# eCommerce store-connected agent — security checklist

Companion to **How to secure AI agents connected to your eCommerce store**.

This is the **store-connected** boundary (Identity, Gateway Policy, secrets, PII, payment). It is not the support week-one tool list ([`support-agent-tool-policy.md`](support-agent-tool-policy.md)) and not the CTO layer brief ([`architecture-cto-brief.md`](architecture-cto-brief.md)).

## Who owns what (do not collapse the names)

| Layer | Owns | Does **not** own |
| ----- | ---- | ---------------- |
| **AgentCore Harness** | Managed loop on Runtime; `CreateHarness` / `InvokeHarness`; isolated Firecracker microVM via Runtime; Memory; Observability | Payment capture, Shopify Admin by magic, Cedar authoring |
| **AgentCore Runtime + Strands 1.0** | Custom loop after export: Agents-as-Tools, Graph, Swarm, Workflow | MicroVMs (Runtime does; Strands does not), Gateway, Identity, Policy, secrets management |
| **Amazon Bedrock** | Converse models + Guardrails | The agent host |
| **Gateway + Cedar** | Tool choke point; `LOG_ONLY` then `ENFORCE` | Prompt-as-authorization |
| **Identity** | JWT claims into Policy (shopper vs associate vs admin) | Storefront session cookies as sufficient authZ |
| **IAM execution role** | What the harness/runtime may call in AWS | Least privilege for **commerce** APIs (that is Gateway + your API authorizer) |
| **Secrets Manager** | OMS/helpdesk credentials | Prompt text, Memory, eval fixtures with live keys |
| **CloudTrail** | API activity on `bedrock-agentcore.amazonaws.com` | Your OMS audit log (keep both) |

## Monday checklist (security)

- [ ] Shopper JWT cannot call associate-only tools (prove with a DENY)
- [ ] Write tools default-deny; Policy `LOG_ONLY` for a canary week, then `ENFORCE`
- [ ] Secrets only in Secrets Manager / IAM; never in instructions, Memory, or eval JSON
- [ ] Tool responses minimize PII (city not street; last-4 not PAN; no CVV)
- [ ] **No** payment capture, card data, or processor vault tools on the agent
- [ ] Browser and Code Interpreter **off** by default
- [ ] CloudTrail + AgentCore Observability on; alarm on unexpected tool mix and DENY spikes
- [ ] Guardrails on Bedrock **and** Cedar on tools — complementary, not substitutes
- [ ] HITL ticket includes `runtimeSessionId` + tool trace ([`hitl-approval-architecture.md`](hitl-approval-architecture.md))
- [ ] Agents Classic is not the net-new path (maintenance for new customers after 30 July 2026)

## Cedar sketch (illustrative)

Context: entity shapes must match **your** Gateway schema. Not a customer policy. Default-deny implied for unmatched.

```cedar
// Sketch — associate refund under cap. LOG_ONLY first.
permit (
  principal,
  action == Action::"createReturn",
  resource
)
when {
  principal has role &&
  principal.role == "associate" &&
  resource has orderStatus &&
  resource.orderStatus != "delivered" &&
  resource has refundUsd &&
  resource.refundUsd <= 75
};

forbid (
  principal,
  action == Action::"capturePayment",
  resource
);
```

There should be **no** `capturePayment` tool to forbid. If it exists, delete it. The `forbid` is a belt; the missing tool is the trousers.

## Payment boundary

Payment systems stay **outside** the tool set. The agent may **read** a coarse payment **status** (`authorized`, `captured`, `failed`) if the OMS already exposes it without PAN. Capture, refund-to-card processor calls, and vault tokens stay on the existing checkout / payments service.

## Related

- Autonomy levels: [`autonomy-spectrum-by-action.md`](autonomy-spectrum-by-action.md)
- Sample Cedar on the store-agents stubs: [`../ecommerce-agentcore-store-agents/policy/refund-and-cancel.cedar`](../ecommerce-agentcore-store-agents/policy/refund-and-cancel.cedar)