What to Let an AI Agent Do on Its Own: A Guardrails Checklist for Reviews and Feedback

The useful question about an AI agent is not "should I use one". It is "what may it do without asking me", which is what guardrails are. An agent that asks customers for feedback, replies to reviews, or follows up with someone who had a bad visit is sending messages under your name. Some of those messages are routine and safe to send a hundred times a day. Some need a human eye every single time. The work is drawing that line before the agent starts, not after a customer forwards you an email you never saw.

This checklist covers the four jobs an agent typically takes on around customer feedback, with three columns for each: what it can do alone, what it should ask you about first, and what it must never do. If you want the wider picture first, start with the complete guide to AI agents for customer feedback and come back here when you are ready to switch one on.

Four kinds of guardrail

Every rule you will want falls into one of four groups. Keep them in mind and the checklist below will feel obvious rather than long.

1. Who it may contact. Which customers, how often, through which channel, and who is off limits. This is where opt-outs, cooldowns, and bounced addresses live.

2. What it may say. The tone, the facts it is allowed to state, and the things it must not promise. A draft in your voice is fine. A made-up refund policy is not.

3. What it may spend or promise. Discounts, free items, credits, callbacks. Anything that costs money or commits a person's time needs a ceiling.

4. When it must stop and hand over. The signals that end the agent's turn: anger, a safety or legal complaint, a request for a human, a customer who stops replying, a review it cannot answer well.

A good agent product gives you a setting for each of these. If it does not, keep that job manual.

Asking for feedback and reviews

This is the highest-volume job and the one most owners hand over first. The sequence is usually a short check-in after the visit, an invitation to leave a review a few days later, and sometimes a request for a testimonial after that. The detail of that sequence is in the automated review request emails guide. Here is what to allow.

Do alone

• Send the check-in and the review invitation to every customer on the list, on a schedule, inside the hours you set.

• Skip anyone without a valid email, anyone who bounced, and anyone who has opted out, and tell you it did.

• Wait before asking someone who has just been through a complaint, and ask them later once that conversation has closed well.

• Hold the queue when the day's cap or the month's allowance is used up, and resume on its own when it resets.

Ask first

• The first batch. You should see the list of people and read the three emails before anything goes out. After that, the routine can run.

• Any change to the wording, the sender name, or the timing. Those are your decisions, made once, and the agent should not drift from them.

• Adding a new source of customers, such as a newly connected point-of-sale or booking system. New sources bring new kinds of people.

Never

• Decide who gets the review invitation based on how they answered the check-in. Everyone who gets the check-in gets the invitation. Timing may change for someone who had a problem. The ask itself does not.

• Offer anything in exchange for a review, or hint at it.

• Email the same person twice in a season, or contact someone who asked to be left alone, for any reason.

• Send outside the hours a reasonable person would expect to hear from a business.

Replying to reviews

Replies are public and permanent. The upside of an agent here is speed and consistency. The risk is a reply that is technically polite and completely wrong about what happened. For how to keep drafts from sounding machine-made, see how to use an AI review response generator without sounding like one.

Do alone

• Draft a reply to every new review, in the voice you have taught it, within minutes of the review appearing.

• Post replies to four and five star reviews on its own, if you have allowed that, when the review contains nothing it would need to check with you.

• Keep a record of what it posted, when, and to which review.

Ask first

• Anything at three stars or below. These are the reviews other customers read most closely, and they often contain a claim you need to verify.

• Any review that names a staff member, mentions health, safety, money, or the law, or asks a direct question you have not answered before.

• Any reply that would state a fact about your business the agent has not been given: opening hours, prices, policies, what happened on a given night.

Never

• Argue with a reviewer, question their motives, or reveal details about them that they did not share in the review.

• Invent an apology for a specific event it has no record of. "Sorry the soup was cold" is only honest if someone has confirmed the soup was cold.

• Post the same reply, word for word, to more than one review.

Recovering an unhappy customer

This is the job with the most to gain and the most to lose. A fast, specific, private reply to someone who had a bad experience often turns the visit around. The same reply, sent with a promise you cannot keep, makes it worse. The agent should work like a good front-desk person with a clear budget and a manager within reach. Our version of this is described on the recovery conversations page.

Do alone

• Open a private conversation within minutes of an unhappy answer, apologize in plain words, and ask what happened.

• Offer something to make it right, but only from a short list you wrote, and only up to the value you set.

• Close the conversation when the customer says they are satisfied, and record how it ended.

Ask first

• Anything above the offer ceiling, or any offer not on the list.

• A conversation that has gone more than a few turns without the customer saying things are better.

• Any mention of a refund dispute, an injury, an allergy, discrimination, a legal threat, or the press. These end the agent's turn immediately and go to a person.

Never

• Admit fault on a matter of liability, or promise an outcome that depends on someone else.

• Keep messaging a customer who has stopped replying. Two follow-ups, then silence.

• Ask the person for a public review while the problem is still open.

Publishing testimonials

If the agent also invites customers to record a short testimonial, the recording is theirs until they say otherwise, and your website is yours. Both deserve a person in the loop.

Do alone

• Send the invitation, collect the clip, capture consent and a display name on the same screen, and transcribe it.

Ask first

• Every clip, before it appears anywhere. You are checking three things: the person agreed to be shown, nothing in the clip is a claim you cannot stand behind, and it looks and sounds like something you would put your name next to.

Never

• Edit what the customer said into something they did not say, or publish without the consent record.

The log and the preview

Two features make every rule above checkable.

The first is a log you can actually read. Not a dashboard of totals, but a line per action in plain language: "Emailed Maria Lopez a check-in." "Skipped John Carter, no email address." "Holding the next email to Dana Whitfield until you give the ok." "Drafted a reply to a two star review and left it for you." Each line should say why, when the why is not obvious. If you cannot reconstruct an afternoon from it, you cannot answer a customer who asks what you sent them.

The second is the preview. Before the agent sends its first batch, you should see who is on it and read every template it will use. That one look catches most of the mistakes people later blame on "the AI": the wrong column mapped to email, a sender name that is a company instead of a person, a check-in question that does not fit the business. After the first batch the routine can run, because nothing in it changes without you.

Limits that should exist by default

You should not have to invent these. If a product does not ship with them on, ask why.

• A daily cap on outgoing messages, so a bad import cannot email your whole history in an hour.

• A send window in your local time, something like business hours Monday to Saturday.

• Opt-out handling that stops every future message to that person the moment they click the link.

• A cooldown so a regular is asked at most once a season, not after every visit.

• An offer ceiling and a fixed menu of offers for recovery conversations.

• A turn limit after which a conversation goes to a person.

• A pause button that holds everything for the rest of the day, for the days you are short-staffed or something has gone wrong in the business.

• An off switch that stops the agent entirely and leaves the record intact.

The rules you are agreeing to on the agent's behalf

Three sets of rules apply to this work in the United States.

The Federal Trade Commission's rule on consumer reviews and testimonials, in force since 2024, bans fake reviews, buying reviews, and suppressing or hiding negative reviews. An agent that only invites the people it expects to be positive is doing the last of those, on your behalf. Ask everyone.

Google's content policy for reviews prohibits soliciting reviews selectively based on expected sentiment and prohibits offering anything in return for a review. The same "ask everyone, offer nothing" rule keeps you on the right side.

The CAN-SPAM Act requires every commercial email to carry a working unsubscribe link and to honor it promptly. Check-ins and review invitations count. Your agent's emails should carry the link without you asking.

The one-page checklist

Print this, or keep it with the notes for whoever runs the agent after you.

• I have read the first batch and all of the templates before anything was sent.

• Every customer who gets the check-in also gets the review invitation. Nobody is filtered by rating.

• Nothing is offered in exchange for a review.

• Opt-outs stop everything, and the unsubscribe link is in every email.

• A daily cap, a send window, and a cooldown are set and I know the numbers.

• Replies to three stars and below always wait for a person.

• The agent may not state a fact about my business it has not been given.

• Recovery offers come from a list I wrote, under a ceiling I set.

• Health, safety, money, legal, and press mentions go straight to a person.

• No conversation runs past a set number of turns without a person looking.

• Every testimonial is approved by a person, with the consent record attached.

• I can read a line-by-line log of what was sent and why someone was skipped.

• I know where the pause button and the off switch are, and so does one other person.

How FeedbackRobot's agents handle this

We built the three Feedback Agents around this list rather than adding it afterward. Get reviews shows you the first batch and its three emails before anything goes out, asks everyone for a review regardless of how they answered the check-in, skips people without an email or who opted out, and keeps a daily cap, a send window, and a 90-day cooldown by default. Its feed is the plain-language log described above, with the reason beside every skip and hold. Reply drafts an answer to every review, posts four and five star replies on its own only if you allow it, and always leaves anything at three stars or below waiting for you. Recover opens the private conversation, works from the offers and the limits you set, and hands over when a conversation runs long or touches something it should not decide. Pause holds everything for the day. Off stops it and keeps the record. The wider picture of how these jobs fit together is in the complete guide to AI agents for customer feedback.

Decide what it may do alone before it does anything. Then let it run, and read the log.