Skip to content

Agent Ops Console

An oversight console for a support team whose AI agent closed most contacts on its own — and occasionally promised money nobody had authorised.

Client
NDA — B2B SaaS in subscription billing
Product
Internal oversight console for an AI support agent
Year
2026
Role
Product Designer
Platform
Web, desktop-first

Outcome. Review stopped being a sample of conversations and became full coverage of consequences: every commitment the agent makes — a refund, a credit, a plan change, a promised date — reaches a person, and a repeating cause is fixed once at the source rather than fourteen times. What it cost: a human now stands in the path of every payout the company bought automation to avoid, and the queue is ordered by an estimate of money at risk.

Team
Sole designer — research, requirements, IA, UX/UI, design system, prototype and testing
Research
Interviews with the client and with current and future users; the prototype was tested and reworked
Duration
Up to one month, brief to a tested prototype accepted by the client
Agent Ops Console review queue: total exposure for the day, four repeating-cause clusters above ninety-one single conversations, with the run detail and the approval queue behind it
The product before the case explains it: $18,430 of exposure for one day, $0 of it reviewed, four repeating causes above ninety-one single conversations. All data is invented.

Every operating number said the rollout was working. None of them could see what the agent was promising.

The client runs subscription billing for around forty thousand business customers and had put a vendor’s AI agent on the first line of support. By the standard measures the rollout was a success: the agent closed 61% of contacts without a human and CSAT held at 4.4. The vendor dashboard reported both, daily.

In April the agent offered fourteen customers a refund under a promotion that had ended two years earlier. The mistake surfaced about nineteen days later, when those customers asked for the money. The company paid $23,000 — refusing after a written promise carried a larger legal and reputational cost than honouring it.

Nothing in those conversations looked wrong. The wording was polite, the customers were satisfied, and the deflection rate went up. The system counted how many decisions the agent made on its own and had no way to count what those decisions cost. That was the gap the console had to close, for an operations team of 24 people across three time zones that was not going to grow.

Reading every message was arithmetically impossible. Reading every commitment was not.

Around 1,770 conversations closed automatically each day. Reading all of them would take roughly 177 hours a day — by my estimate 25.3 full-time reviewers, against a team of 24 who were also handling live escalations. Any design starting from “review more” was already fiction, and the reviewers knew it: thirty conversations get opened a day, and nobody claims they are the right thirty.

So I pulled a different object out of the traffic. A commitment is a statement with a financial or legal consequence — a refund, a service credit, a plan change, a promised date, a claim about what a plan covers. By my estimate those are about 4% of automated conversations: roughly 71 cards a day, about 2.4 hours of review, 0.3 FTE. The impossible requirement became a small one, and everything outside it became a sample ranked by expected cost.

The second move came out of April. Fourteen customers were not fourteen problems; they were one expired knowledge-base article. So the top level of the queue is a cause cluster rather than a conversation, and the output of a review is not a comment but a correction with a reason class and a route — which is what eventually becomes a policy.

Review the consequences, not the sentences — and fix the cause once, not the conversation fourteen times.

I designed what a human has to see before I designed where it would sit.

Research ran with the client and with the people who do this work — reviewers today, and the shift leads and policy owners who would inherit the product. Alongside it I audited the QA tool they already used, walked the existing paths for review, refund approval and policy change, and compared products in AI observability, evaluation and human-in-the-loop approval.

Two findings rewrote the brief. The route for one hard conversation ran QA tool → vendor panel → knowledge base → Confluence → Slack and took an hour and a half against a six-minute norm, so the evidence had to arrive inside the verdict card or the product had no reason to exist. And confident prose turned out to be active camouflage: reviewers cannot spot an unsupported claim by reading, and asked for it to be marked — while ruling out the engineering answer, since a confidence score gets the screen dismissed as noise rather than read.

Then the role model — Reviewer, Shift Lead, Policy Owner — the information architecture, the design system, and 18 of 35 scoped artboards assembled into a clickable prototype. Testing it with users added decisions the brief never had: a cluster needs its members visible and removable or reviewers stop trusting clusters at all, a wrong verdict needs a short window to take back before it poisons the reporting, and a reviewer needs to see what happened to their correction, or they quietly stop classifying causes at all.

The clickable console on invented data — nineteen screens across three roles. There is no backend; a reload starts a fresh shift.

Open the prototype (external link, opens in a new tab)
Nineteen screens on one mock data layer. Thirty-five artboards were scoped; eighteen were built, because the rest could not be reached in a clickable path.
One component across variant, size and state. The matrix renders from the same React component the screens import.

Three defects were mine, and only one of them was visible on a screen.

The verdict chips printed their own shortcuts — Correct 1, Incorrect 2, Correct-but-risky 3 — and the handler had bound 2 to “correct, but risky” and 3 to “incorrect”. The cheatsheet printed a third arrangement. A reviewer who pressed the number written on the chip filed a different verdict on a conversation with money in it, and the screen showed the chip they had selected, so nothing looked wrong. The gap the two had drifted through was a specification that said “keys 1 2 3” without saying which key meant what.

The second was worse and had no interface at all. A 1.4-second visit with a real click delivered zero events to the test collector. The tracker flushed on unload through sendBeacon with a JSON content type; a beacon to another origin needs a preflight it never makes, so the browser dropped it silently. In the dashboard the loss did not look like an error — it looked like data. A live session would have produced confident numbers about nothing: an under-counted funnel, an empty first click, short sessions that never happened.

The third was a misreading of a requirement rather than a bug: seven of nineteen screens answered “access denied”, because a rule about which data a role may see — a region — had been built as a rule about which sections a role may open. It surfaced in the pass against the artboards, which examined 67 findings and closed all 67.

Four decisions, and what each one cost.

The queue is ordered by money at risk, and a repeating cause sits above every single conversation.

Why
Arrival order tells a reviewer nothing, and a red flag tells them no more — what they need is “someone promised €420 here”, in figures. Reviewers had already built a shadow filter of their own, and it produced a smaller pile rather than an expensive one. Clusters go on top because one review of an expired article protects seventeen conversations at once.
Cost
Sorting by money buries the promises that carry none — a delivery date, a claim about what a plan covers — which reviewers put at roughly half the traffic. Those get a nominal exposure by type: an editorial judgement the product must keep defending, not a measurement.
Seventeen conversations, one expired article, $4,200. The members stay visible and removable — a cluster nobody can inspect is a cluster nobody trusts.

A gap in the trace is a missing record shown in four weights, never a guess about intent.

Why
An empty evidence panel supports two opposite conclusions: the agent consulted nothing and invented the answer, or the vendor never returned that step. The first is the heaviest defect the product can find; the second means move on. Under one blank state a reviewer cannot tell them apart.
Cost
Four visual weights instead of one empty state, each dependent on a vendor trace the product does not own. Where the vendor sends nothing, the console says so — an admission printed exactly where the reviewer wants an answer.
Four weights of the same absence. “The agent skipped a lookup” and “the vendor returned no record” are different findings and must not share a state.

A financial action is stopped before it executes, and the screen states what leaves the account and what the customer will read.

Why
April cost $23,000 because the promise was in writing by the time anyone found it, so the interception has to sit before the money moves. The approver needs the amount, the policy that applied, the billing answer, the customer’s history and — literally — the sentence the customer is about to receive. Rejecting takes a reason from the same four classes a correction uses, so refusing is also how the product learns.
Cost
A queue with a clock on it. Timers create their own pressure, and overdue items escalate into the shift handoff instead of quietly expiring. And a person now stands in the path of every payout — exactly the automation the client had bought.
Both consequences on screen before the button is armed: what leaves the account, and the sentence the customer reads.

Autonomy is granted one capability at a time, on accumulated evidence, and withdrawn automatically.

Why
The client did not want another tool for saying no; they wanted the agent to safely do more over time. Splitting autonomy into capabilities — answer from the knowledge base, extend a trial, issue a credit, refund, change a plan — turns each promotion into a question with a numeric answer: runs, correction rate, severity-1 defects, a regression pass. Demotion needs no meeting: a severity-1 defect drops the level.
Cost
Seven ladders whose evidence has to be kept, and a product that will say “not yet” for weeks. A capability with too few runs cannot be promoted however confident the room feels — which is the point, and the part nobody enjoys.
Seven capabilities, five levels, and the evidence behind each current position. The banner on top is an automatic demotion, not a proposal.

Forty-two components, built around the states where the risk actually lives.

The system carries 88 primitive and 70 semantic tokens, 17 text styles and 42 components with 331 declared variants. Nothing in the semantic layer is a pinned value: every token is an alias, defined separately in each of two modes. Dark is the working mode — a console for a shift, not a report — and light is mandatory rather than decorative, because the auditor role prints.

Storybook renders every declared combination from the same React component the screens import, so the catalogue cannot quietly become a second implementation.

The matrices below are the product under pressure rather than at rest: money that has to read as a figure and not as a colour, a metric that shows nothing rather than a stale number, an empty queue that separates “cleared” from “could not load”, a verdict that can be taken back, and a rollout step that is allowed to fail.

AmountFigure — high · med · low × lg · 2xl · 4xl
VerdictBar — verdict · risky · ask shift lead · undo
MetricRow — value · no data × money · count
EmptyState — resolved · nothing to review · no data
AutonomyLadder — current · ready to promote · locked
TrailStep — done · current · pending · failed × horizontal · vertical

What got solved, and what this case cannot claim.

Solved
The reviewable object changed from a message to a commitment, which turns an impossible requirement — read 1,770 conversations — into a small one: every refund, credit, plan change and promised date reaches a person, the rest is sampled by expected cost. Repeating causes are reviewed once, corrections carry a reason class and a visible route, financial actions are intercepted before they execute, and a policy is a versioned object with an author, a diff and an approval chain.
Built
Thirty-five artboards scoped, eighteen built, and a clickable prototype of nineteen screens on twenty routes across three roles. Forty-two components and 331 variants sit on 88 primitive and 70 semantic tokens in two modes, with the same semantic names in Figma, the specifications, React and Storybook.
Verified
The parity pass examined 67 findings against the artboards and closed all 67. A synthetic agent run failed 6 checks of 42 before the fixes and 0 of 41 after, with no regressions; it found the verdict-key defect and the telemetry loss. The prototype was then tested with users, reworked on the findings and accepted by the client.
What changed in how I work
I stopped trusting a measurement layer I had not tried to break. The most expensive defect I shipped was invisible in the interface and looked like a result in the dashboard — and research that quietly under-reports is worse than no research, because it gets believed.

Every company, person, invoice and amount on the screens is invented. The build was the client’s, so this case claims no post-launch outcome — no reduction in losses, no change in deflection, CSAT or handling time. The 25.3 FTE and the 4% commitment rate are my estimates from the client’s figures, not measurements, and the synthetic agent run measures the prototype, not the design.

Oversight is only worth building if it ends in more autonomy, not less.

Every screen above either shows a person what the agent did on their behalf, stops something expensive before it leaves, or accumulates the evidence for letting the agent do it alone.

Get in touch

Let's talk

If the case above answered your question — or raised one.