Security and Access Control for Ecommerce AI

Define Scopes Before Connecting Any System

Scope definition is the first control gate. Before an AI agent touches inventory, customer data, or payment systems, document exactly what it can read and what it can write. This is not a feature request - it is a security requirement.

Start with a scope matrix. Rows are data domains (inventory, orders, customers, financials, ads). Columns are permission levels: read-only, write (create), write (update), delete, trigger (execute workflows). For each AI task, mark which cells apply.

Example: An AI agent that optimizes ad spend should have read access to ad performance, customer LTV, and inventory levels. It should have write access to bid adjustments and budget allocation. It should NOT have access to customer PII, payment methods, or deletion rights. It should NOT trigger refunds or inventory writes without approval.

Enforce scopes at the API token level, not in application logic. If the AI uses Shopify Admin API, create a custom app with only the required scopes (e.g., read_products, write_marketing_events, read_orders). If it uses a data warehouse, create a database user with SELECT on specific tables only. Revoke overly broad permissions before pilot launch.

• Map each AI task to required data domains and permission types
• Create API tokens and database users with minimal scopes, not admin access
• Document scope rationale - why does this agent need this permission?
• Audit token permissions quarterly; revoke unused scopes immediately

Require Approval Gates for High-Risk Operations

High-risk operations are those that directly affect revenue, customer experience, or compliance. These should never be fully automated. Define an approval gate - a human review step before the AI action executes.

High-risk operations include: inventory adjustments above a threshold (e.g., moving more than 50 units between locations), price changes above a percentage (e.g., >15% discount), customer refunds or chargebacks, email sends to large segments (>10,000 customers), ad spend changes above a dollar amount (e.g., >$500 daily budget shift), and any action affecting customer data (deletion, export, segmentation).

Implement approval gates as a workflow step, not a manual email. The AI generates a recommendation, logs it with supporting data, and routes it to a queue. A human (operator, merchandiser, or manager) reviews the recommendation, sees the reasoning, and clicks approve or reject. The approval action is logged with timestamp and user ID.

Set approval SLAs. If an AI recommends pausing an underperforming ad set, the approval should happen within 4 hours. If it recommends a price change, within 24 hours. If the SLA is missed, the recommendation expires and the AI re-evaluates on the next cycle.

For lower-risk operations (e.g., updating product tags, adjusting email send times), approval can be batch-based. The AI collects 50 - 100 recommendations, a human reviews them in bulk, and approves the batch. This reduces friction while maintaining oversight.

• List all operations that affect revenue, customer data, or compliance
• Assign each operation an approval requirement: real-time, batch, or none
• Build approval workflows with reasoning display, not just yes/no buttons
• Set SLAs for approval; expire recommendations if not reviewed in time
• Log all approvals and rejections with user ID and timestamp

Token Hygiene and Credential Rotation

API tokens and database credentials are the keys to your systems. Poor token hygiene is how AI agents (and attackers) gain unauthorized access.

Token hygiene rules: (1) Never hardcode tokens in code or config files. Use environment variables or a secrets manager (AWS Secrets Manager, HashiCorp Vault, 1Password). (2) Rotate tokens every 90 days. Set a calendar reminder. (3) Use short-lived tokens (1 - 24 hours) for high-risk operations; require re-authentication for each action. (4) Scope tokens to a single purpose. Do not create one 'master' token for all AI tasks. Create separate tokens for inventory, ads, email, etc. (5) Revoke tokens immediately when an agent is decommissioned or when a team member leaves.

For Shopify, create a custom app per AI agent (or per logical group of agents). Each app gets its own API credentials. For data warehouses, create a database user per agent with SELECT-only permissions on required tables. For third-party APIs (ad platforms, email services), use OAuth 2.0 with refresh tokens instead of static API keys.

Monitor token usage. Log every API call: which token, which endpoint, which resource, success or failure. If a token makes 10x more requests than usual, or requests from an unexpected IP, investigate. This is your early warning system for compromised credentials.

Incident response: if a token is compromised, revoke it immediately and rotate all related credentials. Review the audit log to see what actions were taken with the compromised token. Notify affected customers if their data was accessed. Update your security runbook based on the incident.

• Store tokens in a secrets manager; never hardcode them
• Rotate tokens every 90 days; use short-lived tokens (1 - 24 hours) for high-risk ops
• Create one token per AI agent or logical group; do not share master tokens
• Revoke tokens when agents are decommissioned or team members leave
• Monitor token usage for anomalies; investigate unusual activity patterns

Common Pitfalls and How to Avoid Them

Pitfall 1: Over-scoping to 'make it work faster'. Teams often grant admin access to get an AI agent running quickly, planning to restrict it later. Later never comes. Instead, start with minimal scopes and add permissions only when justified by the read-only phase.

Pitfall 2: Approval gates that are too slow. If it takes 3 days to approve a price change, the AI's recommendation becomes stale and the operator ignores it. Set realistic SLAs (4 hours for ads, 24 hours for inventory, 1 hour for urgent issues). If SLAs are consistently missed, the approval process is broken - fix it or remove the gate.

Pitfall 3: Audit logs that are not queryable. Logs are only useful if you can search them. Do not dump logs into a text file. Use a log aggregation tool (Datadog, Splunk, CloudWatch) that lets you filter by date, agent, action, and resource.

Pitfall 4: Forgetting to revoke access when an agent is decommissioned. Old AI agents accumulate over time, each with standing access to production systems. Quarterly, audit all active AI agents and their tokens. Revoke any that are no longer in use.

Want this on your account?

Thirty minutes. Bring the number that keeps you up.