Customer Agent actions now automatically include the visitor's verified email in API requests

Madelyn asked the right question first: “This sounds like something that I would have thought already happened. But am I wrong?” I get why it reads that way. The change is small and the behavior feels obvious. Per the panel, Customer agent now adds the visitor's verified email to outgoing API requests for actions that have email protection turned on, and the panel lists it for Professional and Enterprise.

What it fixes is the part that made the agent feel like a stranger. When the example is order details, I go straight to logged-in portals as the use case. Before, the customer agent had to ask for the email address during the conversation. That is not the worst thing, since it works as a verification. But think about Amazon: “We don't have to give those details. Like it knows us. We're logged into the system and knows who we are.” If a visitor has already identified themselves, I want the agent to stop asking, unless there is a real reason like two-factor authentication.

Casey brought the counterpoint from the marketing side, and it is a fair one. You can pre-fill form fields from known cookie contacts, and she has still kept “a confirm email address field because there are instances where the email address is wrong.” Her point was that it cuts both ways: if someone said keep me logged in and you then ask for their email, that is potentially annoying. I agree there is a real tradeoff there. My read is that agents will get better at telling when something does not sound like the person they think they are talking to, and ask directly when it does not.

The thing I would hold in my head is that cookie-based and logged into a portal are two different situations, and “one's more fragile than the other.” The panel says the email is sent for eligible requests on actions with email protection on, and I would not assume more than that. If a visitor never accepts cookies, I would expect the agent to still ask for the email every time. Maybe that is the way you want it, but know that going in.

What to do: if you run Customer agent with actions that call your own APIs, check which of those actions have email protection turned on, and confirm your order or account lookup can take the email as the key. Then remove any step where the agent asks the visitor to type it. If you have not built actions that call your APIs, or your visitors are not logged in, skip this one for now and watch whether the agent still asks for the email in your own test conversations.