How Much Autonomy Should You Give an eCommerce AI Agent? (2026)

AWS lifecycle notice (June 30, 2026) — Amazon Bedrock Agents Classic is in maintenance for new customers after July 30, 2026. Net-new agents should use Bedrock AgentCore. Full matrix: lifecycle roundup.

On June 17, 2026, AgentCore Harness reached general availability — CreateHarness / InvokeHarness on Runtime, isolated Firecracker microVMs, tools via Gateway or MCP (What’s New). That date is useful here because vendors now sell one knob: “autonomous agent.” The procurement question is not Harness vs a chatbot. It is which action may run without a human, this week.

This is the most practical post in the eCommerce AI Agents series if you already decided to run an agent. It is not a remake of AI agent vs workflow automation. That post chooses rules vs agent vs hybrid. This one assumes the hybrid: the agent exists, tools are named, and you still have to pick a level per action.

It is not a client engagement. Demo caps and ticket shapes below are worksheets, not FactualMinds store KPIs.

First-party signals we reuse (not eCommerce outcomes) — Gateway server-side tools cut median tool round-trip ~180 ms → ~95 ms on a B2B CRM assistant (12 tools, ~8k turns/day) — Gateway post. Platform TCO silhouette: support-style AgentCore at 50K sessions/mo ~$791/mo platform + model (decision guide). Model your mix on the AgentCore pricing calculator.

Reproduce this — Copy autonomy-spectrum-by-action.md from examples/architecture-blog-2026/ecommerce-ai-agents-series/. Fill one row per action (refund, discount, PO, email, inventory, account). Ship gates: monday-checklist.md.

Opinionated take: do not set autonomy on the harness. Set it per action. Trade-off: a table to maintain instead of a demo that “just refunds.” You buy an audit trail that a slider cannot provide.

FactualMinds builds agents that connect storefronts, OMS, and back-office tools — with humans still on money, inventory, and identity.

The spectrum (stop using “autonomous” as a boolean)

Bedrock Converse plus Guardrails is the model layer — not the host. Harness (or Runtime after export) hosts the loop. Strands 1.0 gives Agents-as-Tools, Graph, Swarm, Workflow when you export. Strands does not give you microVMs, Gateway, Identity, Policy, or secrets management. Do not encode autonomy as a Swarm hop.

Next.js / TypeScript / Tailwind is the HITL dashboard when you need buttons. It is not the runtime. Detail: HITL post.

flowchart LR
  Observe --> Analyze
  Analyze --> Recommend
  Recommend --> Draft
  Draft --> RequestApproval
  RequestApproval --> Execute
  Execute --> FullyAutomated

Promote one step after evals. Skipping Draft → Execute is how a polite model becomes a ledger.

Per-action defaults (fill the artifact; do not copy the caps blindly)

Demo $75 refund ceiling matches the public store-agents Cedar sketch — a worksheet, not your finance policy.

Payment capture and card data are not a level. They are out of the tool set. See store-connected security.

How this sits on AWS (without turning into a CTO brief)

Harness is the paved road for the first production agent: config for model, instructions, tools, Memory. Isolated sessions are Runtime microVMs whether you stay on Harness or export. Tools go through Gateway (OpenAPI / MCP / Lambda). Identity JWT claims must reach Cedar. Observability and CloudTrail on bedrock-agentcore.amazonaws.com are how you prove which level actually fired.

When you need hop caps or specialists, export to Strands on Runtime — Harness + Strands ship map. How FactualMinds composes the stack: production AI agents on AWS. Neither post is a substitute for this table.

Context: Python 3.12+, boto3 ≥ 1.38.0, IAM execution role, supported region. Sketch — pin the model your account allows. Autonomy is not a parameter here; it lives in tools + Policy.

# Sketch — InvokeHarness. runtimeSessionId must be at least 33 characters.
import boto3
import uuid

client = boto3.client("bedrock-agentcore", region_name="us-west-2")
response = client.invoke_harness(
    harnessArn="arn:aws:bedrock-agentcore:us-west-2:123456789012:harness/commerce-support",
    runtimeSessionId=str(uuid.uuid4()),
    messages=[{"role": "user", "content": [{"text": "Refund order ORD-1001"}]}],
)

If createReturn is attached, this turn is already past Recommend. Strip the tool until Request Approval / Cedar is real. Prompt text is not authorization. Run Policy LOG_ONLY, then ENFORCE.

Browser and Code Interpreter stay off by default. Support-shaped pilots with Browser left hot tracked roughly 3× Runtime-shaped spend — ship map.

What “promote a level” means in practice

1. Goldens at the current level pass, including must-not-write.
2. LOG_ONLY traces show the write you would have allowed — and the ones you would DENY.
3. HITL queue exists for the over-cap / irreversible path (architecture artifact).
4. Flip Cedar to ENFORCE for that one action.
5. Watch DENY spikes and tool mix for a canary week before the next action.

The CRM canary (~180 → ~95 ms) is why Gateway stays in the path. It is not an SLA for “how fast we refund.” Your OMS dominates wall clock.

What broke

What broke — Week two of a support harness. WISMO status Execute was clean (cite getShipment only). Someone set a product flag to “handle the rest” so refunds inherited Execute. Prompt said “under $50 is fine.” Detection: Gateway traces showed createReturn on a delivered fixture; Policy was not attached. Finance saw a refund with no RMA. Fix: strip write tools; restore Recommend; Cedar cap + not-delivered; HITL above cap; goldens that fail if a write fires on delivered-not-received. Lesson: autonomy is a matrix. A harness has no honest global slider.

A second, already-published failure: dual-write cancel-on-delivered when the agent both decided and executed — store-agents sample. Hybrid still owns money movement. This post only answers how far the agent may go inside that decision point.

What to Do This Week

1. List six actions: refunds, discounts, POs, customer messages, inventory writes, account changes.
2. Score each row in autonomy-spectrum-by-action.md. Default to Recommend if you argue.
3. Confirm write tools are absent for anything below Execute.
4. Attach Gateway Policy LOG_ONLY on the first candidate write — not five.
5. Stand up HITL before you promote Request Approval → Execute. Follow HITL.
6. Browser off. Model sessions on the AgentCore pricing calculator. The ~$791/mo silhouette is platform cost, not savings from “full autonomy.”
7. Run monday-checklist.md. Then contact us if the first write is a refund.

What This Post Doesn’t Cover

• Rules vs agent vs hybrid — post 11
• HITL queue payload and SLA fail-closed — post 38
• Identity, secrets, PII, payment boundary — post 39
• Which automation to staff first — post 40
• Supervisor + four specialists duplicated here — store-agents
• Measured refund-rate or CSAT lifts from a named client — we are not inventing them

FAQ

When should you NOT raise an eCommerce agent to Execute or Fully Automated?

Do not promote a write because WISMO notify worked. Keep Execute off refunds, inventory quantity, account mutation, and payment-adjacent tools until Cedar is in ENFORCE, evals include must-not-write cases, and HITL exists for the over-cap path.

What could go wrong if autonomy is a single slider on the harness?

Every tool inherits the highest setting. Delay notices go out and createReturn fires on a delivered order. Autonomy is a table of actions. Gateway Policy cannot save you if the write tool is attached and the product says “just handle it.”

Is the autonomy spectrum the same as agent vs workflow?

No. Agent vs workflow decides whether the loop or the state machine owns the path. This post assumes you already have an agent and picks Observe through Fully Automated per action.

When should you NOT fully automate customer communication?

Skip it when the message includes compensation, an invented ETA, or a policy exception. Carrier-exception delay notices can be Fully Automated if the template is fixed and the send is idempotent.

What could go wrong if refunds sit at Execute under a prompt cap of $50?

Prompt caps are not authorization. Put the cap in Cedar, run LOG_ONLY, then ENFORCE. Over-cap goes to HITL. Shopper JWTs must DENY associate refunds.

Does AgentCore Harness include an autonomy dial?

No. Harness is the managed loop. You encode autonomy in tool allow-lists, Cedar, and the HITL queue. Strands primitives after export still do not replace Policy.

Need a per-action autonomy table before the first refund tool goes live? Contact FactualMinds or see Amazon Bedrock.