Quick answerDefault to treating an unverified third party as having no authority over the account, full stop, regardless of how plausible their story is. The agent can still be helpful: it can take a message, explain the account owner's own channels for granting access, or offer a generic, non-account-specific answer, but it should not disclose account details, change anything, or agree to terms on the account holder's behalf until authority is verified through an existing mechanism, such as a shared login, an account-level authorized-contact list, or a callback to the number on file. This is a distinct problem from a customer whose own capacity is in question. Here the account holder may be entirely competent; the open question is whether the person on the other end of this specific conversation actually speaks for them.
Why plausibility is not the same as authority
A person claiming to negotiate for someone else will often have real details: an order number, a shipping address, even the account holder's date of birth. None of that proves authority, because most of it is either guessable, visible on a package, or obtainable from the account holder themselves without them intending to grant representation rights. The mistake an AI agent can quietly make is treating detail accuracy as a stand-in for verified authority. A human rep might apply judgment here, weighing tone and context; an agent should not be put in that position at all, because it has no reliable signal to weigh, and a wrong call is very hard to reconstruct after the fact. Set the bar at a specific, listed mechanism the account owner set up in advance, not at how convincing the caller sounds.
What the agent can still do without granting authority
Refusing to act on an unverified claim does not mean refusing to engage. The agent can confirm that a message will be passed along, describe the account owner's own options for adding an authorized contact, and answer general policy questions that do not depend on this specific account (shipping windows, return policy, what documents a dispute needs). This keeps the interaction useful for a legitimate representative, such as a family member helping during an emergency, while giving zero ground to someone probing for account access. The design question worth reviewing alongside this is how far the agent should go on hard-coded refusals that policy allows a human to override; see when an AI agent needs a human-approved exception, not a hard refusal for the escalation path once a legitimate but unverifiable case comes up often enough to need one.
From the team
We build production AI systems for startups.
LLM pipelines, RAG, and agent workflows that hold up under real traffic — not just in the demo.
Build the escalation path before the edge case, not during it
The riskiest version of this scenario is a fast-moving one: a person claiming to negotiate a refund or price match on someone else's behalf, pushing for an immediate answer before verification can happen. This overlaps with the broader question of what an agent should ever be allowed to negotiate autonomously; see should your AI agent negotiate price or terms with customers for the negotiation-authority side of this. Whatever the escalation path is, an unverified third party should never be the trigger that gets an autonomous concession approved faster. Log every one of these attempts the same way you would log a suspected account-takeover attempt, since the two are difficult to tell apart from the transcript alone, and route the pattern into the same review your team already uses for documenting AI agent reasonableness over time.
FAQ
Should the agent explain why it cannot verify the caller? Yes, briefly. State that account changes require verification through the account owner's own channel, and explain how to set that up. Being vague or evasive about the refusal creates more frustration than a short, honest explanation of the policy.
What if the third party has power of attorney or a legal guardianship document? That is a different, narrower case with its own verification path, typically requiring a human to review the document itself rather than an AI agent taking a claim at face value; treat any documentation claim as a trigger to route to a human, not as something the agent evaluates on its own.
Does this apply to business accounts where an assistant regularly acts for an executive? Only once that assistant has been added as an authorized contact through the account owner's own process. A recurring relationship still needs a one-time verification step; the agent should not infer standing authority from repeated contact alone.