AI Voice Agents for Customer Service

AI voice agents fit bounded customer-service workflows with clear tools and a reliable human handoff.

Order status, appointment changes, intake, routing, and after-hours triage make practical starting points.

We would not start with rare exceptions that require judgment, broad permissions, and irreversible actions.

The safest pilot is deliberately boring.

A bounded workflow is safer than broad support

A launchable workflow has a defined start, required inputs, authorized actions, success response, and escalation path. “Handle support calls” has none of those edges. “Authenticate the caller and reschedule one existing appointment within the next 30 days” does.

Good first workflows share several traits:

• high volume and repetitive language,
• one or two systems of record,
• typed tool inputs and reversible actions,
• an answer that can be confirmed aloud,
• a human queue for exceptions, and
• a measurable completion event.

Exclude calls involving distress, regulated advice, complex disputes, large financial changes, or ambiguous identity until controls and staffing are mature. The model's fluency can make an unsafe boundary sound more capable than it is.

The control loop needs design before the script

A cascaded system connects turn detection, speech recognition, a text model, tools, and text-to-speech. A native audio system combines speech input, reasoning, and speech output in one model session. The voice-agent explainer covers the architectural trade.

Both designs need application controls:

Table 1 Download CSV

Control	Requirement	Release blocker
Identity	Match the action's risk	Data returned before verification
Authorization	Enforce permissions outside the model	Tool accepts a forbidden action
Confirmation	Repeat consequential changes	Action executes on ambiguous “yes”
Idempotency	One key per intended action	Retry creates a duplicate
Audit	Trace prompts, tools, results, and audio policy	Missing action record
Escalation	Live transfer with context	Caller reaches a dead end

The model can decide what it wants to do. The application decides what it is allowed to do.

Spoken copy needs a different writing rhythm

Spoken answers need different constraints from chat. Keep one idea per turn. Put the requested fact first. Avoid reading URLs, long lists, table-shaped data, or internal field names. Ask one question at a time.

For numbers and addresses, repeat the normalized value and ask for explicit confirmation. For a tool delay, acknowledge the work: “I'm checking that order now.” For a failure, state what succeeded before proposing the next step.

Interruption behavior belongs in the design. Some messages, such as legal disclosures or final confirmations, may need a non-interruptible policy. Most conversational filler should stop immediately when the caller resumes speaking.

A worked text-model cost example

Consider 1,000 calls at five minutes each. Assume the application sends 20,000 text input tokens per minute because it repeatedly includes instructions, tools, retrieved context, and conversation history. Assume it generates 600 output tokens per minute, including visible and reasoning output.

That produces:

• 100 million input tokens: 1,000 × 5 × 20,000,
• 3 million output tokens: 1,000 × 5 × 600.

Using Mercury 2's first-party price of $0.25 per million input tokens and $0.75 per million output tokens:

Table 2 Download CSV

Text-model charge	Calculation	Cost
Input	100 × $0.25	$25.00
Output	3 × $0.75	$2.25
Total model layer	$25.00 + $2.25	$27.25
Model layer per call	$27.25 ÷ 1,000	$0.02725
Model layer per call minute	$27.25 ÷ 5,000	$0.00545

The example is close to Inception's own half-cent-per-minute voice illustration because it uses the same broad token assumptions. It is not an independent bill estimate and does not include speech recognition, text-to-speech, telephony, platform fees, tools, storage, taxes, retries, or support.

The largest assumption is input volume. A system that resends the full conversation and large tool schemas can consume far more input than the caller's words suggest. Capture actual traces before forecasting a contract.

Run a sensitivity range around that assumption. Price half and twice the input volume, then vary call length, transfer rate, and retries. If a small prompt change moves the forecast materially, add token and context telemetry before committing to a traffic target.

Native audio needs a different calculator

GPT-Realtime 2.1 and Gemini 3.1 Flash Live Preview charge for audio tokens as well as text. Their native-audio rates cannot be compared with Mercury's text price without adding the missing speech layers on one side and the observed audio usage on the other.

Use completed calls as the denominator. A cheaper minute that fails to resolve the task can increase transfers, repeat calls, and handle time. Track model and platform cost per successful outcome, not only per connected minute.

For the current model shortlist, use Best LLMs for Voice AI Agents. The live first-answer table is a starting point, the call replay decides.

Build the replay before the pilot

Create 100 to 300 scripted or consented, redacted calls. Include ordinary successes and the conditions most likely to break the workflow:

• background noise and weak connections,
• accents, code-switching, names, dates, and account numbers,
• interruptions before and during a tool call,
• a correction after explicit confirmation,
• stale data and tool timeouts,
• identity failure,
• unsupported requests and policy exceptions,
• prompt injection in retrieved notes, and
• a human transfer that is busy or unavailable.

Replay every version against the same set. Score task completion, wrong-tool calls, duplicates, unauthorized disclosure, first audible response, tail latency, escalation, and cost. Listen to a sample of both passes and failures, aggregates do not reveal whether the agent sounded certain while doing the wrong thing.

Roll out by authority, not traffic

Begin in shadow mode: the agent observes calls and proposes actions without speaking or executing. Compare its decisions with the human outcome. Then allow answers with no account access, followed by read-only tools, reversible actions, and finally a narrow set of confirmed writes.

Each stage adds authority after its own acceptance gate. Traffic can increase inside a stage, but volume does not justify skipping one.

Define the rollback before each expansion: the error rate, permission incident, tail-latency threshold, or transfer failure that returns the workflow to the prior authority level. A rollback that depends on inventing a process during an incident is not a control.

Monitor drift after launch. Product catalogs change, policies move, provider models update, and callers discover new phrasing. Keep the replay set versioned, add every serious failure, and rerun it before changing the model, prompt, voice, tools, or turn detector.

The winning pilot is not the one that answers the most calls. It is the one that earns permission to handle the next class of action.