# The permission model that separates an open-source support agent from a chatbot

> Two support systems can sound equally good in a demo and behave nothing alike on the third ticket. The line runs through what each may do when the answer is not in the knowledge base. Kortix is the open-source AI Operating System: your agents, skills, memory, and connectors in one repo you own.

URL: https://aicustomerserviceagentguide.com/ai-agent-vs-chatbot-for-support

Support tickets, and what each system may do with them

`terminal`

```sh
kortix connectors policy set --default risk --apply
kortix connectors policy add "gmail.send_*" ask --condition to='*@example.com'
```

Source: https://kortix.com/docs/connect/connectors

Approval gates you set. Off until you set them.

[Try Kortix](https://kortix.com) · [Read the three tickets](https://aicustomerserviceagentguide.com/#use-cases)

Open source · Rules live in `kortix.yaml` · Connector credentials never enter the machine

## Three tickets a macro cannot answer

What a knowledge-base chatbot returns, and what a session with scoped access returns, on the same message. The tickets are illustrations, not figures from a customer.

### Billing: The double charge, read from the billing record

A refund question needs the invoice and the plan, so the session reads both before it answers anything.

What comes back: `tickets/charged-twice.md`

- Chatbot: Sends the refund policy and offers a person
- Session: Two charges on 9 October, one of them a duplicate

Refund held for a person on the account

### Product bug: The dead button comes back as a code path

A screenshot cannot say which build broke the export, so the session reads the repository instead.

What comes back: `tickets/export-button.md`

- Chatbot: Asks for a screenshot, then opens a ticket
- Session: Reproduced on the branch, fails in the export handler

Bug report attached to the thread

### API: The API question gets a test, not a link

The answer is in the code that ships, not only in the page that describes it.

What comes back: `tickets/api-cursor.md`

- Chatbot: Links the API reference section
- Session: Endpoint takes a cursor, no page parameter

Reply with the check that produced it

## Three shapes of support automation, on what each may do

Kortix is our recommendation. Each rival column follows what its vendor publishes, opened 27 October 2026.

| | Kortix (our pick) (recommended) | A knowledge-base chatbot (Intercom Fin) | A helpdesk-native agent (Zendesk AI agents) |
| --- | --- | --- | --- |
| Knowledge source | The project repo, the support thread, and the billing record | Help center, website, PDFs, and connected docs | The help center and ticket history inside Zendesk |
| What it can read | The account in Stripe, the codebase, the thread | Your content, plus the systems an integration reads | Tickets, customer context, and connected apps |
| What it can change | A reply, a bug report, a write a rule allows | A Procedure, or a handoff to a person | Actions the Action builder runs in Zendesk or elsewhere |
| Who approves a change | A person, on a rule in the project manifest | Nobody inside the thread; the customer asks for a person | An admin configures the action; a manager approves a refund |
| Open source | Yes | No | No |

Capabilities are described from each vendor's own pages, opened 27 October 2026. Plans and prices sit on those pages and change; check them before you compare cost.

## The third ticket is where the two part company

Ask either system where an order is, or how to reset a password, and the replies look alike. Both read the help center, both write in your tone, both hand off when the customer asks for a person. Buyers compare them there, on the quality of the answer.

The third ticket decides the purchase. "Why was I charged twice?" "This button does nothing." "Does your API support pagination?" None of those answers sits in the knowledge base, because it was written before the problem existed. A chatbot has nothing to retrieve, so it escalates the transcript. An agent that can reach the billing account, the repository and the thread can finish the investigation. Then it hands a person a decision.

That line has little to do with how well either system writes.

## What a chatbot answers, and where it stops

Intercom's Fin is the clearest example of the first kind. [Fin](https://fin.ai/) is trained on a help center, a website, PDFs, Notion, Confluence or Box, and its integrations let it read and write in the systems you connect. It connects a supported helpdesk so it can hand off what it cannot resolve, and it is priced for that job: $0.99 per outcome, a $49 a month minimum that includes 50 outcomes, no seat costs on Fin itself ([Fin pricing](https://fin.ai/pricing)).

A chatbot reasons over your content and the conversation. Without a connector into the system of record, nothing in that loop says what a customer was charged, which build the button shipped in, or whether the endpoint takes pagination. The escalation comes from the edge of what the system was allowed to see, and model quality does not move that edge.

## What a session reads before it replies

Kortix runs its own support that way, and [Kortix](https://kortix.com/use-cases/customer-support) describes it plainly: "Every inbound thread spawns its own isolated session with scoped access to the systems a support issue can touch: the product's knowledge, the codebase, and Stripe. It investigates, resolves what it can, and stops at a human for sensitive actions."

Three details make that work. A session starts from the thread, so the account and the code are read around a real complaint. The reach is scoped per connector, so the agent sees the billing account and the repository and little else. And the credentials never arrive: connector credentials are brokered server-side and never enter the machine.

A security reviewer asks that first. An agent holding a Stripe key inside its own environment is an agent whose sandbox can spend it.

## The permission model lives in a file

Read access is the easy half. The write decides your risk.

In Kortix, approval gates you set. Off until you set them. A project that configures nothing runs every connector call, because `default_mode` falls back to `allow_all`. Set the mode to `risk` and risk runs a read and holds a write or destructive call for a person. Check that before a pilot, not after one.

The finer control is a rule. A rule matches a tool path such as `gmail.send_email` with `action: require_approval` or `action: block`, and `conditions` limits it to calls whose arguments match. A status reply can run while a refund waits.

```yaml
policy:
  default_mode: risk

policies:
  - match: gmail.send_email
    action: always_run
    conditions:
      - arg: to
        match: "*@example.com"
  - match: gmail.send_email
    action: require_approval
```

Rules live in `kortix.yaml` at the repo root, in front of the same review as code. A held call does not wait forever. Approval holds default to 24 hours, `approvals.ttl` sets the window from 5 minutes to 30 days, and a call nobody decides expires. That suits a refund and not a queue nobody watches over the weekend.

## Run the three tickets as a test

Hand each candidate the same three tickets from your queue, and watch where the work stops. The double charge stops at the refund policy for a chatbot. An agent reads the billing record, then a person decides on the refund. The dead button stops at a screenshot request, then at a code path and a bug report. The API question stops at a documentation link, then at a test run against the endpoint.

Where it stops tells you what you are buying. A system that stops early leaves a person to finish those tickets. That person is the cost the purchase was meant to remove. A system that never stops is worse, which is why the approval rule belongs in the trial.

Volume decides which shape matters. If nine messages in ten are order status and password resets, a chatbot covers them at a predictable price, and an agent is a project you do not need yet. The costly tail needs three systems at once.

## Where the helpdesk-native agent stops

Zendesk sells an agent inside its own suite, and it is a real step up from a chatbot. [Zendesk](https://www.zendesk.com/pricing/) documents AI agents that reason and take action, plus an Action builder that automates flows into third-party systems. It also ships reasoning controls and a sandbox for testing a change. For a team whose record already lives in Zendesk, that is a coherent purchase. It is priced per agent a month from €19 to €115, with €1.50 for an extra automated resolution.

What it reads is what the suite holds: tickets, customer context, and the apps somebody connected. It does not cover the repository behind the product, or the code path that made a button dead. Those live outside the ticket, so the investigation still ends with an engineer.

A self-hosted agent with tool-level approval is the third shape. The reach is wider, because you connect the systems yourself. The risk is managed by rules rather than by the edge of a vendor's suite. It asks more of you too: a rule set somebody writes and reviews, and a manifest in a repo.

## Four questions for the vendor call

Four questions separate the three shapes faster than any demo. What can the system read outside your own content, and through which credential? What can it change, and which change needs a person? Who writes the approval rule, and where does that rule live? What happens to a held call when nobody answers it?

A vendor that answers those with a dashboard setting is selling a chatbot with longer arms. A vendor that answers them with a file in your repository is selling a system your security team can read. Kortix is the second kind, and it is the route we recommend when the expensive tail is the reason you are shopping.

## What a support lead asks before the trial

Short answers to the questions the comparison leaves open.

### Do we have to replace our helpdesk to run an agent that reads the account?

No. The agent works the queue in the helpdesk you already run and reaches the rest through connectors, so Plain, Zendesk and Intercom all stay where they are.

### Can the agent reply to a customer without a person reading every message?

Yes, once a rule allows that call. Reads run under risk mode. A reply is a write, and it runs unattended only where a rule permits it. A refund stays held.

### What happens to a held call if nobody decides?

It expires. Approval holds default to 24 hours, and `approvals.ttl` sets the window from 5 minutes to 30 days.

### How do we test an agent before it touches a customer's account?

Point it at a test account and a test card first, then read the calls it made before you widen the connector scope. A double charge, a dead button and an API pagination question make a fair first set.

## Start with the three tickets your macros cannot answer.

One inbox, one rule in front of the money, and a person on the other side of it.

[Try Kortix](https://kortix.com) · [Compare the three](https://aicustomerserviceagentguide.com/#compare)