What an AI Agent Should Never Do on Your WhatsApp Number (Consent, Opt-Outs, and Owner Takeover)

AI agent WhatsApp safety comes down to limits you set before the first message. A whatsapp ai agent can do real damage in an afternoon. One reply to a stranger, one first message to someone who never opted in, or one ignored "stop", and you are the one who has to explain it. This guide lists what an agent should never do on your number, what stays with you, and how to set those limits before you switch anything on.

What should an AI agent never do on your WhatsApp number?

An AI agent should never message someone who has not asked to hear from you, answer chats you did not choose, keep talking after you take over, ignore a request to stop, or send bulk or irreversible messages without your yes. Those five limits cover most of the damage a badly set up agent can do on a personal or business number.

Treat each one as a boundary you write down before you configure anything. Vague rules like "be careful" do not survive a busy inbox.

• Never message someone first unless you scheduled it.
• Never reply in a chat you did not name.
• Never keep talking once you have stepped in.
• Never treat a stop request as noise.
• Never send bulk or irreversible actions without your yes.

Even a mostly accurate agent still fails. The few wrong chats are the ones a customer remembers.

Who is responsible for consent and opt-out?

You are. Consent and opt-out are the sender's responsibility. An AI agent on WhatsApp sends in your name, so the obligation stays with your number. WhatsApp's business policy requires opt-in before you contact someone and requires you to respect any request to block or opt out. An agent does not change either rule.

WhatsApp's business policy says you may only contact people who gave you their number and agreed to receive messages from you. It also says you must respect every request to block, discontinue or opt out, on or off WhatsApp. Read that as the owner's job, not the software's.

In practice that means three things. Collect permission before the first message. Keep a record of each whatsapp opt-out request. Point the agent only at chats where both of those are true. For how to collect permission cleanly, read our opt-in collection guide.

Does the agent reply to strangers by default?

It should not, and a well-built agent defaults to silence. It should answer only the chats you named, and only after you switch it on. New incoming chats should stay out of scope until you decide otherwise. The exact defaults are in the setup section below, so you can check each one before the agent goes live.

Strangers are the risk most people miss. An unknown number writes to you, the agent answers, and now a conversation exists that you never agreed to. Treat every new chat as out of scope until you add it by name.

Gotcha: a default you never read is still a default you accepted. Read the chat scope before you turn anything on.

Can the agent start a conversation with someone who never wrote to you?

Only if you tell it to. An agent that replies waits for a message. An agent with a scheduled send can speak first, to the destination you set, or in the source chat if you set none. A first message to someone who never opted in is still your decision, so treat it like a cold message you would send yourself.

Scheduled sends are the path you set up in advance for an agent to speak first. You set the source chat and the time, and optionally a destination. Leave the destination out and the reply goes to the source chat. That fits a morning summary sent to your own team. It is the wrong tool for reaching out to customers who never asked to hear from you.

Gotcha: a schedule that points at people without permission is a cold message with a timer on it. Check the destination before you save the schedule, not after the first send.

What happens when you type in a chat the agent is handling?

Your message takes over the conversation, and the agent stays out of that chat while you handle it. Owner takeover is on by default, but automatic takeover only arms when every engine on your account is new enough to mark its own replies. Older engines get no automatic takeover.

This rule keeps you in the loop on the chats that matter most. Owner takeover on WhatsApp works like this: when you type into a conversation, you speak and the agent steps back. You should never have to fight the agent for the same chat.

Automatic takeover depends on what is running under your account. Blueticks arms it only when every engine serving you reports a version that marks agent replies, so the agent's own messages are not mistaken for yours. Extension 5.9.25 or later passes that check. Baileys pods do not arm automatic takeover yet, and an older gateway that is still connected keeps it off.

Failure mode: if one old engine is still connected, automatic takeover will not arm, so your typed reply will not pause the agent on its own. The same is true today for any account with a Baileys pod. Check your engine versions before you rely on takeover, and treat any chat where you cannot afford a double reply as yours, not the agent's.

How do you stop the agent immediately?

Send stop from your operator chat. The agent stops answering everyone, and any scheduled run that comes due while it is stopped is skipped, not held until you send start. If the operator chat serves more than one agent, reply to one of that agent's messages with stop so the right one stops. Turning an agent off is never refused by the checks that can block switching it on, so stop always works from that chat.

The operator chat is the one you set for the agent's notices and commands. Send help to see the command list. Set the operator chat before you go live, then test stop and start once while you are watching.

Gotcha: the operator chat is your stop from WhatsApp, so set one first. You can also switch an agent off with the toggle in the app, or by updating the agent with only the enabled setting set to false.

What if a customer types STOP?

Do not rely on the agent to read a customer's STOP as an opt-out. The agent has no built-in STOP handling for customers, so the request is yours to honour. This is the gap most people do not expect, and it is the one that causes complaints.

When a customer types STOP, do three things yourself. Stop the agent, or take the chat over. Remove that chat from the agent's trigger list so it does not answer again. Then reply to the customer and confirm the request is done. Do not wait for the agent to notice the word.

What should still wait for your yes?

Anything you cannot undo, anything that reaches more than one person, and anything that spends money should wait for your yes. That includes refunds, bulk sends, first messages to people who never wrote to you, and any change to who the agent may read or reply to. Automate the routine replies. Hold the rest for approval.

Think in three buckets. Routine replies in the chat you named can run unattended. Irreversible or wide actions need approval every time. Anything in between, a new contact or a new chat, gets a human look first.

Gotcha: an approval step nobody answers is just a delay. Decide in advance what the agent does when you do not reply. The safe answer is nothing. The approval loop covers how the ping and the yes work.

How do you set these limits before you switch an agent on?

Agent setup is in limited access right now, so this is the checklist to hold any setup to. Set five things before you switch the agent on: one trigger chat, new chats off, where replies go, what the agent may read, and an operator chat for stop and start. New agents are created paused, and an empty trigger list means the agent answers no chat at all. Here is the order to set them in.

1. Create the agent. It starts paused, so nothing goes out yet.
2. Set one trigger chat. Put a single chat you control in trigger_chat_ids, such as your own test chat. An empty list means no replies at all.
3. Leave new chats off. include_new_chats defaults to false, and chat_scope defaults to list, so the agent answers only the chats you named.
4. Check where replies go. Replies go back to the triggering chat unless you set send_chat_ids. Under the defaults, the agent reads its own triggering chat and only the chats in read_message_chat_ids.
5. Set your operator chat. Use it for start and stop, and send help once to see the commands.
6. Switch it on, then test. Send a message in the trigger chat and check the reply. Send one from a second chat and confirm the agent stays silent there.

A new agent starts paused, so you can finish steps 2 to 5 before anything goes out. Agent setup is limited to approved accounts right now. If you want access, email our support team and ask for access.

What breaks, and what to check first:

• A paused agent looks broken because it is doing exactly what you told it: nothing. Check its status before you debug anything else.
• A wrong chat stays silent. Groups and one-to-one chats have different IDs, so confirm the chat before you paste it in.
• An older engine keeps automatic takeover from arming, so your typed reply will not pause the agent on its own.
• The operator chat is your stop from WhatsApp. Without one, you would have to switch the agent off in the app.

If you plan to let the agent call WhatsApp tools too, read WhatsApp MCP tools first. Some agent configurations need a Blueticks operator review before they can be switched on, and that switch can be refused, and some setups also need workspace setup with our support team. Treat a refusal as the review working as intended.

Frequently asked questions

Does an AI agent need my customers' consent before it messages them?

Yes. Consent is the sender's responsibility, and the agent sends for you. WhatsApp's business policy requires opt-in before you contact someone, so collect that first.

Can an AI agent on WhatsApp message people first?

Only through a schedule you set, to a destination you chose. An agent that replies waits for a message.

What happens if I type in a chat my agent is handling?

Your message takes over the chat and the agent steps back. Automatic takeover only arms when every engine on your account is new enough to mark its own replies.

Does a customer's STOP switch off the agent?

Do not count on it. Stop the agent, remove the chat from its trigger list, and honour the request yourself.