructions, then reads the conversation in front of it, and decides what to do next. Most of the time it follows the instructions well. Most of the time is a fine standard for how polite the agent sounds. It is not a fine standard for something that must never happen.

Look at the words I used: unless it was necessary. I handed the agent a judgment call and then expected it to make that call the way I would, on every call, with every kind of caller. A person on the line who insists, sounds upset, or simply asks the question a different way changes what the agent thinks is necessary. The instruction was never the problem. Asking a judgment call to behave like a lock was the problem.

In banking risk work, a control is something that works whether or not anyone remembers it, and it is designed before the incident, not after. A sign that says do not open this vault is not a control. A lock is. AI agents deserve the same discipline, because they will be asked to do the thing you told them not to do, and they will be asked in ways you did not predict.

What counts as a real control for an AI agent?

A control changes what the agent is able to do, not what it is asked to do. For a small business, almost every real control is one of these four:

1. 01Remove the ability. If the agent must never transfer, refund, cancel, or delete, take away the action that does it. An agent cannot misuse a tool it does not have.
2. 02Narrow the permission. Give the agent access to the calendar it books, not every calendar. Give it read access where it only needs to look things up. Give it the information it should share and nothing it should not.
3. 03Put a person in the path. When a decision carries real risk, the agent hands off and a named person acts. In my business, the agent texts me when a caller wants to talk, and I own every callback.
4. 04Keep one official path. My callback alert once depended on a tag that did not always fire. I rebuilt it so the agent sends the text directly, then retired the other paths. One path you trust is better than four you hope will work.

Notice that none of these depend on how well the prompt is written. That is the point. A good control still works on the day the prompt is unclear, the caller is difficult, or the software vendor changes something underneath you.

Where do prompts still belong?

This is not an argument against prompts. Prompts are the right tool for everything that is a matter of judgment and tone: how the agent greets people, what it asks first, how it explains your service, and how it offers a next step without pressure. If the agent gets one of those slightly wrong, you adjust the wording and nobody is harmed.

The working rule I recommend is simple. If a mistake would be awkward, guide it with the prompt. If a mistake would cost money, break a promise, expose information, or reach a customer in a way you cannot take back, make it impossible and put a person in the path.

That same sorting shows up in how I decide what AI should do at all. Some work AI can do on its own, some it should support a person in doing, and some should stay with people entirely. I explain that sorting in Automate, Augment, Advise, or Avoid. The Avoid list is where most of your controls come from.

How do you check your own AI tools this week?

You do not need a consultant for the first pass. Take one AI tool your business already uses, whether a phone agent, a chatbot, or an assistant connected to your email or CRM, and give it thirty minutes.

1. 01List every action the tool can take, not just the ones you meant it to take. Look at its settings, its connected apps, and anything labeled tools, actions, or integrations.
2. 02Mark each action that must never happen without a person: transfers, refunds, prices, cancellations, deletions, and anything that sends information outside the business.
3. 03For each marked action, choose a control: remove it, narrow it, or require a person to approve it. Write down which one you chose.
4. 04Test it. Ask the tool to do the forbidden thing directly, then ask again in a different way. If it can still do it, the control is not in place yet.
5. 05Name one person who owns the tool and checks it each month, because settings, vendors, and your own needs will change.

If you find more than one surprise, write it into your AI policy so the next tool is set up the right way from the start. A Practical AI Policy for a 20-Person Company gives you a one-page outline to start from.

If you would rather have someone walk your tools with you, setting up controls, owners, and review steps for owner-led businesses is the work of AI governance consulting. For phone agents, chat, and follow up in a service business, AI consulting for service businesses covers how that work is set up. If you are still deciding whether and where AI belongs in the business at all, start with the AI Verdict.