How Much Autonomy Should You Give an eCommerce AI Agent? (2026)
Quick summary: Autonomy is per action, not one store-wide dial. The public worksheet uses a $75 refund ceiling — yours belongs in Policy, not a prompt. Delay notices can go fully automated when the template is fixed.
Key Takeaways
- The public worksheet uses a $75 refund ceiling — yours belongs in Policy, not a prompt
- FactualMinds is an AWS Select Tier Services Partner
- Default level per action (fill the artifact; do not copy caps blindly) Demo $75 refund ceiling matches the public store-agents Cedar sketch — a worksheet, not your finance policy
- What "promote a level" means in practice 1
- 2
Table of Contents
Vendors sell one knob: “autonomous agent.” For a store, the question is simpler — which action may run without a person, this week? A delay notice that cites the carrier scan is not the same permission as a refund. Treat them as different rows, not one setting.
This post assumes you already decided to run an agent. It is not AI agent vs workflow automation — that post chooses rules vs agent vs hybrid. This one picks a level per action after the agent exists.
The job. Stop one “autonomous” flag from letting refunds, inventory writes, and delay emails inherit the same permission.
This week. List six actions — refunds, discounts, POs, customer messages, inventory, account changes. Default each to Recommend unless you can defend higher.
A person still signs. Refunds over your cap, large POs, compensation emails, account changes, and anything on a delivered-not-received case.
Skip it when you cannot name the action, when Policy is not attached, or when the only goal is “just handle refunds.”
Copy the table —
autonomy-spectrum-by-action.md. Ship gates:monday-checklist.md. Series index:ecommerce-ai-agents-series/.
FactualMinds is an AWS Select Tier Services Partner. Demo caps below are worksheets, not store KPIs.
Our take: do not set autonomy on the harness. Set it per action. A table to maintain beats a demo that “just refunds.”
Seven levels — not one “autonomous” switch
| Level | Name | Agent may | Typical store home |
|---|---|---|---|
| Observe | Read, private trace | getOrder into Observability | Shadow mode, week zero |
| Analyze | Internal brief | Stock-vs-velocity note in Slack ops | Inventory risk, review themes |
| Recommend | Structured decision, no write | { "decision": "route_to_returns" } | Exceptions, fraud-adjacent |
| Draft | Fill the artifact | Email, RMA, PO, reply — unsent | Vendor ops, catalog copy |
| Request approval | Propose a write; block | HITL ticket with session id + trace | Over-cap refund, large PO |
| Execute | Call an allowed write | Cedar ALLOW, under cap, right role | In-window cancel, under-cap RMA |
| Fully automated | No human in the path | Idempotent notify, status cite | Carrier-exception delay notice |
Promote one step after evals. Skipping Draft → Execute is how a polite model becomes a ledger.
Next.js / TypeScript / Tailwind is the approval dashboard when you need buttons. It is not the runtime. Detail: HITL post.
flowchart LR
Observe --> Analyze
Analyze --> Recommend
Recommend --> Draft
Draft --> RequestApproval
RequestApproval --> Execute
Execute --> FullyAutomatedDefault level per action (fill the artifact; do not copy caps blindly)
Demo $75 refund ceiling matches the public store-agents Cedar sketch — a worksheet, not your finance policy.
| Action | Week-one level | Execute / Fully Automated only if | Hard stop |
|---|---|---|---|
| Refunds / createReturn | Recommend or Request approval | Cedar cap, not delivered, associate JWT, HITL above cap | Delivered-not-received; shopper JWT; stacked returns |
| Discounts / gift cards | Draft or Request approval | Promo engine issued the code; Policy on issueGiftCard | Invented percentages; unpublished stacks |
| Purchase orders | Draft + Request approval | Buyer role, vendor match, qty sanity | Auto-send to vendor |
| Customer communication | Execute for cited status; Fully Automated for carrier-exception notify | Template + idempotency key | Compensation, invented ETA, legal language |
| Inventory changes | Analyze / Recommend | Cycle-count evidence + associate JWT + HITL | Chat-driven ATP mutation |
| Account changes | Request approval (email/address); Observe for password / MFA / payout | Identity proof | Shopper-token PII writes; Memory as the profile store |
Payment capture and card data are not a level. They are out of the tool set. See store-connected security.
What “promote a level” means in practice
- Goldens at the current level pass, including must-not-write.
LOG_ONLYtraces show the write you would have allowed — and the ones you would DENY.- HITL queue exists for the over-cap / irreversible path (architecture artifact).
- Flip Cedar to
ENFORCEfor that one action. - Watch DENY spikes and tool mix for a canary week before the next action.
What broke
What broke — Week two of a support harness. WISMO status Execute was clean (cite
getShipmentonly). Someone set a product flag to “handle the rest” so refunds inherited Execute. Prompt said “under $50 is fine.” Detection: Gateway traces showedcreateReturnon a delivered fixture; Policy was not attached. Finance saw a refund with no RMA. Fix: strip write tools; restore Recommend; Cedar cap + not-delivered; HITL above cap; goldens that fail if a write fires on delivered-not-received. Lesson: autonomy is a matrix. A harness has no honest global slider.
A second, already-published failure: dual-write cancel-on-delivered when the agent both decided and executed — store-agents sample. Hybrid still owns money movement. This post only answers how far the agent may go inside that decision point.
If you only do one thing
Fill one row in autonomy-spectrum-by-action.md for refunds. If you cannot defend Recommend or Request approval, strip the write tool until Cedar and HITL exist.
For your technical lead
On June 17, 2026, AgentCore Harness reached general availability — CreateHarness / InvokeHarness on Runtime, isolated Firecracker microVMs, tools via Gateway or MCP (What’s New).
AWS lifecycle notice (June 30, 2026) — Amazon Bedrock Agents Classic is in maintenance for new customers after July 30, 2026. Net-new agents should use Bedrock AgentCore. Full matrix: lifecycle roundup.
First-party signals we reuse (not eCommerce outcomes) — Gateway server-side tools cut median tool round-trip ~180 ms → ~95 ms on a B2B CRM assistant (12 tools, ~8k turns/day) — Gateway post. Platform TCO silhouette: support-style AgentCore at 50K sessions/mo ~$791/mo platform + model (decision guide). Model your mix on the AgentCore pricing calculator. Treat ~$791/mo as a platform cost floor, not savings.
Harness is the paved road for the first production agent: config for model, instructions, tools, Memory. Isolated sessions are Runtime microVMs whether you stay on Harness or export. Tools go through Gateway (OpenAPI / MCP / Lambda). Identity JWT claims must reach Cedar. Observability and CloudTrail on bedrock-agentcore.amazonaws.com are how you prove which level actually fired.
When you need hop caps or specialists, export to Strands on Runtime — Harness + Strands ship map. How FactualMinds composes the stack: production AI agents on AWS. Neither post is a substitute for this table.
Bedrock Converse plus Guardrails is the model layer — not the host. Strands 1.0 gives Agents-as-Tools, Graph, Swarm, Workflow when you export. Strands does not give you microVMs, Gateway, Identity, Policy, or secrets management. Do not encode autonomy as a Swarm hop.
Context: Python 3.12+, boto3 ≥ 1.38.0, IAM execution role, supported region. Sketch — pin the model your account allows. Autonomy is not a parameter here; it lives in tools + Policy.
# Sketch — InvokeHarness. runtimeSessionId must be at least 33 characters.
import boto3
import uuid
client = boto3.client("bedrock-agentcore", region_name="us-west-2")
response = client.invoke_harness(
harnessArn="arn:aws:bedrock-agentcore:us-west-2:123456789012:harness/commerce-support",
runtimeSessionId=str(uuid.uuid4()),
messages=[{"role": "user", "content": [{"text": "Refund order ORD-1001"}]}],
)If createReturn is attached, this turn is already past Recommend. Strip the tool until Request Approval / Cedar is real. Prompt text is not authorization. Run Policy LOG_ONLY, then ENFORCE.
Browser and Code Interpreter stay off by default. Support-shaped pilots with Browser left hot tracked roughly 3× Runtime-shaped spend — ship map.
The CRM canary (~180 → ~95 ms) is why Gateway stays in the path. It is not an SLA for “how fast we refund.” Your OMS dominates wall clock.
What to do this week
- List six actions: refunds, discounts, POs, customer messages, inventory writes, account changes.
- Score each row in
autonomy-spectrum-by-action.md. Default to Recommend if you argue. - Confirm write tools are absent for anything below Execute.
- Attach Gateway Policy
LOG_ONLYon the first candidate write — not five. - Stand up HITL before you promote Request Approval → Execute. Follow HITL.
- Browser off. Model sessions on the AgentCore pricing calculator.
- Run
monday-checklist.md. Then contact us if the first write is a refund.
What this post doesn’t cover
- Rules vs agent vs hybrid — post 11
- HITL queue payload and SLA fail-closed — post 38
- Identity, secrets, PII, payment boundary — post 39
- Which automation to staff first — post 40
- Supervisor + four specialists duplicated here — store-agents
- Measured refund-rate or CSAT lifts from a named client — we are not inventing them
FAQ
When should you NOT raise an eCommerce agent to Execute or Fully Automated?
Do not promote a write because WISMO notify worked. Keep Execute off refunds, inventory quantity, account mutation, and any payment-adjacent tool until Cedar is in ENFORCE, evals include must-not-write cases, and a HITL queue exists for the over-cap path. Fully Automated is for duplicate-safe notifies and read-grounded status — not money.
What could go wrong if autonomy is a single slider on the harness?
Every tool inherits the highest setting. Delay notices go out (good) and createReturn fires on a delivered fixture (bad). Autonomy is a table of actions, not a CreateHarness flag. Gateway Policy cannot save you if you attached the write tool and set the product to “just handle it.”
Is the autonomy spectrum the same as agent vs workflow?
No. Agent vs workflow (post 11) decides whether the loop or the state machine owns the path. This post assumes you already have an agent. It decides how far that agent may go on each action: Observe, Analyze, Recommend, Draft, Request Approval, Execute, Fully Automated.
When should you NOT fully automate customer communication?
Skip full automation when the message includes compensation, an invented ETA, or a policy exception. Carrier-exception delay notices can be Fully Automated if the template is fixed and the send is idempotent. Apology-plus-gift-card is Draft or Request Approval.
What could go wrong if refunds sit at Execute under a prompt cap of $50?
Prompt caps are not authorization. The model will refund delivered orders, stack two returns, or ignore the number. Put the cap in Cedar, run LOG_ONLY, then ENFORCE. Over-cap goes to HITL. Shopper JWTs must DENY associate refunds.
Does AgentCore Harness include an autonomy dial?
No. Harness (GA June 17, 2026) is the managed loop — CreateHarness / InvokeHarness on Runtime. You encode autonomy in tool allow-lists, Cedar, and the HITL queue. Strands 1.0 adds Graph and Agents-as-Tools after export; it still does not replace Policy.
Need a per-action autonomy table before the first refund tool goes live? Contact FactualMinds or see Amazon Bedrock.
AWS Cloud Architect & AI Expert
AWS-certified cloud architect and AI expert with deep expertise in cloud migrations, cost optimization, and generative AI on AWS.
