An iCommerce agent combines observations, a proposed business action and an execution host.
The host owns identity, policy, credentials and store selection. The model does not supply
its own authority by choosing a tool name or adding an apply field.
Work through the loop
- Observe. Read the intended order, stock, payment/return and external evidence. Preserve
record identities and scope; a partial list is not a complete snapshot.
- Test. Use a preview or isolated simulation with explicit
assumptions. A projection or preview does not establish authorization or future demand.
- Authorize. Load operator-owned principal/policy, capability/delegation, scope, versions,
approval and exact resource limits required by the command.
- Execute. Persist original key/payload before sending a typed governed operation. The
receipt records decision, result, versions, event identities and retry disposition.
- Reconcile. Check native state, stock posting, provider/ERP outcomes and evidence
separately. Preserve uncertainty rather than creating another key after a lost response.
Core is the default MCP tier, with 209 source tools. all has 966 before endpoint filtering;
experimental domains can depend on external stacks or incomplete support. A profile selects
discovery, not permission. Strict endpoints expose supported governed writes and available reads.
Use MCP setup and
governed execution.
Direct native mutations are application APIs; they do not automatically create governed
receipts. General audit logging is not universal. A broad domain accessor list does not prove
the full return/disposition, financial posting, or external settlement workflow is exposed.
Isolate untrusted execution
A kernel policy is not an OS sandbox. For generated code or long-lived workers, configure
Sandbox, explicit runtime availability,
secret access, time budgets and cleanup. Database authority remains independently scoped.
Persist receipts/artifacts before terminating temporary workers.
For scripts prefer typed operations and deterministic commands over repeated natural-language
interpretation. Deterministic syntax still needs authorization, state checks and recovery. Last modified on October 20, 2026
