Give these rules to any AI agent that calls the API on your behalf.
- Never guess ids. Use only ids the API returned. If two cases or codes match a description, stop and ask a human.
- Confirm before broad actions. Get a human's confirmation before any of these:
- an export with no
deviceorconversations(a whole-case export); - removing a member;
- any delete.
- an export with no
- Keep secrets out of prompts and logs. That means passwords, access, refresh and API tokens, and signed URLs.
- Treat collected data as confidential. Exports contain private messages. Do not paste export contents into tools or models that are not approved for that data.
- Back off on errors. On 429 or 5xx, retry with increasing delays and give up after a few tries.
- Check before you retry a create. Retry an action that creates something (a case, code or export) only after you have checked whether the first attempt already created it, or you will get duplicates.