AI Voice Agents for Customer Service

Speed-table leaders are usually the wrong model for a support call.

As of August 3, 2026, first-answer rank and quality rank disagree on the rows we publish. Several of the quickest models fail the task bar. Strongest rows miss a live-call budget.

We would start with a bounded workflow, not broad support. Order status, appointment changes, intake, routing, and after-hours triage. Rare exceptions that need judgment, broad permissions, and irreversible actions wait.

Fluency is the trap. A model reads an unsafe boundary in the same confident tone it reads a safe one.

A bounded workflow is safer than broad support

"Handle support calls" has no start, no required inputs, no authorized actions, and no escalation path. "Authenticate the caller and reschedule one existing appointment within the next 30 days" has all four.

Launchable first workflows share a shape: high volume, repetitive language, one or two systems of record, typed tool inputs, reversible actions, an answer that can be confirmed aloud, a human queue for exceptions, and a completion event you can count.

Distress, regulated advice, complex disputes, large financial changes, and ambiguous identity stay out until controls and staffing are mature. Those calls are not a later chapter of the same script. They are a different product, with a different permission surface.

Teams skip this cut for social reasons, not technical ones. Rescheduling appointments looks small in a steering meeting. "Handle support" looks strategic, then fails in production because nobody can say what success was, or which tool the agent was allowed to call.

Write the workflow as a contract before you write the prompt. If you cannot name the start event, the allowed tools, the confirmation, and the human exit, you do not have a voice-agent job. You have a demo.

Permissions belong in the application, not the prompt

Cascaded systems connect turn detection, speech recognition, a text model, tools, and text-to-speech. Native audio systems combine speech input, reasoning, and speech output in one model session. Our voice-agent explainer covers that architectural trade.

Both designs still need application controls. Models decide what they want to do. Applications decide what is allowed.

Table 1 Download CSV

Control	Requirement	Release blocker
Identity	Match the action's risk	Data returned before verification
Authorization	Enforce permissions outside the model	Tool accepts a forbidden action
Confirmation	Repeat consequential changes	Action executes on ambiguous "yes"
Idempotency	One key per intended action	Retry creates a duplicate
Audit	Trace prompts, tools, results, and audio policy	Missing action record
Escalation	Live transfer with context	Caller reaches a dead end

Prompt discipline does not substitute for a permission check. Prompts request. Permission checks refuse.

Handoffs fail in the same way. Pass the live call with verified identity, intent, collected fields, completed tool actions, unresolved questions, and a short transcript summary. Tell the caller what happens next and whether anything must be repeated. If the human queue is busy, leave a reference and a way back. Silent drops into a queue are not escalations. They are the original problem, plus a second wait.

Spoken answers fail when they read like a screen

Chat can dump a table. Callers cannot. Keep one idea per turn. Put the requested fact first. Do not read URLs, long lists, table-shaped data, or internal field names. Ask one question at a time.

For numbers and addresses, repeat the normalized value and ask for explicit confirmation. For a tool delay, acknowledge the work: "I'm checking that order now." For a failure, state what succeeded before proposing the next step.

Interruption behavior belongs in the design. Legal disclosures and final confirmations may need a non-interruptible policy. Conversational filler should stop the instant the caller resumes speaking.

Read one more category aloud before shipping: every string the agent can speak that arrived from a database. Product names, street abbreviations, and order references were written for screens. Synthesizers pronounce them literally. Normalizing those into speakable forms is unglamorous work, and it removes a surprising share of repeat questions.

If you only test with typed transcripts, you will ship an agent that is correct on paper and unintelligible on the phone.

First-answer rank and quality rank do not agree

Chat forgives a slow model because the user reads while it writes. Calls do not. Silence is a failure state, and callers fill it by repeating themselves, which corrupts the turn the agent was in the middle of handling.

That pressure sends teams to the top of a speed table. Current first-answer rows look like this:

Table 2 Download CSV

Model	Latency (first answer)	Output speed	Type	Overall score
Gemini 3 Flash	0.75s	199 t/s	Non-Reasoning	60
GPT-5 (high)	1.33s	66 t/s	Reasoning	59
Claude Opus 4.5	1.42s	52 t/s	Non-Reasoning	63
GLM-4.5	1.45s	51 t/s	Non-Reasoning	58
Claude Sonnet 4.6	1.60s	47 t/s	Non-Reasoning	64
Claude Opus 4.6	2.37s	44 t/s	Non-Reasoning	68
Kimi K2.6	2.88s	40 t/s	Reasoning	60
GPT-5.4 nano	3.64s	191 t/s	Reasoning	66

Read the last column. First-answer rank and quality rank disagree, and they disagree in the direction that hurts a support workflow. Several of the quickest rows are among the weaker models on task. The strongest models sit in the slower half.

So the pick is an intersection, not a maximum. Set a latency budget from the call type, set a task bar from the workflow, and choose only from models that clear both. That set is usually small. On some weeks it is empty, which is a real finding rather than a reason to relax the task bar.

Two honest limits on that table. It times text completions, not calls, so it screens candidates and cannot rank them for voice. And a caller experiences the whole clock, from end of their speech to first audible audio, with turn detection, transcription, synthesis, and transport all added to the model's share. Our TTFT explainer covers why those two numbers are not interchangeable.

For the current shortlist, use Best LLMs for Voice AI Agents. That table narrows the field. Replay decides.

You do not have to use one model. Route greetings, clarification, and routine tools through a fast conversational row, and send policy or document work to a stronger background model. That split still needs one trace, explicit acknowledgments, idempotent actions, and tests for stale or duplicated results. The replay has to earn every extra branch.

The model layer is the cheapest line on the bill

Consider 1,000 calls at five minutes each. Assume the application sends 20,000 text input tokens per minute because it repeatedly includes instructions, tools, retrieved context, and conversation history. Assume it generates 600 output tokens per minute, including visible and reasoning output.

That produces 100 million input tokens and 3 million output tokens.

At Mercury 2's currently listed $0.25/$0.75 per million input and output tokens, the text layer costs:

Table 3 Download CSV

Text-model charge	Calculation	Cost
Input	100 × $0.25	$25.00
Output	3 × $0.75	$2.25
Total model layer	$25.00 + $2.25	$27.25
Model layer per call	$27.25 ÷ 1,000	$0.02725
Model layer per call minute	$27.25 ÷ 5,000	$0.00545

Those totals use the price shown above on our review date, and they land close to Inception's own half-cent-per-minute illustration because they borrow the same broad token assumptions. If the listed price has moved since, the shape of the table survives and the totals do not.

Half a cent a minute is also the number that misleads people, because it is one line on an invoice with seven or eight lines:

Table 4 Download CSV

Layer	Charged on	Usually larger than the text model?
Telephony	Connected minutes, numbers, regions	Yes
Speech recognition	Audio minutes	Yes
Text-to-speech	Characters or audio seconds	Yes
Text model	Input and output tokens	Baseline
Platform or orchestration	Minutes, sessions, or seats	Often
Tools and systems of record	Calls, seats, or contract	Varies
Logging, storage, and review	Retention volume and staff time	Underestimated

Native audio changes the calculation again rather than simplifying it. GPT-Realtime 2.1 and Gemini 3.1 Flash Live Preview charge for audio tokens as well as text, so their rates cannot be set beside Mercury's text price until the missing speech layers are added on one side and observed audio usage on the other.

Use completed calls as the denominator throughout. Cheaper minutes that fail to resolve the task raise transfers, repeat calls, and handle time, and those costs land in a different budget where nobody attributes them to the model.

Input volume is the largest assumption above. Systems that resend the full conversation and large tool schemas consume far more input than the caller's words suggest. Capture actual traces before forecasting a contract, then price half and twice the input volume and vary call length, transfer rate, and retries. If a small prompt change moves the forecast materially, add token and context telemetry before committing to a traffic target.

A replay set is the only regression catch

Create 100 to 300 scripted or consented, redacted calls. Include ordinary successes and the conditions most likely to break the workflow:

• background noise and weak connections,
• accents, code-switching, names, dates, and account numbers,
• interruptions before and during a tool call,
• a correction after explicit confirmation,
• stale data and tool timeouts,
• identity failure,
• unsupported requests and policy exceptions,
• prompt injection in retrieved notes, and
• a human transfer that is busy or unavailable.

Replay every version against the same set. Score task completion, wrong-tool calls, duplicates, unauthorized disclosure, first audible response, tail latency, escalation, and cost.

Listen to a sample of both passes and failures. Aggregates never reveal whether the agent sounded certain while doing the wrong thing, and that specific failure is the one customers escalate to a regulator rather than a support queue.

Dashboards that report "containment" without those cases are vanity metrics. Containment can mean the caller gave up.

Authority is the rollout unit, not traffic

Begin in shadow mode: the agent observes calls and proposes actions without speaking or executing. Compare its decisions with the human outcome. Then allow answers with no account access, followed by read-only tools, reversible actions, and finally a narrow set of confirmed writes.

Each stage adds authority after its own acceptance gate. Traffic can increase inside a stage, but volume does not justify skipping one.

Define the rollback before each expansion: the error rate, permission incident, tail-latency threshold, or transfer failure that returns the workflow to the prior authority level. Rollbacks invented during an incident are not controls.

Monitor drift after launch. Product catalogs change, policies move, provider models update, and callers discover new phrasing. Keep the replay set versioned, add every serious failure, and rerun it before changing the model, prompt, voice, tools, or turn detector.

Winning pilots are not the ones that answer the most calls. They earn permission to handle the next class of action.