# Safety & permissions

> How the Shoplazza AI Toolkit keeps agent writes safe: the preview-restate-confirm protocol, domain and OAuth scopes, and read-only access you control.

When an AI agent operates the CLI on your behalf, every command has real consequences — creating products, refunding buyers, deleting discounts. The AI Toolkit is designed so an agent stays inside guardrails you control.

## The safety protocol

The foundation skill `shoplazza-common` loads automatically and enforces this protocol for any **write** operation:

1. **Preview** — run the command with `--dry-run`, which prints the request without sending it.
2. **Restate** — summarize what the operation will change.
3. **Confirm** — wait for your explicit confirmation before executing.

This matters most for irreversible or financial operations: refunds, cancellations, and batch deletes. Read-only commands (`+search`, `+count`, `list`, `get`) run without confirmation.

```
/shoplazza-orders Refund 15.50 to the buyer on order 660011
```

The agent previews the refund with `--dry-run`, restates the amount and restock behavior, and waits for your "yes" before running it for real.

## Scopes limit what an agent can do

Authentication is scoped per domain. An agent can only touch domains you granted at login:

```shell
shoplazza auth login --store-domain my-store.myshoplaza.com --domain products,orders
```

The command above lets the agent manage products and orders — but not customers, discounts, or shop settings. To grant fine-grained OAuth scopes instead:

```shell
shoplazza auth login --store-domain my-store.myshoplaza.com --scope read_product,read_order
```

Granting only `read_*` scopes gives an agent a **read-only** view of a domain. The CLI checks scopes before every call and returns a clear error if one is missing. See [Authentication → Scope mapping](/docs/app/developer-tools/shoplazza-cli/authentication#scope-mapping).

## Practical guardrails

* **Least privilege** — grant only the domains and scopes the task needs. A reporting agent needs `read_*` only.
* **Review before run** — keep the confirm step on for writes; read the restated command before approving.
* **Credentials stay in the keychain** — tokens live in your OS-native secure storage, never in plain-text config the agent can read.
* **Separate stores** — point agents at a development store first; switch with `shoplazza auth store use`.
* **CI secrets** — in automated runs, pass a UAT as an encrypted secret, never in the prompt or source. See [Headless & CI](./headless-ci).

## See also

* [Agent Skills → The safety protocol](./skills#the-safety-protocol)
* [Authentication](/docs/app/developer-tools/shoplazza-cli/authentication)
* [Troubleshooting](./troubleshooting)