Skip to main content

Safety & permissions

When an AI agent operates the CLI on your behalf, every command has real consequences — creating products, refunding buyers, deleting discounts. The AI Toolkit is designed so an agent stays inside guardrails you control.

The safety protocol​

The foundation skill shoplazza-common loads automatically and enforces this protocol for any write operation:

  1. Preview — run the command with --dry-run, which prints the request without sending it.
  2. Restate — summarize what the operation will change.
  3. Confirm — wait for your explicit confirmation before executing.

This matters most for irreversible or financial operations: refunds, cancellations, and batch deletes. Read-only commands (+search, +count, list, get) run without confirmation.

/shoplazza-orders Refund 15.50 to the buyer on order 660011

The agent previews the refund with --dry-run, restates the amount and restock behavior, and waits for your "yes" before running it for real.

Scopes limit what an agent can do​

Authentication is scoped per domain. An agent can only touch domains you granted at login:

shell
shoplazza auth login --store-domain my-store.myshoplazza.com --domain products,orders

The command above lets the agent manage products and orders — but not customers, discounts, or shop settings. To grant fine-grained OAuth scopes instead:

shell
shoplazza auth login --store-domain my-store.myshoplazza.com --scope read_product,read_order

Granting only read_* scopes gives an agent a read-only view of a domain. The CLI checks scopes before every call and returns a clear error if one is missing. See Authentication → Scope mapping.

Practical guardrails​

  • Least privilege — grant only the domains and scopes the task needs. A reporting agent needs read_* only.
  • Review before run — keep the confirm step on for writes; read the restated command before approving.
  • Credentials stay in the keychain — tokens live in your OS-native secure storage, never in plain-text config the agent can read.
  • Separate stores — point agents at a development store first; switch with shoplazza auth store use.
  • CI secrets — in automated runs, pass a UAT as an encrypted secret, never in the prompt or source. See Headless & CI.

See also​

On this page