AI Purchase Order Agent for eCommerce (2026)

Reorder is money. The brief that says “buy 240 of SKU-TEE-BLU-M” is not the same system as the button that commits a vendor and a ship date. Mix them and you get a 2 a.m. PO.

On 17 June 2026, AgentCore Harness reached general availability (What’s New). After 30 July 2026, net-new purchasing agents should not start on Classic (lifecycle). This post is a sample approval-gate file, not a client PO-cycle KPI. Dollar caps in the artifact are labels to replace.

First-party signals we reuse (not eCommerce outcomes) — Gateway server-side tools cut median tool round-trip ~180 ms → ~95 ms on a B2B CRM assistant (12 tools, ~8k turns/day) — Gateway post. Platform TCO silhouette: support-style AgentCore at 50K sessions/mo ~$791/mo platform + model (decision guide). Model your mix on the AgentCore pricing calculator.

Reproduce this — Copy purchase-order-approval-gates.md. Replace every $X with finance policy. Ship gates: monday-checklist.md.

This is series part 25 — back-office purchase assistance. Upstream: inventory risk and demand brief. Downstream: vendor health. Hybrid default: agent vs workflow.

The inventory agent must not own createPurchaseOrder. Hop caps exist so a morning risk job cannot spend. Purchasing is a different Identity and a different eval suite.

Opinionated take: high-value purchasing always needs approval controls. Week one: the agent drafts; the buyer sends. Trade-off: POs sit in a queue. You do not let a model pick a vendor and a qty in one unattended turn.

Why this matters / who breaks without it: working capital breaks on wrong pack size and stacked inbound. Vendor ops breaks when a “cheaper” supplier is not in the contract. Audit breaks when send happened in LOG_ONLY. If a buyer cannot explain the qty from tool evidence, the draft fails — even if the prose is confident.

Automate first

If min/max plus preferred vendor already posts in ERP, leave it. The hybrid matrix is the decision table. Use the agent when qty depends on messy context (split packs, backup vendor, inbound stacking). The workflow still executes create after a structured decision — same pattern as refunds.

EDI 850 generation can stay in ERP after approval. The agent should not be your EDI translator.

Risk → demand → vendor → recommend → HITL → PO

flowchart LR
  InventoryRisk[Inventory Risk]
  Demand[Demand]
  Vendor[Vendor]
  PORec[PO Recommendation]
  HumanApproval[Human Approval]
  PO[Purchase Order]
  InventoryRisk --> Demand
  Demand --> Vendor
  Vendor --> PORec
  PORec --> HumanApproval
  HumanApproval --> PO

From the gates file, the recommendation must include qty, vendor, lead time, unit cost, open POs, and inventory position — each from a named tool. Fail the draft if any of those is a guess.

Next.js (or Slack, or the ERP inbox) is the HITL surface, not the AgentCore host.

Qty must reconcile pack size (inner/case) from the vendor tool, not a round number the model likes. Existing orders: subtract open PO qty and inbound that lands inside lead time before recommending more. Unit cost is last PO or getVendorQuote — never a “they’ll do 8% off” sentence.

Week-one evals: missing preferred vendor = fail; qty > 2× 28-day velocity without merch note = fail; send tool present while Policy is LOG_ONLY = do not ship.

Production shape

Bedrock = model. Harness or Runtime = host. Gateway + Cedar = product. Strands ≠ infra. Browser off.

No native Shopify AgentCore connector.

Context: Harness GA 17 June 2026 or Runtime; Cedar on writes.

# From purchase-order-approval-gates.md — not a live Cedar file
DENY createPurchaseOrder UNLESS principal.role IN ["buyer", "admin"]
DENY sendPurchaseOrder  UNLESS principal.role == "buyer"
# LOG_ONLY is not this file.

Identity claims: buyer vs associate vs shopper. Associates may see drafts if your policy says so. They must not send. Finance caps belong in Cedar entities or in the ERP approval graph — not in a prompt that says “be careful over $10k.” Demo $X in the artifact is a placeholder. Put your number in Policy.

What broke

What broke — Sample Gateway had createPurchaseOrder while Policy was LOG_ONLY. The model chose a backup vendor from a stale email in Memory (not a tool) at a higher unit cost, and would have sent 2× qty because open inbound was unread. Detection: trace showed send without getOpenPurchaseOrders or getPreferredVendor. Fix: delete send from the week-one OpenAPI; require those reads in eval; ENFORCE DENY for non-buyer roles. Lesson: purchasing is not a chat quality score. Unattended send is how you buy the wrong pack from the wrong supplier.

What This Post Doesn’t Cover

• EDI mapping, three-way match, or AP invoice posting.
• Measured PO-cycle time from a FactualMinds client.
• Vendor scorecards beyond preferred-vendor read.
• AgentCore Payments / x402.
• Browser over a supplier portal.
• Classic Agents migration.
• A native Shopify purchasing connector (it does not exist).

What to Do This Week

1. Name the buyer. If you cannot, stop.
2. Clone purchase-order-approval-gates.md. Fill caps with finance.
3. If ERP already posts min/max, keep it. Agent only at the messy decision.
4. Read tools first. No create operation in the OpenAPI until DENY is proven.
5. Harness or Runtime; Policy LOG_ONLY, then ENFORCE. Browser off.
6. Eval: stacked PO, new vendor, missing cost = fail.
7. Model cost on the AgentCore pricing calculator. Contact us, Bedrock, retail / eCommerce.

Full ship list: monday-checklist.md.

If you only do one thing

Remove send from the OpenAPI until Cedar is in ENFORCE and a named buyer exists. Drafts are cheap. Silent POs are not.

FAQ

When should we NOT use an AI agent for purchase orders?

Skip it when preferred vendor plus an EOQ or min/max rule already posts correctly in ERP and a buyer only clicks confirm. Keep that workflow. Add an agent when vendor choice, pack size, or inbound stacking is messy. Also skip it if finance cannot name a cap and an approver. High-value purchasing without approval controls is the failure mode this post exists to prevent.

What could go wrong if Policy stays in LOG_ONLY and the agent can send?

Wrong vendor, wrong pack size, stacked qty on an open PO, or a unit cost the model invented. LOG_ONLY is a trace, not a lock. ENFORCE plus buyer JWT before createPurchaseOrder. Prompt instructions are not authorization.

What could go wrong if the PO agent picks a new vendor from chat?

You leave a contracted supplier, lose a rebate, or buy from a vendor with no lead-time tool. Preferred vendor comes from a tool. New vendor is always HITL — same as the vendor-performance post.

How does this relate to inventory risk and demand briefs?

Inventory says reorder vs wait. Demand explains units. This agent turns those into a PO recommendation. Do not let the inventory specialist also send. Hop-cap writes to the buyer path. See agent vs workflow: money movement stays deterministic after a structured decision.

Harness or Runtime for purchasing?

Harness can draft with a short tool list if send is a separate human step outside the loop. Runtime plus Strands when inventory, demand, and vendor specialists must not share createPurchaseOrder. Agents Classic is the wrong net-new host after 30 July 2026.

Is there a native Shopify AgentCore PO connector?

No. ERP, EDI, or Shopify purchase-order apps sit behind your OpenAPI or MCP on Gateway. Do not wait for a first-party Shopify AgentCore purchasing product.