Chatbot human handoff: a person takes over the conversation

How an operator joins the dialog

The owner gets a dialog card in Telegram. The operator replies right on the card, and the reply goes to the client on behalf of the bot. At the same time the bot goes silent for a set time, 60 minutes by default, so it does not cut in on the person.

A client on the site sees everything in the same chat window. While the window is open it checks for replies every four seconds, and in a background tab once every twenty. The person's reply is signed "Manager", and a message "The manager has joined and will answer you personally" is shown once. While the bot is silent because an operator is present, the visitor sees "Message passed to a manager". How such a window is installed and what it looks like is described on the page about the website chatbot.

The bot does not interrupt the operator

Before every send the bot checks again whether a human has taken the dialog. This check works in Telegram and on the site. Thanks to it the bot will not insert a line in the middle of an operator's answer, even if the client has written several messages in a row.

Owner commands

The owner has about thirty commands in Telegram: pause, quiet mode, switch on, "busy" and "free", a list of dialogs. The command "reply" makes the bot answer the last message itself. The command "chat" shows the dialog feed, and "summary" shows a short digest and the last ten replies. These commands are accepted only from the owner. A short summary on operator connection is enabled for some bots, and we set it up for your task.

The "no promises" mode

The owner's most common fear is that the bot will promise too much. That is what the "no promises" mode is for. Questions about a meeting, price, payment and deadline go to the owner as a card, and the bot writes to the client "received, the owner will answer personally". The mode is set per bot, and sales bots get one more layer: a price is quoted verbatim from the price list, inventing one is forbidden, and the words "in stock" and "lead time" are banned.

There is no "never" guarantee here, and we say so directly. In October 2026 a sales bot once named a discount that did not exist. So the mode works together with a conversation log: it shows where the bot answered by itself and where it passed the talk to an operator, and the scenario can be corrected. Where the bot takes prices from is covered on the page about the AI chatbot on your data.

Closed entrances

A request to the bot without a key is rejected: we checked this on the site chat. A request for operator replies without a key is also rejected, for six bots. The Telegram webhook accepts requests only with a secret header. There is a limit on request frequency from one visitor and one address, and a daily cap on model spending for each bot.

An honest caveat: the browser lets any address talk to the chat, so protection rests on a key, a rate limit and a daily cap, not on a whitelist of sites. A watcher follows the model balance and sends an alert if funds run out.

Checking your bot as an attacker would

If a bot runs on a language model, it is worth testing for instruction hijacking. We have two routes. The ready AI Agent Security Kit for $150 contains 13 attacks, a hardening checklist, a hardened instruction template and a two-layer detector of instruction hijacking as an n8n node; it is described on the AI Agent Security Kit page. The Security Audit service from 380 $ follows the OWASP methodology.

An important caveat from the specification: this is an audit and hardening, not certification and not a guarantee of absolute security.

How this connects to other pages

Where cards come from and how not to irritate clients is described in the section about the lead capture chatbot. Where the cards go next is in the section about integrations. Prices are on the pricing page, and a request goes through contacts.