Let support look up orders without opening the admin panel

A customer writes in: their order has not arrived. Today, the support agent opens the admin panel, searches, clicks into the order, scrolls to shipping, then to payment, and pieces together a reply. Or, more often, they message a developer.

Here is the same request in Caterfli's web chat.

where is order #4821?

A moment later:

Order #4821 shipped yesterday and is out for delivery today. Paid by card, $64.00. The customer asked for evening delivery.

That is the whole interaction from support's side. The interesting part is what happened in between.

What the agent actually did

1. It proposed a call. The model read the question and proposed a tool with an argument — on an API connection something like get_order with 4821, on a database list_orders filtered to that id. A proposal is only a request.
2. The platform checked it. The tool exists and this agent has it. The workspace owns the connection behind it. The argument matches the tool's schema. The person asking holds the permission a read needs, chat.use. Policy allows a low-risk read without asking anyone.
3. It ran, and the model wrote a sentence. The result came back from your system, and the model turned the fields into a reply a person can paste into an email.

Each of those steps is written to the execution trace as it happens, including the ones where nothing ran. Every lookup has a record of who asked, which tool answered and what came back.

Setting it up for support

Give support their own agent. The quickest way to keep support inside support data is to give their agent only the tools support needs: orders, shipments, maybe customers. An agent's abilities are exactly the tools it has. On a database connection you can also untick tables, and row filters can limit a table to matching rows.

Give them the member role. A member can use chat and run agents, which covers reads. Anything that changes data needs tool.execute, which starts at manager. So if someone asks the agent to change a delivery address, the call is refused and the trace names the missing permission. That is deliberate. If support should be able to make changes, that person is a manager, and destructive calls still wait for approval.

Write one sentence of purpose. "You answer questions about orders for the support team" does more than three paragraphs about tone. Then say what it should refuse and what to say instead: "If somebody asks for card details, say you cannot see them." Instructions shape what the model proposes; the checks above hold whatever the instructions say.

No admin login to hand out

Support never touches the admin panel or a database credential. They sign in to Caterfli with a member role, and the credential for your system stays encrypted inside the connector.

If the team lives in Slack, WhatsApp or Telegram, the same agent can be reached there. A channel answers only senders on its allow-list, which starts empty. Binding a sender to their workspace account makes the agent act as that person, with the same role limits as in web chat.

What changes for the developer

Order questions stop arriving in their inbox, because the people asking can now get the answer themselves — and only the answer their role allows. If this sounds like your week, the "Can you check this order?" tax is the longer version of why it matters.