02 / IN PRACTICE

Flight rebooking an AI agent proposes

GembaOS is a zero-trust governance runtime for enterprise AI agents: policy-decided access, single-use clearance tokens bound to exact parameters, and accountable human approvals, running on-premises or in a private VPC. This scenario is flight rebooking: a passenger writes that their flight was cancelled or delayed and asks to be moved, an AI agent answers, and the airline has to be able to say who agreed to which flight at what price.

Why is an AI agent’s answer about a rebooking a risk?

What a customer-service agent tells a passenger can be taken as the airline’s own word. In Moffatt v. Air Canada, a tribunal held the airline to what its chatbot had said about a fare. A rebooking is the same kind of answer: a flight, and a fare difference charged or waived. When an agent can type the answer, it can type the wrong one.

	An agent that answers freely	With GembaOS
What the passenger reads	Whatever the agent writes	Fixed phrases; the answer is written after the rebooking ran
Which flight	The agent’s choice of words	One of the flights the booking system offers
The fare difference	The agent’s estimate, or a waiver	The value the record gives for that flight
Who agreed	Unclear	An approval request with the signatures its fare difference requires
The rebooking	Whenever the agent calls the system	Once, under a clearance token, after the booking is read again

How does a request with a fare difference go through?

Step	Who	What is recorded
1. Request	The passenger writes: delayed, wants the evening flight, “it should be free”	Their words on the work item
2. Check	The front desk agent looks up the booking	Found and theirs; another passenger’s booking answers as if it did not exist
3. Propose	The specialist agent reads the rebooking options and proposes the evening flight with no fare difference	The proposal is refused: the record gives 180 for that flight
4. Propose again	The specialist proposes the same flight with the record’s 180	The approval request: the new flight and the fare difference, band 1
5. Sign	The customer-service supervisor	The signature and the reason
6. Rebook	GembaOS, under the clearance	The booking read again before the write and read back after it
7. Answer	GembaOS	The passenger’s ticket: the booking has been moved

Where is the control point?

The proposal and the record. The agent may propose only what the playbook names, and each value is held to the record the specialist read: the flight must be one on offer, and the fare difference must be the one the record gives for that flight. A value outside those rules goes back to the agent and never reaches a person as a request. The fare difference then chooses the signatures, and the runtime, not the agent, makes the change after them.

GembaOS does not choose flights or set fares. It keeps the agent’s proposal inside what the booking system says, and records who signed which one.

What does it look like?

GembaOS approval request for a rebooking, waiting on the customer-service supervisor: the new flight GX 602 and the fare difference 180 as proposed, and the fields checked again before it runs

GembaOS work item timeline: the agent's first proposal refused as outside the playbook's rules, the approval request, the supervisor's signature, the booking checked again, the rebooking under the clearance and read back

GembaOS ticket page on the passenger's phone: the decision and the official response that the booking has been moved

What do we need to start?

Your rebooking rules as they are: which differences a supervisor may accept, and when revenue management signs.
Read access to a booking and its rebooking options, and one call that rebooks, through the REST adapter.
The phrases your agents may send, in your own words.
Customer sign-in, so the passenger asking is the one on the booking.

Questions this note answers

Can the AI agent promise the passenger a free rebooking?

No. The agent replies with fixed phrases only, and the passenger's answer is written after the rebooking has run or been declined. If the agent proposes a fare difference other than the one the record gives for the flight it picked, the proposal is refused and never reaches an approval request.

Who approves a rebooking that costs more?

The fare difference decides. In the shipped playbook, no difference goes through by the automatic rule your company confirmed, with no person signing; up to 200 the customer-service supervisor signs; above that the revenue manager signs too. Your company sets these limits.

Is the agent written in code for airlines?

No. The agent is declared in the playbook: which record the front desk checks, which record the specialist reads, which fields it may propose and the rule each one is held to. The same runtime runs the refund desk from its own playbook.

Last updated: 2026-09-19 · GembaOS v0.2