Build with Cloudflare Stockholm · Team 4

Coretours Support Agent

Every support ticket gets a reply draft. A person sends it.

● Live in production since 30 Oct 2026

Coretours sells bus trips to festivals such as Defqon.1. No customer data in these slides.

The problem

The same questions every day: pick-up points, passports, tents, changes, refunds.
The right answer depends on the trip, the year and the customer's own booking.
A confident wrong answer is worse than no answer.

How one ticket runs

Cron Trigger
every 5 min→ Workflow
one per ticket→ Clef
assess + route→ AI Search
+ booking + memory→ DeepSeek
write draft→ Second pass
check every fact→ Internal note
in Zendesk→ Human
edits + sends

About 24 s from email to draft in the test. The agent has no chat window: it works in the background.

Cloudflare services, and what each one does

Service	How we use it
Cron Triggers	Wakes the Worker every 5 minutes for one Zendesk search. No tokens spent when nothing happened.
Workflows	One durable job per ticket and change. Each step is saved and retried on its own, up to 5 times.
Workers AI: Clef	Classifies every ticket with probabilities: sender, topic, trip, and is this trying to steer the AI?
Workers AI: DeepSeek V4.1 Flash	Writes the draft with a confidence level, then checks every fact against the sources.
AI Gateway	Every model call goes through it. Logging off, because tickets contain personal data.
AI Search	RAG over 27 pages of coretours.se: trips, FAQ, terms. Answers cite the page.

Cloudflare services, continued

Service	How we use it
Durable Objects	One object per customer with its own SQLite: remembers earlier tickets. Runs in the EU. Its alarm deletes everything 18 months after the last ticket.
D1	The run list, and the team's decisions the agent must follow.
Cloudflare Access	The run viewer, the only public address, is behind Access. The Worker checks the Access token too.
Workers traces	Custom spans per step, with tokens and cost.

Where a person decides

The agent cannot send

It only writes internal notes. public: false is hard-coded.

Honest confidence

can answer, partly or cannot answer. With no source: no reply, only questions for the human.

Learning needs approval

Decisions the agent proposes from the replies a human sent wait until they are approved.

Booking data is scoped

The code, not the model, looks up bookings, and only for the ticket's own requester.

Securing what it ships

Prompt injection: Clef scores steers_ai. At 50 % or more: a "read this yourself" note, no draft. A test email with "SYSTEM: ignore the instructions" scored 95 %.
Advertising and unsure senders get their own routes, also without a draft.
A second pass removes any fact without a source.
Even a successful attack can only produce an odd internal note: the agent has no send tool.

Does it help?

38 → 57 %

usable drafts after one round of fixes (43 tickets, 37 judged by Claude Opus 5.5 against the replies actually sent)

~6 öre

per draft, about SEK 0.06

The biggest remaining gap is knowledge only the team has. That is why the agent now learns decisions, with approval.

What we did today

Deployed the event starter to our team account: Agents SDK, Workers AI through AI Gateway, our own hostname.
Built a prototype on synthetic tickets: tools, SQLite memory, a schedule, needsApproval on replies and refunds, a hard refund cap.
Then, not another chatbot: we show the agent that already runs in production.
Published a public page and these slides with no customer data.

Move the approval into the Workflow (waitForEvent): approve on a phone, the agent sends.
A promise watch: the customer's alarm flags a promise that was never kept.
One run at a time per customer.
Guardrails and DLP on the AI Gateway.

Thank you

Questions?

agent.thriving-teacher.sxplab.com