--- title: AI Agent Identity for eCommerce: Who Is Calling the Tool (2026) description: Three identities, not one token. The workload role, the shopper or associate, and the downstream API account. A shared admin credential fails the split. AgentCore Identity does not replace your order-system scopes. url: https://www.factualminds.com/blog/ai-agent-identity-enterprise-ecommerce-2026/ datePublished: 2026-09-25T00:00:00.000Z dateModified: 2026-09-25T00:00:00.000Z author: palaniappan-p category: AI Agents tags: ai-agents, ecommerce, security, bedrock-agentcore, amazon-cognito --- # AI Agent Identity for eCommerce: Who Is Calling the Tool (2026) > Three identities, not one token. The workload role, the shopper or associate, and the downstream API account. A shared admin credential fails the split. AgentCore Identity does not replace your order-system scopes. On **25 September 2026**, "agent identity" in an eCommerce stack is three questions that teams collapse into one API key: 1. **Which workload** is running (the IAM role or runtime identity)? 2. **Which human** is it acting for (shopper, associate, or nobody)? 3. **Which downstream account** is allowed to call Shopify, Adobe Commerce, or BigCommerce? **Who this is for.** A CTO or security partner reviewing a design. The policy around writes is [securing agents on the store](/blog/secure-ai-agents-ecommerce-store-2026/). This page is only the names on the credentials. **Our take:** if you cannot point to three credentials, you have one over-powered token. Do not add a write. ## The three credentials | Credential | Answers | Must not | | --- | --- | --- | | Workload role | This runtime may call Gateway, logs, and its secret | Be a human's IAM user with access keys | | Caller claims | `shopper` or `associate`, stable subject id | Be a string the model typed | | Store API account | Reads this workflow needs | Include refunds "for later" | Bedrock AgentCore has an Identity component in the same product family as Runtime and Gateway (GA **13 October 2025** for the platform). Use it, or your IdP, to **verify** the caller. It does not grant Magento resources. Those are still an Adobe integration. Harness (GA **17 June 2026**) does not change that split. On the store side, follow the platform page: [Shopify scopes](/blog/shopify-ai-agents-ecommerce-2026/), [Adobe integrations](/blog/magento-ai-agents-ecommerce-2026/), [BigCommerce API accounts](/blog/bigcommerce-ai-agents-ecommerce-2026/). ## How a tool should check Before `getOrder`: - The workload role is the one deployed for this agent. A developer laptop role fails closed in production. - The verified subject is present. Anonymous storefront chat gets a narrower tool list than an associate. - The order id is in the set that subject may see, **or** the associate claim is present and your policy allows any order. The model does not make that decision. - The store token used is the read account. A refund tool, if it exists at all, requires the associate claim **and** a human approval record **and** a policy allow. Any missing leg is a deny. Log the deny. The prompt's apology is irrelevant. ## What people confuse with identity - **MCP OAuth** ([spec 2025-11-25](https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization)) proves a client may open your MCP server. See [MCP security](/blog/mcp-security-enterprise-ai-2026/). It is not the shopper. - **Cognito admin APIs** in the [aws-auth skill post](/blog/amazon-cognito-aws-auth-agent-skill-2026/) are about changing user pools. They are not a commerce role model. - **Memory.** A fact like "prefers ground shipping" is not an authorization. Do not store tokens there. - **Service accounts named after a person.** When that person leaves, you will be afraid to rotate the token. Name it after the workflow. > **What broke** — Support and purchasing shared a Gateway target because "it was already authed." A support session passed a SKU and the purchasing tool drafted a PO. **Detection:** the trace showed one role and two tool catalogs. **Fix:** split targets and split store credentials. **Lesson:** identity scoped to the gateway, with every tool behind it, is not least privilege. ## If you only do one thing Label the three secrets in the design review. If a box says "admin token," stop. ## What to do this week 1. Draw workload, caller, and store account. No arrows that skip a box. 2. Issue a read-only store credential for the one workflow. 3. Reject tool calls that do not carry a verified subject. 4. Rotate anything a prompt or a memory record has seen. 5. Readiness under **16 out of 30** still means no write, even with perfect identity. The rubric is the [readiness assessment](/blog/ecommerce-ai-agent-readiness-assessment-2026/). 6. [Discuss the architecture](/contact-us/?focus=ai-agents). Identity work sits with [eCommerce AI agents](/services/ecommerce-ai-agents/) and, when the control is the point, [the security practice](/security-compliance/ai-security/). ## What this post doesn't cover - A full IAM Identity Center build. That is account access for humans. - Customer account takeover detection. - A claim that AgentCore Identity is a commerce IdP. It is not, on the documentation we ship against. ## FAQ ### When should you NOT use one admin API token for every agent? Always. A support lookup and a purchase-order draft need different downstream scopes. One token means the lookup agent can do the draft. Split accounts per workflow. ### What could go wrong if the shopper id is only in the prompt? The model can repeat another customer's order id and the tool will fetch it if the credential is an admin. The tool must receive a verified subject from your identity layer and refuse ids that subject cannot see. ### Is Amazon Cognito the agent? No. Cognito, or any IdP, can authenticate the human and issue claims. The agent workload still needs its own AWS role. The store still needs its own API account. The Cognito skill post is about administering Cognito, not about this three-way split. ### What could go wrong if AgentCore Memory stores the access token? The next turn, or another agent sharing that memory, can replay it. Memory is for shopper preferences you meant to keep. Secrets stay in a manager the model cannot read. ### Does MCP authorization replace this? MCP OAuth, in the 2025-11-25 spec, authenticates a client to an MCP server. It does not decide whether that client may refund order 1001. You still map the token to a role and enforce it on the tool. --- *Source: https://www.factualminds.com/blog/ai-agent-identity-enterprise-ecommerce-2026/*