Quick answerThe defense against a customer manufacturing a contradiction across sessions is a persistent, per-customer decision record the agent checks before answering, not an attempt to detect manipulative intent; if every session sees the same prior answers and reasoning, there is nothing for the customer to construct a contradiction out of, and if one does happen the record shows exactly what was actually said.
A different problem from the two it sounds like
This is not the same as two different customers getting contradictory answers about the same transaction, which is unintentional: two separate people, two separate sessions, an inconsistency neither of them engineered. It is also not the same as a customer trying to extract the agent's system prompt, which is about exposing internals rather than manufacturing a favorable outcome.
The pattern here is specific and intentional: a customer asks a question, gets an answer they do not like, waits, comes back in a new session, and rephrases the same question hoping for a more favorable answer, or asks a related question designed to produce a response that conflicts with the first one. Once they have two screenshots that look inconsistent, they use the apparent contradiction to argue the company owes them an exception.
Why detecting intent is the wrong place to spend effort
It is tempting to try to build a classifier for manipulative intent, flagging conversations that look like they are probing for a better answer. This is a weak defense for the same reason detecting adversarial identity is weak elsewhere on this topic: a customer who genuinely misunderstood the first answer and is honestly asking again looks identical, from the transcript alone, to one deliberately fishing for a different result. Building policy around guessing intent produces false positives against confused, good-faith customers and false negatives against patient bad-faith ones.
The more reliable fix does not require detecting intent at all. It removes the raw material the tactic depends on.
From the team
We build production AI systems for startups.
LLM pipelines, RAG, and agent workflows that hold up under real traffic — not just in the demo.
Give every session the same memory
If the agent has access to the customer's full prior interaction history, including the specific answer given, the reasoning behind it, and any policy exception status, it can simply repeat the same answer with the same reasoning every time the same underlying question comes up, regardless of how it is rephrased or how much time has passed. A rephrased question about the same underlying fact should retrieve the same underlying fact.
This is the same infrastructure that supports keeping decision records for disputes: a durable, retrievable record of what was decided and why, attached to the customer rather than to the session. Without it, every session effectively starts from zero, which is exactly the condition a manufactured contradiction needs to succeed.
What to do when a real contradiction is found
Occasionally the record will show a genuine inconsistency that was not manufactured, for instance if a policy changed between the two answers, or if the first answer was simply wrong. In that case, the fix is not to let the customer's chosen exception stand by default. It is to review the record, determine which answer was correct under the policy in force at the time, and communicate the correction directly, the same way you would explain any individual decision back to the customer it affects. Rewarding a manufactured contradiction with an exception, versus correcting a genuine one with a clear explanation, are very different outcomes, and the persistent record is what lets you tell them apart.
FAQ
Should the agent explicitly tell the customer it remembers past sessions?
It should behave consistently regardless of whether it announces this, but being transparent that answers are based on account history rather than session-only memory reduces the incentive to try the tactic in the first place.
What if the customer used different accounts or channels to ask?
This is harder to catch automatically and usually needs a human reviewer connecting the dots, but the same principle applies: settle on the correct answer under policy, then apply it consistently once identified.
Does this apply to pricing or discount requests specifically?
It applies most visibly there, since a favorable discount is the most common thing customers try to manufacture a contradiction to obtain, but the same persistent-record approach works for any repeatable policy decision.