FullAgenticStack WhatsApp-first Anti-Patterns: A Reference Handbook

Organized by Category and Severity Severity Legend: 🔴 CRITICAL : Blocks deployment. Risk of fraud, financial loss, or legal violation. 🟠 HIGH : Severely degrades experience. Requires priority fix. 🟡 MEDIUM : Moderate impact. Should be addressed in future sprints. 🟢 LOW : UX improvement. Non-blocking. 1. SECURITY & TRUST (8 anti-patterns) 🔴 AP-01: Ignoring Anti-Fraud Phone number provides implicit identity, not perfect authentication. Risky actions require progressive friction. Example: Someone with the customer's WhatsApp (stolen phone, cloned chip) requests address change. System accepts just because "it's the customer's number". Effect: Diverted delivery + fraud. 🔴 AP-02: Sensitive Data in Plain Text CPF, credit card, medical prescription — all stored without encryption/redaction. Signal: Complete log exposes PII without protection. 🔴 AP-03: Weak Confirmation (yes/no) Without Object Binding "Yes" without tying to order/action becomes ambiguity and fraud. Example: User responds "yes"