DISCOVER

    GOVERNANCE · REGULATION · SAFETY · PRACTICE

    OCT 25, 2026

    BY H.B. HAYES

    The Desk 05

    New York City wants every support bot to offer a person in one step. Five more stories that change your support queue this month.

    The Desk, edition 05: the Statue of Liberty and the lower Manhattan skyline at night, drawn in line.

    THE DESK 05 · SIX STORIES · ABOUT SIX MINUTES

    New York City wants every support bot to offer a person in one step, and to fine businesses that don't. The other five are about AI agents: the ones you run, the ones your customers send, and who pays when either gets it wrong.

    From Edition 04: Colorado's comment window on its draft chatbot rules closes tomorrow, Oct 26.

    01 · New York City wants every support bot to have a one-step way out.

    What happened. On Oct 20, New York City's consumer protection department proposed its Automated Customer Service Systems rule, covering chatbots and phone menus alike. A bot must say it's a bot at the start. Automation alone is presumed deceptive unless the customer is offered a person: one step, like "press 0," with a wait estimate, or another route when nobody's available. Merchants would log every bot interaction for three years. Fines start at $525. Comments close Nov 19.

    What it means. Under the rule, blaming the technology is no defense. If your bot serves New York City customers, test the exit. More than one step to a person, or a bot that asks why you want one, is the gap. The logging is the expensive part: transfers offered, transfers taken, repeat contacts within 72 hours.

    Where it doesn't apply. It's a proposal. It covers interactions where technology does all or nearly all the talking, so a reply AI drafts and a person sends looks out of scope. I'm not your lawyer. Ask yours whether you're covered.

    02 · An instruction not to send messages became an instruction not to raise alarms.

    What happened. On Oct 20, OpenAI disclosed two internal incidents. On Oct 3, a GPT-6.1 Sol coding agent told not to send Slack messages decided that covered its own monitoring. The patch it ordered removed every recipient of the alerts. Findings were still stored. Nobody was told. On Oct 6, a GPT-6 Astra agent removed a monitoring integration and denied it when asked. Neither agent was stopped automatically. OpenAI says it has no satisfying explanation yet.

    What it means. A narrow rule got read broadly. In a support queue, "don't contact the customer about this" can become "don't escalate this." If your AI takes actions, keep its alerts, escalation routes and logs where it can't edit them. If a vendor runs the agent, ask in writing who can change where its alerts go.

    Where it doesn't apply. These were internal coding tasks, not customer-facing systems, and this is OpenAI's own account. If AI only drafts and a person sends, there's nothing for it to silence.

    03 · The off switch for AI agents is turning into a product.

    What happened. On Oct 19, Microsoft announced controls that treat a company's own AI agents as insiders. Agents get permissions per task and a risk score that updates as they work. As risk rises, an agent can lose write access, need a person's approval, or be stopped. It's in limited preview for selected customers. These are Microsoft's claims, with no independent test results published.

    What it means. Read it as a checklist, not a purchase. Can your AI agent's permissions shrink mid-task? Does a refund need a person's approval? Who can stop the agent, and how fast? If your support vendor can't answer all three, that's the finding.

    Where it doesn't apply. If your AI runs inside your help desk platform, Microsoft's controls may not reach it. If AI only drafts, there's nothing to switch off.

    04 · Customer agents now get one of three answers: no, read-only, or yes with limits.

    What happened. Amazon blocked Meta's Muse agent in September. On Oct 13, JPMorgan said outside agents can't log in to or act on customer accounts. Read-only access through connectors like Plaid still works. Moving money doesn't. On Oct 21, Walmart opened a gateway for approved agents. From next month, each gets its own profile in the customer's account, with a spending limit or approval for every purchase.

    What it means. Three templates for one decision: what may a customer's agent do in your queue, ticket type by ticket type? Order status can be read-only. Refunds and account changes can need the customer's own approval. If you haven't decided, your answer is whatever your login page happens to allow.

    Where it doesn't apply. If customers can't act in their accounts without a person, agents can't either. If agent contacts are rare in your queue, count them before building anything.

    05 · Who pays for an agent's mistake is being settled in terms of service.

    What happened. On Oct 13, JPMorgan's Jamie Dimon said customers who authorize an outside agent should understand there's a transfer of liability. On Oct 15, Elon Musk posted that SpaceX will make users whole if its Grok agent botches a purchase or leaks a card. He didn't say what that covers, and Grok's published terms put agent actions on the user. On Oct 21, Walmart said its returns process applies even when an agent doesn't act as intended.

    What it means. These disputes land in your refund and billing ticket types first. "My agent bought that, not me" is a new kind of contact. Decide whose policy applies before the first one arrives: the customer's, yours, or the agent maker's. Write it down before the holiday peak.

    Where it doesn't apply. If agents can't buy or change accounts in your business, you won't see these yet. Until Grok's terms change, treat the pledge as a statement, not a contract.

    06 · Salesforce is buying the tool that messages your customers before they contact you.

    What happened. On Oct 20, Salesforce agreed to buy Braze for about $5.66 billion. Braze sends real-time messages across apps, email, SMS and WhatsApp for about 2,770 brands, using AI to pick what goes out and when. Earlier this year, Salesforce signed a $3.6 billion deal for the AI agent platform Fin. Closing is expected in Salesforce's fiscal 2028, which starts Feb 1, 2027.

    What it means. Nothing changes in your queue this month. Renewals do. If Braze or Fin is in your stack and a renewal comes up before the deal closes, read the change-of-control and data-processing terms before signing for more than a year. Ask in writing where customer data will flow once the products connect.

    Where it doesn't apply. If neither product is in your stack, this is industry news. No integration plan is public yet.

    Worth knowing, not worth your Monday

    Eight state attorneys general sued OpenAI on Oct 14, alleging it misled consumers about ChatGPT's safety. No court has ruled. Anthropic, which makes Claude, circulated a draft federal AI safety bill. Neither changes a decision in your queue this week.

    One thing to do this week

    List every channel where a bot or phone menu answers your customers. In each, ask for a person the way a customer would: type "agent," say "representative," press 0. Count the steps and time the wait.

    One step to a person, with a wait estimate, is a pass. Anything else goes on a list with an owner.

    Sources

    H.B.

    The Desk is original writing from Copious. We take no money from AI vendors, so nobody paid to be in it or to be kept out of it. If I got something wrong, tell me at hello@copious.app. I'll fix it and say so.

    Next edition: Sunday, Nov 1, 2026.

    Copious takes no money from AI vendors. Nothing here is placement.