AI Agent Identity for eCommerce: Who Is Calling the Tool (2026)

On 25 September 2026, “agent identity” in an eCommerce stack is three questions that teams collapse into one API key:

1. Which workload is running (the IAM role or runtime identity)?
2. Which human is it acting for (shopper, associate, or nobody)?
3. Which downstream account is allowed to call Shopify, Adobe Commerce, or BigCommerce?

Who this is for. A CTO or security partner reviewing a design. The policy around writes is securing agents on the store. This page is only the names on the credentials.

Our take: if you cannot point to three credentials, you have one over-powered token. Do not add a write.

The three credentials

Bedrock AgentCore has an Identity component in the same product family as Runtime and Gateway (GA 13 October 2025 for the platform). Use it, or your IdP, to verify the caller. It does not grant Magento resources. Those are still an Adobe integration. Harness (GA 17 June 2026) does not change that split.

On the store side, follow the platform page: Shopify scopes, Adobe integrations, BigCommerce API accounts.

How a tool should check

Before getOrder:

• The workload role is the one deployed for this agent. A developer laptop role fails closed in production.
• The verified subject is present. Anonymous storefront chat gets a narrower tool list than an associate.
• The order id is in the set that subject may see, or the associate claim is present and your policy allows any order. The model does not make that decision.
• The store token used is the read account.

A refund tool, if it exists at all, requires the associate claim and a human approval record and a policy allow. Any missing leg is a deny. Log the deny. The prompt’s apology is irrelevant.

What people confuse with identity

• MCP OAuth (spec 2025-11-25) proves a client may open your MCP server. See MCP security. It is not the shopper.
• Cognito admin APIs in the aws-auth skill post are about changing user pools. They are not a commerce role model.
• Memory. A fact like “prefers ground shipping” is not an authorization. Do not store tokens there.
• Service accounts named after a person. When that person leaves, you will be afraid to rotate the token. Name it after the workflow.

What broke — Support and purchasing shared a Gateway target because “it was already authed.” A support session passed a SKU and the purchasing tool drafted a PO. Detection: the trace showed one role and two tool catalogs. Fix: split targets and split store credentials. Lesson: identity scoped to the gateway, with every tool behind it, is not least privilege.

If you only do one thing

Label the three secrets in the design review. If a box says “admin token,” stop.

What to do this week

1. Draw workload, caller, and store account. No arrows that skip a box.
2. Issue a read-only store credential for the one workflow.
3. Reject tool calls that do not carry a verified subject.
4. Rotate anything a prompt or a memory record has seen.
5. Readiness under 16 out of 30 still means no write, even with perfect identity. The rubric is the readiness assessment.
6. Discuss the architecture. Identity work sits with eCommerce AI agents and, when the control is the point, the security practice.

What this post doesn’t cover

• A full IAM Identity Center build. That is account access for humans.
• Customer account takeover detection.
• A claim that AgentCore Identity is a commerce IdP. It is not, on the documentation we ship against.