# Support agent — allowed tools and escalation

Companion to **AI customer support agents for eCommerce stores**.

## Allowed read tools (week one)

| Tool | Purpose | Evidence to return |
| ---- | ------- | ------------------ |
| `getOrder` | Order by id / email + last-4 | status, items, ship-to city (not full address unless policy allows) |
| `getShipment` | Carrier events | last scan, ETA, exception code |
| `getProduct` | Title, inventory, size chart | SKU, in-stock boolean |
| `getReturnPolicy` | Store policy snippets | policy version id |
| `searchHelpArticles` | Public help center | article id + excerpt |

## Forbidden until Policy ENFORCE

- `createRefund`, `cancelOrder`, `updateAddress`, `issueGiftCard`
- Unrestricted SQL / warehouse dumps
- Browser tool on every conversational turn

## Escalate immediately

- Chargeback, attorney, or regulator language
- "Delivered but not received" after carrier delivered
- PII correction requests (GDPR/CCPA access paths)
- Discount or price-match demands above store rule

## Cedar sketch (not production)

Default-deny. LOG_ONLY first.

```cedar
// Illustrative only — generate from your Gateway schema
forbid (
  principal,
  action == AgentCore::Action::"createRefund",
  resource
);
```

Attach shopper vs associate Identity claims. Associate-only writes must DENY for shopper tokens even if the support specialist is invoked by mistake.