How Much Autonomy Should You Give an eCommerce AI Agent? (2026)

Vendors sell one knob: “autonomous agent.” For a store, the question is simpler: which action may run without a person, this week? A delay notice that cites the carrier scan needs a different permission than a refund, so give them separate rows.

This post assumes you already decided to run an agent. AI agent vs workflow automation chooses rules vs agent vs hybrid; this post picks a level per action after the agent exists.

The job. Stop one “autonomous” flag from letting refunds, inventory writes, and delay emails inherit the same permission.

This week. List six actions: refunds, discounts, POs, customer messages, inventory, and account changes. Default each to Recommend unless you can defend higher.

A person still signs. Refunds over your cap, large POs, compensation emails, account changes, and anything on a delivered-not-received case.

Skip it when you cannot name the action, when Policy is not attached, or when the only goal is “just handle refunds.”

FactualMinds is an AWS Select Tier Services Partner. Demo caps below are worksheets, not store KPIs.

Our take: set autonomy per action, not on the harness. A table you maintain is safer than a demo that “just refunds.”

Seven autonomy levels

Promote one step after evals. Skipping from Draft straight to Execute lets a polite model start writing to your ledger.

Next.js / TypeScript / Tailwind can serve as the approval dashboard when you need buttons, but it is not the runtime. Detail: HITL post.

flowchart LR
  Observe --> Analyze
  Analyze --> Recommend
  Recommend --> Draft
  Draft --> RequestApproval
  RequestApproval --> Execute
  Execute --> FullyAutomated

Default level per action (fill the artifact; do not copy caps blindly)

Demo $75 refund ceiling matches the public store-agents Cedar sketch. It is a worksheet, not your finance policy.

Payment capture and card data are not a level. They stay out of the tool set. See store-connected security.

What “promote a level” means in practice

1. Goldens at the current level pass, including must-not-write.
2. LOG_ONLY traces show the writes you would have allowed and the ones you would DENY.
3. HITL queue exists for the over-cap / irreversible path (architecture artifact).
4. Flip Cedar to ENFORCE for that one action.
5. Watch DENY spikes and tool mix for a canary week before the next action.

What broke

A second, already-published failure: dual-write cancel-on-delivered when the agent both decided and executed (store-agents sample). Hybrid still owns money movement. This post covers how far the agent may go inside that decision point.

One row to fill first

Fill one row in autonomy-spectrum-by-action.md for refunds. If you cannot defend Recommend or Request approval, strip the write tool until Cedar and HITL exist.

For your technical lead

On June 17, 2026, AgentCore Harness reached general availability: CreateHarness / InvokeHarness on Runtime, isolated Firecracker microVMs, tools via Gateway or MCP (What’s New).

Harness is the standard path for a first production agent: config for model, instructions, tools, Memory. Isolated sessions are Runtime microVMs whether you stay on Harness or export. Tools go through Gateway (OpenAPI / MCP / Lambda). Identity JWT claims must reach Cedar. Observability and CloudTrail on bedrock-agentcore.amazonaws.com are how you prove which level actually fired.

When you need hop caps or specialists, export to Strands on Runtime; see the Harness + Strands ship map. How FactualMinds composes the stack: production AI agents on AWS. Neither post replaces this table.

Bedrock Converse plus Guardrails is the model layer, not the host. Strands 1.0 gives Agents-as-Tools, Graph, Swarm, Workflow when you export. Strands does not give you microVMs, Gateway, Identity, Policy, or secrets management. Do not encode autonomy as a Swarm hop.

Context: Python 3.12+, boto3 ≥ 1.38.0, IAM execution role, supported region. Sketch: pin the model your account allows. Autonomy is not a parameter here; it lives in tools + Policy.

# Sketch — InvokeHarness. runtimeSessionId must be at least 33 characters.
import boto3
import uuid

client = boto3.client("bedrock-agentcore", region_name="us-west-2")
response = client.invoke_harness(
    harnessArn="arn:aws:bedrock-agentcore:us-west-2:123456789012:harness/commerce-support",
    runtimeSessionId=str(uuid.uuid4()),
    messages=[{"role": "user", "content": [{"text": "Refund order ORD-1001"}]}],
)

If createReturn is attached, this turn is already past Recommend. Strip the tool until Request Approval / Cedar is real. Prompt text is not authorization. Run Policy LOG_ONLY, then ENFORCE.

Browser and Code Interpreter stay off by default. Support-shaped pilots with Browser left hot tracked roughly 3× Runtime-shaped spend (ship map).

The CRM canary (~180 → ~95 ms) is why Gateway stays in the path. It is not an SLA for “how fast we refund,” because your OMS dominates wall clock.

What to do this week

1. List six actions: refunds, discounts, POs, customer messages, inventory writes, account changes.
2. Score each row in autonomy-spectrum-by-action.md. Default to Recommend if you argue.
3. Confirm write tools are absent for anything below Execute.
4. Attach Gateway Policy LOG_ONLY on the first candidate write, not five.
5. Stand up HITL before you promote Request Approval → Execute. Follow HITL.
6. Browser off. Model sessions on the AgentCore pricing calculator.
7. Run monday-checklist.md. Then contact us if the first write is a refund.

What this post doesn’t cover

• Rules vs agent vs hybrid: post 11
• HITL queue payload and SLA fail-closed: post 38
• Identity, secrets, PII, payment boundary: post 39
• Which automation to staff first: post 40
• Supervisor + four specialists duplicated here: store-agents
• Measured refund-rate or CSAT lifts from a named client; we are not inventing them

FAQ

When should you NOT raise an eCommerce agent to Execute or Fully Automated?

Do not promote a write because WISMO notify worked. Keep Execute off refunds, inventory quantity, account mutation, and any payment-adjacent tool until Cedar is in ENFORCE, evals include must-not-write cases, and a HITL queue exists for the over-cap path. Fully Automated is for duplicate-safe notifies and read-grounded status, not money.

What could go wrong if autonomy is a single slider on the harness?

Every tool inherits the highest setting. Delay notices go out (good) and createReturn fires on a delivered fixture (bad). Autonomy is a table of actions, not a CreateHarness flag. Gateway Policy cannot save you if you attached the write tool and set the product to “just handle it.”

Is the autonomy spectrum the same as agent vs workflow?

No. Agent vs workflow (post 11) decides whether the loop or the state machine owns the path. This post assumes you already have an agent. It decides how far that agent may go on each action: Observe, Analyze, Recommend, Draft, Request Approval, Execute, Fully Automated.

When should you NOT fully automate customer communication?

Skip full automation when the message includes compensation, an invented ETA, or a policy exception. Carrier-exception delay notices can be Fully Automated if the template is fixed and the send is idempotent. Apology-plus-gift-card is Draft or Request Approval.

What could go wrong if refunds sit at Execute under a prompt cap of $50?

Prompt caps are not authorization. The model will refund delivered orders, stack two returns, or ignore the number. Put the cap in Cedar, run LOG_ONLY, then ENFORCE. Over-cap goes to HITL. Shopper JWTs must DENY associate refunds.

Does AgentCore Harness include an autonomy dial?

No. Harness (GA June 17, 2026) is the managed loop: CreateHarness / InvokeHarness on Runtime. You encode autonomy in tool allow-lists, Cedar, and the HITL queue. Strands 1.0 adds Graph and Agents-as-Tools after export; it still does not replace Policy.

Need a per-action autonomy table before the first refund tool goes live? Contact FactualMinds or see Amazon Bedrock.