The permission model that separates an open-source support agent from a chatbot

The third ticket is where the two part company

Ask either system where an order is, or how to reset a password, and the replies look alike. Both read the help center, both write in your tone, both hand off when the customer asks for a person. Buyers compare them there, on the quality of the answer.

The third ticket decides the purchase. "Why was I charged twice?" "This button does nothing." "Does your API support pagination?" None of those answers sits in the knowledge base, because it was written before the problem existed. A chatbot has nothing to retrieve, so it escalates the transcript. An agent that can reach the billing account, the repository and the thread can finish the investigation. Then it hands a person a decision.

That line has little to do with how well either system writes.

What a chatbot answers, and where it stops

Intercom's Fin is the clearest example of the first kind. Fin is trained on a help center, a website, PDFs, Notion, Confluence or Box, and its integrations let it read and write in the systems you connect. It connects a supported helpdesk so it can hand off what it cannot resolve, and it is priced for that job: $0.99 per outcome, a $49 a month minimum that includes 50 outcomes, no seat costs on Fin itself (Fin pricing).

A chatbot reasons over your content and the conversation. Without a connector into the system of record, nothing in that loop says what a customer was charged, which build the button shipped in, or whether the endpoint takes pagination. The escalation comes from the edge of what the system was allowed to see, and model quality does not move that edge.

What a session reads before it replies

Kortix runs its own support that way, and Kortix describes it plainly: "Every inbound thread spawns its own isolated session with scoped access to the systems a support issue can touch: the product's knowledge, the codebase, and Stripe. It investigates, resolves what it can, and stops at a human for sensitive actions."

Three details make that work. A session starts from the thread, so the account and the code are read around a real complaint. The reach is scoped per connector, so the agent sees the billing account and the repository and little else. And the credentials never arrive: connector credentials are brokered server-side and never enter the machine.

A security reviewer asks that first. An agent holding a Stripe key inside its own environment is an agent whose sandbox can spend it.

The permission model lives in a file

Read access is the easy half. The write decides your risk.

In Kortix, approval gates you set. Off until you set them. A project that configures nothing runs every connector call, because default_mode falls back to allow_all. Set the mode to risk and risk runs a read and holds a write or destructive call for a person. Check that before a pilot, not after one.

The finer control is a rule. A rule matches a tool path such as gmail.send_email with action: require_approval or action: block, and conditions limits it to calls whose arguments match. A status reply can run while a refund waits.

1policy:2  default_mode: risk3 4policies:5  - match: gmail.send_email6    action: always_run7    conditions:8      - arg: to9        match: "*@example.com"10  - match: gmail.send_email11    action: require_approval

Rules live in kortix.yaml at the repo root, in front of the same review as code. A held call does not wait forever. Approval holds default to 24 hours, approvals.ttl sets the window from 5 minutes to 30 days, and a call nobody decides expires. That suits a refund and not a queue nobody watches over the weekend.

Run the three tickets as a test

Hand each candidate the same three tickets from your queue, and watch where the work stops. The double charge stops at the refund policy for a chatbot. An agent reads the billing record, then a person decides on the refund. The dead button stops at a screenshot request, then at a code path and a bug report. The API question stops at a documentation link, then at a test run against the endpoint.

Where it stops tells you what you are buying. A system that stops early leaves a person to finish those tickets. That person is the cost the purchase was meant to remove. A system that never stops is worse, which is why the approval rule belongs in the trial.

Volume decides which shape matters. If nine messages in ten are order status and password resets, a chatbot covers them at a predictable price, and an agent is a project you do not need yet. The costly tail needs three systems at once.

Where the helpdesk-native agent stops

Zendesk sells an agent inside its own suite, and it is a real step up from a chatbot. Zendesk documents AI agents that reason and take action, plus an Action builder that automates flows into third-party systems. It also ships reasoning controls and a sandbox for testing a change. For a team whose record already lives in Zendesk, that is a coherent purchase. It is priced per agent a month from €19 to €115, with €1.50 for an extra automated resolution.

What it reads is what the suite holds: tickets, customer context, and the apps somebody connected. It does not cover the repository behind the product, or the code path that made a button dead. Those live outside the ticket, so the investigation still ends with an engineer.

A self-hosted agent with tool-level approval is the third shape. The reach is wider, because you connect the systems yourself. The risk is managed by rules rather than by the edge of a vendor's suite. It asks more of you too: a rule set somebody writes and reviews, and a manifest in a repo.

Four questions for the vendor call

Four questions separate the three shapes faster than any demo. What can the system read outside your own content, and through which credential? What can it change, and which change needs a person? Who writes the approval rule, and where does that rule live? What happens to a held call when nobody answers it?

A vendor that answers those with a dashboard setting is selling a chatbot with longer arms. A vendor that answers them with a file in your repository is selling a system your security team can read. Kortix is the second kind, and it is the route we recommend when the expensive tail is the reason you are shopping.