TL;DR: Top-down AI mandates can drive pilots and demos without real process change, while merchants remain cautious about conversational AI agents handling high-stakes customer interactions, according to Riskified’s coverage of Bret Taylor’s remarks at the RILA CEO Forum 2026. The real test is not prompt quality but workflow design, guardrails, and identity-aware decisioning around who is making a request.
At a glance
What this is: Riskified argues that merchant AI adoption is being slowed by “AI tourism”, where demos and pilots outnumber production deployments and high-stakes customer workflows still resist conversational automation.
Why it matters: For IAM, NHI, and agentic AI programmes, the issue is not just whether AI can answer requests, but whether the request, the decision, and the authority behind it are governed well enough to trust automation in customer-facing processes.
By the numbers:
- The article says the cost of a human agent’s time is $5-20.
Context
AI tourism describes a pattern where organisations run many proofs of concept, demos, and prompt experiments but stop short of redesigning the operational workflow. In merchant environments, that leaves AI as a presentation layer rather than a control point, so adoption looks active while business change remains shallow.
The governance problem is not limited to model quality. When conversational AI is allowed to act on customer requests, the decision path, the identity behind the request, and the guardrails around exceptions all become part of the control plane. That is where identity-aware decisioning starts to matter for agentic AI and customer-service automation.
This dynamic is typical in organisations that treat AI as a tool to trial rather than a system to govern end to end.
Key questions
Q: How should organisations decide which customer workflows are safe to automate with AI?
A: Start by separating routine, low-stakes requests from actions that change money, account state, or shipping details. The safest automation targets are workflows with clear rules, reliable identity signals, and a low cost of error. If fraud, dispute, or recovery risk is material, keep human review in the loop until controls are strong enough to bound the agent’s authority.
Q: Why does identity matter when conversational AI handles customer requests?
A: Because the model is only one part of the decision. The real risk sits in whether the requester is legitimate, whether the request is consistent with prior behaviour, and whether the system is authorised to act without further checks. Without that context, AI can accelerate both legitimate service and fraudulent abuse.
Q: What breaks when AI is treated as a prompt machine instead of a workflow system?
A: Teams get impressive demos but little operational change. Prompt-only deployments leave exception handling, approval logic, fraud screening, and escalation paths untouched, so the organisation still pays the cost of human processing while assuming it has automated the process. The result is shallow adoption with limited business value.
Q: What should teams do when a customer-facing AI action could affect money or account control?
A: Require a human fallback or a stricter approval path before the action is completed. For refunds, address changes, and similar high-impact requests, the system should verify request legitimacy, apply policy checks, and stop short of autonomous execution when confidence is insufficient.
Technical breakdown
Why prompt quality is not the real adoption barrier
Prompt engineering can make an AI interaction look competent, but it does not prove that the surrounding process is safe to automate. In merchant workflows, the important question is whether the system can resolve requests, detect abuse, and preserve customer trust across the full lifecycle of an interaction. That requires workflow design, exception handling, and controls around when the model may act versus when it must defer. The underlying issue is that conversational output is only one control point in a larger decision chain.
Practical implication: Treat prompt quality as a narrow usability concern and assess the full workflow before approving automation.
How identity-aware decisioning fits customer service automation
Identity-aware decisioning means the system does not only ask what the customer wants, but also how trustworthy the requester and the request pattern appear. In refund and address-change workflows, merchants need to consider session signals, account history, and fraud patterns before allowing an AI agent to complete the action. This is especially relevant where the AI is not just assisting an employee but acting as the front line for a customer request. Without that layer, automation can amplify fraud or misroute legitimate claims.
Practical implication: Build request-level trust checks into automated service flows before expanding agent permissions.
Why workflow AI can create value where chatbots stall
Workflow AI differs from a novelty chatbot because it is embedded into end-to-end business processes and can remove toil rather than merely answer questions. In the article’s example, resolving item-not-received claims without human intervention can save meaningful handling cost, but only if the workflow is governed well enough to avoid harm to legitimate customers. That means the value sits in the orchestration of actions, not in conversational polish. Organisations that stop at prompt demos will miss that operational leverage.
Practical implication: Prioritise process redesign and action governance over isolated conversational use cases.
NHI Mgmt Group analysis
AI tourism is a governance symptom, not an adoption strategy. The pattern described here shows that organisations can generate visible activity without changing how work is actually done. Demos and pilots create motion, but they do not establish durable authority, decision rights, or exception handling. For practitioners, that means the real question is whether AI is being allowed to affect production outcomes or merely decorate an existing process.
Merchant automation needs identity-aware controls because the request itself is part of the risk. In customer service, the value of automation depends on knowing whether a request is legitimate, not just whether it is well formed. That puts identity signals, fraud context, and workflow policy at the center of agentic AI governance. The practical conclusion is that trust should be evaluated at the point of action, not after a model has already answered.
Workflow AI, not conversational AI, is where measurable value begins. A system that closes refund or item-not-received cases can change economics, but only when it is embedded into the operating process and bounded by controls. This shifts AI governance from content quality to decision integrity, which is a more demanding standard. Practitioners should judge AI by the business process it controls, not by the fluency of the conversation.
Identity-bound customer action is the control gap this article exposes. High-stakes merchant workflows fail when systems treat a request as text instead of a governed action tied to a requester, a risk profile, and an approval path. That gap is directly relevant to agentic AI security because the same problem appears whenever software is permitted to act on behalf of a person or a session. The conclusion is simple: if the request is not identity-bound, the automation is not yet trustworthy.
Agentic AI adoption will be decided by operational trust, not model capability. The article’s central tension is that LLM performance is improving faster than many organisations can rework controls, roles, and exception paths. That means adoption will be gated by whether teams can govern agent actions safely inside business workflows. Practitioners should assume that control design, not model novelty, will separate real deployment from AI tourism.
From our research library:
- Organisations that describe themselves as confident in their AI deployment actually experience a 72% security incident rate, compared to 33% for those who remain cautious, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
- Read next: Agentic AI Identity Risk Board Briefing
What this signals
Identity-bound customer action: merchant automation fails when the system cannot connect a request to a trustworthy requester and a governed approval path. That is the core control problem behind many agentic AI service designs, and it becomes more acute as organisations let AI move from chat to action.
AI programmes that stop at demonstrations will keep confusing activity with adoption. The operational test is whether the workflow has been redesigned so the agent can complete work safely, or whether the human still has to finish the job behind the curtain.
Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey. That gap suggests governance maturity will lag demand unless teams build controls around identity, authority, and exception handling.
For practitioners
- Define high-stakes workflow boundaries Separate low-risk customer intents from actions such as refunds, shipping changes, and account recovery, then require stronger controls for the latter.
- Add identity checks to agent decisions Use request context, account history, and fraud signals before letting a conversational agent complete a customer action.
- Measure automation by process completion Track whether AI actually resolves the end-to-end workflow, not just whether it can draft a response or pass a demo.
- Set explicit human fallback rules Require human review when the request is unusual, financially sensitive, or likely to affect legitimate customers if the agent is wrong.
Key takeaways
- AI tourism produces visible experimentation without durable process change, which is why many merchant AI efforts stall before production value appears.
- The key governance issue is not just model quality but whether customer requests are identity-aware and safe to execute.
- Workflow AI can reduce cost and toil, but only when authority, fraud context, and fallback handling are built into the operating process.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The article centers on when an AI system is trusted to act on behalf of a requester in business workflows. |
| ASI02 — Tool Misuse | The concern is not chat output alone but unsafe action execution inside merchant processes. | |
| Recommendation — Constrain agent authority so customer-facing actions remain bounded by identity and approval policy. Restrict agent tool use to approved workflow steps and block direct execution on high-risk actions. | ||
| NIST AI RMF | GOVERN — AI Governance and Accountability | The article is about organisational control design, not model performance alone. |
| Recommendation — Assign ownership for AI actions, exception handling, and escalation paths before scaling deployment. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | AI-assisted customer workflows still need clear authorisation boundaries for sensitive actions. |
| Recommendation — Apply PR.AA-05 to ensure AI can only trigger customer actions that have explicit permission and policy support. | ||
| MITRE ATT&CK | TA0006 — Credential Access | Refund and account-change abuse is driven by trust in the requester, a common precursor to fraud and abuse. |
| Recommendation — Map high-risk customer-action abuse to TA0006 and monitor requests that resemble credential or account takeover patterns. | ||
Key terms
- AI Tourism: A pattern where organisations experiment with AI through demos, prompts, and pilots without redesigning the underlying process for production use. The result is visible activity but limited operational change, because the system remains dependent on human workflows and does not absorb meaningful business work.
- Workflow AI: AI that is embedded into an end-to-end business process and can help complete work rather than just generate text. In practice, it depends on orchestration, exception handling, and governance around when the system may act and when it must defer to a human.
- Identity-Aware Decisioning: A control approach that evaluates both the request and the requester before allowing an action. In customer operations, it combines identity, behaviour, and transaction context so the system can distinguish legitimate service from fraudulent or out-of-policy requests.
- High-Stakes Customer Action: A customer request that changes money, account state, or delivery details, such as refunds or shipping address changes. These actions need stronger governance than simple information queries because a wrong automated decision can create fraud exposure or harm legitimate customers.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, and machine identity security. It helps practitioners build the control thinking needed for systems that act on behalf of users and workflows.
Published by the NHIMG editorial team on July 11, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org