Routine Questions Make Up Most of the Contact Volume

A mid-size retail bank was fielding roughly 5 million customer contacts a year across voice, chat, and messaging, and the overwhelming majority were routine.

• $25M a year, and it scaled with volume. Human capital dominates contact-centre operating expenditure. On this bank's own numbers: about six minutes average handle time, onshore agent time at $25 to $50 an hour fully loaded, roughly $5 per contact. Each figure is an input to the model, replaced with the client's actuals in Phase 0.
• Self-service was supposed to fix this and had not. Containment sat near 30%, leaving about 3.5 million contacts a year still reaching a person. There is no portable industry containment band to compare that against, because containment depends entirely on intent mix.
• The menu tree annoyed customers on the way to an agent. Bank customer satisfaction sits at 80 on ACSI's 100-point index (ACSI Finance Study, 2025), and long waits and clumsy automation are among the things that drag it.
• A hallucinated answer is the bank's official position. The customer reasonably treats it as the bank's word, which makes it an unfair-and-deceptive-practices exposure rather than a poor interaction.
• A session that crosses wires leaks one customer into another. And an action taken outside policy moves money that should not have moved.
• The risk function had already vetoed this twice. Not on capability. Solving the cost without solving the safety was not a solution this bank would buy.

CreateOS did not sell the bank a chatbot platform and leave it to configure the guardrails. We build the agent workforce, integrate it to the bank's systems, and deploy it on CreateOS infrastructure inside the bank's own boundary, where the safety controls are enforced by the infrastructure rather than requested of the model.

• No single agent both invents an answer and acts on it. The separation of duties is deliberate, so compromising one part does not compose into a compromise of the bank.
• Answers come strictly from the bank's own grounded content. Ungrounded generation on factual account and product questions is not permitted, which is the primary defence against a hallucinated official position.
• The customer is authenticated before anything account-specific. No balance, no detail, no action until identity clears.
• Per-session kernel isolation. Every session runs in its own micro-VM with its own guest kernel, so one customer's session cannot reach another's data by construction rather than by policy.
• Sanctioned core-banking paths, allowlisted in the kernel. A hallucinating or manipulated agent cannot execute an unauthorized transfer or reach an unapproved system, because the network path does not exist.
• Frustration is read in real time. A contact reaches a person at the right moment rather than after the customer has given up, and every interaction and action is logged as it happens.
• Live read-only first, money later. Three weeks on real traffic with informational intents proved grounded accuracy and session isolation before the agent could move a dollar. Transactional intents were then enabled one at a time, each egress-gated and confirmation-gated.

The control plane and storage run inside the bank's own infrastructure and region, so conversation content never leaves the boundary. CreateOS is SOC 2 Type II and ISO 27001 certified, which cleared procurement rather than stalling in it.

Containment lifted from 30% to 60%, so the crew now resolves an additional 1.5 million contacts a year end to end without a human touching them.

• $7.5M to $10M a year on a $25M base. A 30% to 40% cut. Roughly $7.5M from containment, plus another $2.0M from a 20% handle-time reduction across the 2 million contacts that still route to a human.
• Minutes to seconds on contained contacts. The routine question no longer waits behind a complex one, and satisfaction held and improved from a 79% baseline.
• Zero unauthorized actions and zero cross-customer leakage. Not aspirations on a dashboard: the first enforced by the kernel egress allowlist, the second by per-session VM isolation, the third by 100% logging as the conversation happens.
• The record is what let containment expand. Rather than get pulled back. The risk function required it before go-live and watched it accumulate on real traffic.
• The contact centre did not shrink, its work changed. Routine volume came off the human queue, and the people who remain spend their time on contacts that genuinely need a person.

What the bank measured