For years, we’ve described customer experience as an evolution: person to person, person to agent, and now agent to agent. With personal AI agents, that next stage is moving into customers’ everyday lives.
Personal AI agents can research products, make purchases, process returns, and manage ongoing tasks on a customer’s behalf. That means the customer may never visit a brand’s website or speak directly with its team.
For customers, that’s convenience. For brands, it’s a quiet but serious shift. When an agent does the shopping, the brand risks losing the moments where it advertises, cross-sells, and earns loyalty. Brands risk being reduced to interchangeable fulfillment providers, picked on price and delivery speed by software that has no attachment to any of them.
This is not only a brand and line-of-business question, but it is also an IT responsibility. How can your brand remain a trusted interface as personal AI agents take on more of the customer relationship? To me, the answer starts with helping brands confidently engage with the agent each customer chooses. That means identifying the agent and the customer it represents, understanding what the customer has authorized it to do, and keeping the interaction within those limits.
Security and trust comes first
When a personal AI agent acts on a customer’s behalf, a brand needs to know the agent’s identity, whom it represents, and what it is authorized to do before sharing information or taking action.
These three steps are easy to confuse, but each serves a distinct and equally important purpose. Detection tells you an agent is present. Verification establishes the agent’s identity and whom it represents. Authorization defines what the agent may do on that person’s behalf.
Even the first step—distinguishing a human caller from an AI one—can’t rely on a single method. Using models to spot the patterns of AI callers helps, but it becomes a pattern that attackers can adapt to. We’ve solved this kind of problem before: voice, messaging and fax have developed shared protocols that help recipients establish who is on the other end. Personal AI agents need the same foundation, an industry-wide standard for identifying agents, built openly and used across brands, platforms, and providers.
Passing one step doesn’t satisfy the next. An agent that proves its identity hasn’t earned permission to disclose data or change an account. A personal agent should be bound to a specific customer, account, task, and time window. Anything outside of that grant should trigger verification, customer approval,or a handoff to a person. Managing these agents’ identities and their connection to the people they represent will be pivotal for businesses seeking to provide a meaningful approach to managing personal agent experiences.
Enterprises can continue managing customer identity through their chosen providers and authentication workflows. Those signals, however, do not establish what a personal agent is authorized to do on a customer’s behalf, so the model has to extend beyond identity and authentication. Emerging protocols, including Personal Agent Protocol (PAP), and Personal Agent Consent & Trust Protocol (PACT), are beginning to address how agents identify themselves and obtain permission to act. These protocols are still early and take different approaches to trust and consent, so we think the right posture is to evaluate the broader landscape openly and build for interoperability.
The brand and the customer both set the limits
Autonomy only scales when someone is in control, and that control runs both ways. The business decides how it engages. Admins should set which channels, queues, and directions accept personal agents and which identities or trust issuers to recognize, They should also define how to handle unknown agents and which actions need approval.
The customer decides what their agent can do. Customers should be able to l et explicit limits on what the agent can see and change and withdraw consent when needed. Agent-specific roles and permissions should govern both directions what the brand’s AI can access in external systems and what a personal agent can do within the brand’s systems.
A defined interface is only the start. Controls must prevent personal agents from gaining authority through repeated requests, persuasion or misuse of tools. The same controls apply to brand agents. Businesses should audit what their agents access or change, which permissions apply, and where a person approves an action. The business remains accountable for the outcome, whether an agent acts in its own systems or an external system.
Give every customer a personal relationship
A brand needs its own dedicated agent to work with customers and their personal agents, bringing relevant context, reliable service, and successful outcomes to each interaction.
Picture a sports retailer whose agent does more than answer order questions. With the customer’s permission, it knows their sizes, goals, and budget. It finds the right products, suggests a training plan and nutrition guidance that match how the customer lives, and completes the purchase with the customer’s approval. If something doesn’t fit, it initiates the return. When the customer’s own personal agent comes calling, the retailer’s agent is ready with context, authority, and a relationship already in place.
That goes beyond customer service. It’s a persistent personal experience that helps keep the brand’s direct relationship with the customer intact, even when agents sit between the two. The opportunity is to become a trusted counterpart to whichever personal agent the customer chooses, earning that relationship through the service the brand delivers.
The customer should not carry the coordination tax
Customer journeys span channels, people, agents, and systems. When those pieces don’t share context, customers end up connecting them. That’s the coordination tax. Customers should be able to approve consequential decisions without managing the coordination behind them.
A brand relationship agent can help remove that burden. It can handle a structured request from a personal agent by checking identity, authority, and policy; presenting permitted options and the proposed action; and bringing in a person for unusual requests. That person should see the verified agent, the request, and its scope.
For example, the brand can process a return within the customer’s authorization. If an exchange requires an additional payment, the customer approves that commitment. If a person needs to step in, the request should carry forward the work already completed and the permissions behind it. This means less effort for the customer and greater confidence for the brand.
Identity, scope, and decisions should carry across voice and digital channels, inbound and outbound, and every AI-to-human handoff. If a personal agent reaches the brand by phone or message instead of through a dedicated interface, a secure verification or handoff path should keep the experience moving. Suspected automation alone should not be treated as fraud.
Why Cisco
Building this at an enterprise scale takes more than a clever agent. It takes customer experience, security, observability, and infrastructure working together. This is where Cisco’s security expertise matters: helping brands engage with personal agents while protecting the customers and systems those agents interact with.
AI Agent 360 powered by AI Defense provides runtime protections designed to detect manipulation and unsafe behavior, including attempts to trigger unauthorized tool use. AI Agent 360 also brings management and oversight to customer-facing agents, with announced Splunk observability capabilities intended to deepen visibility into agent behavior and business impact.
Most enterprise AI agents inherit the limits of the department that built them. Service, sales, billing and marketing each own a fragment of the customer, and each is building its own AI front door. The customer gets faster fragments, not a better relationship. A personal agent, with its view of the customer’s goals, will notice immediately.
A brand’s agent has to work differently. It needs to carry a persistent understanding of the customer’s history, preferences and commitments across channels and over time, within the permissions granted. It has to keep working on an outcome long after a conversation ends and bring in people when judgement is required.
That is what Dialog, announced at WebexOne, is designed for. As the agentic harness for the Webex AI Agent platform, it is designed to help customer-facing agents become relationship managers at scale, with persistent context and long-horizon execution. Our view is that the conversation is only the start. The unit that matters is the journey, and ultimately the relationship.
The real test for the CX industry
Personal agents will change how customers engage with brands. The brands that thrive will decide early how to remain a trusted interface by recognizing the personal agent each customer chooses, setting clear limits on what it can do, and making every interaction feel like part of one relationship rather than a hundred transactions.
Trust before talk. Before sharing information or taking action, a brand needs to know which customer an agent represents and what that customer has authorized it to do. Consequential actions may still require customer approval. Detection, verification, and authorization answer different questions.
Control runs both ways. The brand decides which agents can interact with its systems and under what conditions. The customer decides what their own agent can do. Persuasion and repetition must never create new authority.
Relationship beats disconnected transactions. When a brand’s bots operate in silos, customers get disconnected transactions and the brand risks becoming an interchangeable fulfillment provider. A brand agent can carry context across channels and follow through over time, turning thousands of conversations and hundreds of journeys into one continuous relationship.
As organizations put their own customer-facing personal AI agents to work, governing them becomes just as important as building them. AI without accountability is a liability. Cisco is future-proofing this with AI Agent 360 with Splunk observability and our latest agentic harness, Dialog. Together, these capabilities help enterprises deploy and manage personal AI agents with confidence.
The shift to agentic CX is more than a technical upgrade; it changes how customers experience a brand. Customers will use their agents to hold us accountable. The brands that earn trust and maintain continuity will help define what loyalty looks like next.
Resources:
About The Author
