AI Agents in Retail: Assistants, Pricing and Orders

Retailers are letting AI agents quote prices, apply discounts, issue refunds and place supplier orders, and each of those agents reads text that customers, competitors or fraudsters can write. A shopping assistant that can apply a goodwill voucher, a pricing agent that reacts to scraped competitor prices and a returns agent that approves refunds are all money-moving systems, even when they look like chat features. This guide covers the retailer's own agents: where they sit, the threats specific to each, how to bound their identities and authority in the commerce platform rather than in the prompt, what payment, competition and consumer rules mean for them, and how to roll out and monitor them. It is written for retail CISOs, ecommerce platform owners, pricing and fraud teams. The wider retail security programme is in the Cybersecurity for Retail and Ecommerce Guide; shoppers' own agents arriving at your checkout are covered in Agentic Commerce for Merchants.

Source note: regulatory and standards points summarise the cited official sources with status checked on 12 November 2026.

Key takeaways

Prices and promises come from systems of record. An assistant should quote the price, stock and policy that the commerce platform returns, never a figure the model composes, so a manipulated conversation cannot create a binding offer.
Authority limits live in the platform. Discount caps, refund ceilings, price floors and order value limits are configured in the commerce, order management and pricing systems, where the agent's identity cannot exceed them.
Pricing agents need input integrity and competition law hygiene. Scraped competitor data can be poisoned, and the UK CMA has warned that not knowing how a pricing algorithm works is no defence.
Agents get their own narrow credentials. PCI SSC's 2025 AI principles call for use case and context specific credentials, least privilege and logged actions with one responsible person.
The retailer owns what its agent says. Tribunals have held a business liable for its chatbot's statements, so conversation logs, owners and approved answer sources are a legal need as well as a security one.

Where agents sit in retail

The risk of a retail agent depends on what it can change and how much money that moves. The table maps common 2026 deployments to the failure that matters most.

Agent	Typical tasks	What can go wrong	Money at risk
Shopping assistant	Product questions, recommendations, basket building, order status, applying promotions	Invented prices or terms, unauthorised discounts, another customer's order details disclosed	Low to medium per conversation, high at scale
Customer service and returns agent	Returns authorisations, refunds, replacements, delivery address changes, goodwill credits	Refund fraud at machine speed, account takeover through the agent, redirected deliveries	High
Pricing and markdown agent	Monitor competitor prices, propose or set prices and markdowns within rules	Prices driven to zero or absurd highs by poisoned inputs, margin loss, competition law exposure	Very high, across the catalogue
Order and fulfilment automation	Route orders, split shipments, handle exceptions, cancel or hold suspicious orders	Fraudulent orders released, legitimate orders cancelled, stock misallocated	Medium to high
Replenishment and procurement agent	Forecast demand, raise purchase orders, chase suppliers	Inflated orders, supplier bank detail fraud, manipulated supplier emails	High
Catalogue and content agent	Write product descriptions, attributes and translations from supplier feeds	Misleading claims, injected content published to the storefront	Low money, high reputational and consumer law risk

Procurement agents share most of their controls with the AI Agents in Procurement Guide, and service agents with the Customer Service AI Agents Security guide; this page concentrates on what is distinctive in retail: prices, promotions, refunds and orders.

Threats specific to retail agents

Bargaining by prompt injection: customers instruct the assistant to agree a price or confirm a discount. The Chevrolet dealer chatbot agreed a $1 sale of a 2024 Tahoe and called it binding because nothing outside the model limited what it could promise (OWASP LLM01:2025 Prompt Injection).
Wrong answers that bind: in the Air Canada chatbot ruling, the British Columbia Civil Resolution Tribunal rejected the argument that the airline was not responsible for its bot and found negligent misrepresentation. Returns and warranty policies stated by an agent carry the same risk (OWASP LLM09:2025 Misinformation).
Refund and goodwill abuse: a returns agent that approves refunds on a customer's description of damage turns social engineering into cash (ATT&CK T1657 Financial Theft; OWASP LLM06:2025 Excessive Agency). See the Refund and Returns Fraud Guide.
Promotion stacking: agents that can apply codes are probed for combinations the promotion engine would reject. See the Promotion and Bonus Abuse Guide.
Account takeover through the assistant: an assistant that changes delivery addresses, emails or loyalty details for a lightly verified customer is a takeover path. The Meta AI Instagram account takeover shows an AI support assistant sending recovery links to attackers.
Poisoned pricing inputs: competitor sites, marketplace listings and supplier feeds are untrusted. A rival or a fraudster can publish bait prices or hidden text to pull a pricing agent down (OWASP LLM04:2025 Data and Model Poisoning; ATT&CK T1565.001 Stored Data Manipulation where stored prices are changed).
Cross-customer disclosure: an assistant with broad order lookup repeats another customer's address or order (OWASP LLM02:2025 Sensitive Information Disclosure).
Integration token theft: chat and commerce integrations hold OAuth tokens into CRM and order systems. The Salesloft Drift breach showed tokens from one chatbot integration opening hundreds of Salesforce tenants (ATT&CK T1528 Steal Application Access Token).

Attackers also use agents against retailers. The AI agent retail card theft campaign chained web flaws, readable one-time passcodes and over-scoped cloud keys into a Secrets Manager dump and a Magento encryption key, taking over 600,000 cards from at least 27 retailers. The defences are the ordinary ones, applied without exceptions: scoped machine credentials and keys stored apart from the data they protect.

Bounding agent authority in the commerce stack

OWASP's Excessive Agency mitigations apply directly: limit the tools offered, limit what each tool can do, enforce permissions at the identity the tool uses downstream, and require human approval for high-impact actions. In retail the limits belong in specific systems.

Agent	Allowed	Never allowed	Enforced where
Shopping assistant	Read catalogue, live price and stock; read the signed-in customer's own orders; add to basket; apply public promotions through the promotion engine	Set or override a price, create a discount code, read other customers' data, take card numbers in chat	Commerce API scopes bound to the customer session; promotion engine rules
Returns and service agent	Create return authorisations within policy, issue refunds to the original payment method up to a per-order cap, offer goodwill credit from a fixed menu	Refund to a new payment method or gift card, change delivery address after dispatch, exceed daily refund totals	Order management roles and limits on the agent identity; payment service refund rules
Pricing agent	Propose prices; publish changes inside guardrails (floor at cost plus margin, ceiling, maximum change per cycle, excluded lines)	Publish outside guardrails, change cost data, price regulated or promotional lines without approval	Pricing engine rule set; approval workflow for out-of-band changes
Order automation	Hold, route and release orders against fraud scores; cancel duplicates	Override a fraud decline, release held high-value orders alone	Order management workflow; fraud platform decisions as hard inputs
Replenishment agent	Raise purchase orders to approved suppliers within budget and quantity bands	Add suppliers, change supplier bank details, exceed budget	ERP approval limits; supplier master data controls

One identity per agent role: no shared integration user and no agent acting through a store manager's or service representative's session. See the Agent Identity and Access Guide.
Money limits outside the model: per-transaction, per-customer and daily totals in the platform. A limit stated in a prompt is guidance, not a control. See the AI Agent Action Approvals and Spending Limits Guide.
Customer-bound access: the assistant reaches only the records of the customer authenticated in that session, enforced by the API. Sensitive changes (email, password, address on an open order) need step-up authentication the agent cannot perform for the customer.
Answers from approved sources: returns, warranty and delivery policies retrieved from a controlled knowledge source with version history, so a wrong answer can be traced and corrected.

Pricing agents: integrity and competition law

A pricing agent can change thousands of prices before anyone looks. Treat it as a high-impact system with three layers of control.

Input integrity: collect competitor prices from known sources, discard outliers against history (a 90% drop on one competitor is a signal to hold, not to follow), require corroboration from more than one source before acting on a large move, and strip page text so hidden instructions never reach a language model.
Output guardrails: hard floors and ceilings, a maximum percentage change per cycle and per day, and lines excluded from automation (regulated products, price-promised lines, items under active promotion). Breaches go to a pricing analyst.
Competition law hygiene: the CMA's 2024 guidance on pricing algorithms warns that rivals using the same pricing software may exchange confidential information such as pricing plans or stock levels without an explicit agreement, that users must understand how their tools work, and that infringements can bring fines of up to 10% of global turnover. Ask suppliers of pricing tools whether recommendations draw on other customers' confidential data, and record the answer.

Keep a price change log with the inputs, rule version and agent identity behind each change, so a pricing error or a competition authority question can be answered line by line.

Payments, consumer and AI rules

Source	Status	What it means for retail agents
PCI DSS v4.0.1 and PCI SSC AI Principles (blog, 11 September 2025)	Standard in force; principles are guidance	AI deployed in payment environments must comply with PCI requirements. AI should not hold responsibility-bearing roles, should have its own use case and context specific credentials, should have least privilege (Requirement 7) and logged actions with one responsible individual (Requirement 10), and should see account data only when protected; payment tokens or single-use PANs with spend, merchant or lifetime limits are acceptable. Details in AI Agents and PCI DSS.
PCI SSC additional guidance on securing AI in payment environments	Announced 7 October 2026; not mandatory, standards take precedence	Addresses how AI is deployed and how access is managed when AI acts with limited human involvement.
UK competition law (CMA blog, 8 November 2024)	Guidance on existing law	Pricing algorithms can implement or facilitate collusion; ignorance of how the tool works is no defence.
EU AI Act Article 50(1)	Applies from 2 August 2026	People interacting with an AI system must be told so unless it is obvious; a shopping assistant needs a clear AI disclosure.
Consumer and misrepresentation law (Moffatt v. Air Canada, 2024)	Tribunal decision, British Columbia	A business can be liable for its chatbot's statements; agent answers on price, returns and warranties need approved sources and logs.
GDPR and UK GDPR	In force	Conversation logs and order data are personal data: purpose limits, retention and security of processing apply.

Where identity fits

Every retail agent is a non-human identity with tokens into commerce, order management, payment, CRM and ERP systems. The credential, not the model, is what an attacker steals.

Short-lived, scoped tokens: issue per-session or short-lived tokens to agents and keep long-lived platform API keys in a secrets manager, scoped per agent and per store. See the AI Agent Credential Lifecycle Guide.
Connected app inventory: list every chat, recommendation and pricing integration with OAuth access to customer or order data, its scopes and owner; remove what is unused.
Keys apart from data: platform encryption keys and payment credentials never sit in configuration files the agent runtime can read.
Storefront write access: agents and their pipelines should not hold credentials that can change storefront code, scripts or CDN content.

Implementation: a phased rollout

Inventory: list every agent and AI feature in the storefront, service, pricing, order and ERP platforms, including features switched on by suppliers, with owner, identity, tools, limits and money-moving actions. Record them in an AI agent registry.
Set limits in the platforms first: refund caps, discount menus, price guardrails and order release rules on each agent identity, tested before any agent is connected.
Shadow mode: run assistants and pricing agents without effect; compare proposed refunds, discounts and prices with what staff and current rules would do.
Red team the money paths: try bargaining, promotion stacking, refund stories, address changes and poisoned competitor pages before launch.
Limited release: one region, category or channel, low caps, human review of anything above them.
Widen with evidence: raise caps only when refund loss, override and complaint metrics hold steady.
Rollback: a switch that returns pricing to the last approved price file and service to human queues, plus a kill switch that revokes agent tokens. Rehearse it before peak trading.

Small and large retailers: a small merchant on a hosted platform will mostly configure the platform's own assistant and should focus on the refund, discount and address-change settings and the app permissions it grants. A large retailer running its own agents needs the full identity design, a pricing change log and a dedicated fraud feedback loop.

Detection and measurement

Money anomalies: refund or goodwill totals per agent, per customer and per hour against baseline; refunds to new payment methods.
Price anomalies: changes near guardrails, many lines moving together, or moves driven by a single competitor source.
Conversation signals: instructions to override policy, attempts to extract the system prompt (OWASP LLM07:2025 System Prompt Leakage), repeated promotion code probing.
Identity signals: agent tokens used from unexpected networks or calling tools outside their role.

Metric	What good looks like
Refund value approved by agents that is later found fraudulent, per 1,000 refunds	No worse than human-handled refunds
Price changes blocked by guardrails and confirmed as correct blocks	Tracked weekly; a rise signals input problems
Agent answers on policy traced to an approved source version	100%
Agent identities with platform-enforced limits on every money-moving tool	100%
Time from detection to agent token revocation in exercises	Minutes, not hours

Framework mapping

Control area	NIST CSF 2.0	NIST SP 800-53 Rev 5	ISO/IEC 27001:2022 Annex A	CIS Controls v8.1
Scoped agent access and limits	PR.AA-05	AC-6	A.5.15, A.8.2	Control 6
Untrusted conversation and pricing inputs	PR.DS-10	SI-10	A.8.28	Control 16
Monitoring agent actions	DE.CM-09	AU-6, SI-4	A.8.15, A.8.16	Control 8
Agent and pricing tool suppliers	GV.SC-07	SA-9, SR-6	A.5.19, A.5.21	Control 15
Threats to money paths	ID.RA-03	SI-4	A.5.7	Control 18

Common failure patterns

Prices in the prompt. The assistant is told the price list in its instructions instead of calling the pricing service, so it can be talked into another number.
Refund caps only in policy text. The returns agent's tool can refund any amount, and the cap is a sentence in the system prompt.
Pricing agents that follow anything. No outlier rejection or change limit, so one bad competitor feed reprices a category overnight.
Shared integration accounts. Assistant, pricing and order agents use one platform API key, so nobody can tell which agent issued a refund or changed a price.
Unowned supplier assistants. A platform feature is switched on with default permissions and nobody owns its answers or its logs.
No rollback for peak. The agent misbehaves during a sale and there is no tested way to fall back to the last approved prices and human queues.

Practitioner checklist

Inventory every retail agent and supplier AI feature with owner, identity, tools and money-moving actions.
Serve prices, stock and policies to agents from systems of record, never from prompts.
Configure refund caps, discount menus, price guardrails and order release rules on each agent identity in the platform.
Give each agent role its own short-lived, scoped credentials; keep keys out of agent-readable configuration.
Require step-up authentication for customer account changes made through an assistant.
Validate and corroborate competitor price inputs and keep a price change log.
Ask pricing tool suppliers how recommendations use other customers' data, and record the answer.
Disclose AI to shoppers and log conversations under a defined retention period.
Rehearse the kill switch and price rollback before peak trading.

AI Agents in Retail: Securing Shopping Assistants, Pricing Agents and Order Automation