Guide
Support automation risk matrix
Support automation risk depends on what happens when the answer is wrong, what customer state must be checked, and whether the workflow can change money, access, rights, safety, or protected data.
Updated July 23, 2026 · 7 min read
Direct answer
Use a three-level support automation risk matrix: green for stable public information, yellow for stateful or consequential work requiring approval, and red for privacy, security, fraud, legal, safety, or other cases that must remain human-controlled.
Green: stable and informational
Green work can be answered from maintained public information and does not change customer state, disclose protected data, or move money.
- Published product specifications
- Documented setup instructions
- Operating hours
- General feature explanations
Yellow: verify and approve
Yellow work may benefit from drafting, but the final answer depends on current order, account, subscription, billing, identity, or policy state. An authorized person should verify facts and approve the response.
- Refund and replacement requests
- Cancellations
- Billing changes
- Order edits
- Identity-dependent account help
Red: mandatory human control
Red work involves sensitive rights or high-impact harm. Use explicit deterministic detection and block automatic drafting or sending when appropriate.
- Privacy access and deletion
- Security incidents
- Fraud and chargebacks
- Legal or regulatory requests
- Unsafe incidents
- Unknown authentication or payment changes
Frequently asked questions
Can a frequent issue still be red risk?
Yes. Frequency does not reduce consequence. A common account-compromise or privacy request still requires human control.
Can yellow cases use AI?
They can use AI-assisted drafting when the required live state is checked and an authorized reviewer approves the response.
Should risk rely on one model classifier?
No. Combine deterministic rules for known high-risk language with contextual classification and a final action gate.