Skip to main content
When the AI Agent performs sensitive operations, Typewise injects verified parameters (such as user_email) directly into integrations. The AI Agent never generates or modifies these values – they come from trusted sources only. Configure actions with verified parameters so integrations receive trusted identities. The external system can then validate permissions (e.g., that a user can refund their own order). This prevents impersonation and unauthorized access.

​
Configure verified variables

Define verified variables in Guardrails (Settings → Guardrails → Verified Parameters tab). Verified variables configuration
FieldDescription
Variable nameKey used in the payload (e.g., user_email, user_id)
TypeText, Number, or Yes/No
ActionDelete or edit the variable
The user_email variable comes pre-configured and can’t be deleted. It’s always available for email verification.

​
Verification by channel

​
Chat widget

Pass verified parameters through the chat widget configuration. Signed parameters are trusted. 
window.twConfig = {
  clientId: 'your-client-id',
  variables: {
    user_email: '[email protected]',
    user_id: '12345',
    subscription_tier: 'premium'
  }
};
Pass any data (user ID, subscription status, account type) for the AI Agent to trust during execution.

​
Email

For email channels, Typewise verifies only the sender’s email address. Challenge: Email addresses can be spoofed, and customers often forward emails. Solution: Typewise verifies senders by confirming they receive responses. When a customer replies to a Typewise email, the platform checks metadata to confirm delivery. If the sender isn’t verified and an action requires verified email:
  1. The AI Agent asks the customer to reply
  2. Once they reply, Typewise verifies the email
  3. If verification fails, conversation hands off to a human agent
Typewise may request verification if the customer has only sent a single email without prior history.

​
Guardrails

Missing verified variable: If an action requires a variable that isn’t available, the system hands off to a human agent. Permission validation: The integration must check permissions. For sensitive actions like “Refund Order”, your MCP server or API must verify the user’s identity and authorization. See Guardrails settings to configure.

​
Map parameters to actions

When configuring an AI action, map verified parameters to inputs:
  • Verified Parameter – from trusted context (e.g., user_email from chat widget)
  • Static Value – fixed value for every execution
This ensures the AI Agent never generates sensitive data like user identity.

​
See also