Yes. In agentic commerce, the identity decision does not end at payment authorisation because the same delegated authority may later be used to cancel, reroute, or refund orders. That makes post-purchase actions part of the governed trust chain, especially where the agent can operate without fresh human confirmation.
Why Returns and Refunds Belong in the Same Governed Trust Chain
Returns, cancellations, reroutes, chargebacks, and refunds are not separate from the original identity decision when an agent can act on behalf of a customer or employee. They are later steps in the same delegated authority chain, so fraud teams should judge whether the actor still has the right, context, and bounds to complete the post-purchase action. If those controls are weak, the fraud path simply moves downstream.
That means the relevant question is not only “was the payment legitimate?”, but also “is this post-purchase action still consistent with the original trust grant?” In practice, refunds and return requests can become the easiest place to exploit stale authority, because business pressure favours speed and customer friction is lower than at checkout.
A useful way to frame the issue is to treat post-purchase operations as governed entitlement events. The same access model that supports the transaction should also limit who can cancel, redirect, or recover value from it, especially when the request is made by an autonomous agent rather than a person.
For teams building the control model, IAM and IGA Basics is a good reference point for thinking about authorization, access review, and lifecycle control across people and machines. The same lifecycle logic also appears in Ultimate Guide to NHIs, Lifecycle Processes for Managing NHIs, where ongoing authority must be managed after initial issuance.
What Fraud Teams Need to Control After Checkout
Post-purchase governance usually breaks down around three practical questions. First, does the actor have standing authority to initiate the action? Second, has the request crossed a boundary that should require fresh confirmation, such as a refund to a new destination or a high-value return exception? Third, can the team prove that the action was authorized by the right principal, for the right order, within the right time window?
This is where identity governance becomes operational, not theoretical. If an agent can continue acting after payment, the team needs explicit rules for duration, scope, and revocation. Otherwise, a legitimate initial purchase can still end in fraudulent value extraction through cancellation abuse, refund redirection, return abuse, or post-purchase social engineering.
Controls should therefore focus on the action itself, not just the account that placed the order. The most important distinction is between routine fulfillment, which may proceed under delegated authority, and value-recovering actions, which should carry tighter approval, stronger step-up checks, or a narrower set of permitted destinations.
Where organisations need a lifecycle lens for machine- or agent-driven access, Access Reviews and Certification Guide is relevant because it focuses on closing access paths, not just granting them. For ownership and segregation questions, Segregation of Duties (SoD) Guide is a strong fit when the same party should not be able to initiate, approve, and receive the financial outcome of the same transaction.
Where the Fraud Boundary Should Move in Agentic Commerce
The boundary should move from “payment success” to “post-purchase authority remains valid.” That shift matters because agents can preserve access longer than humans expect, especially when tokens, sessions, or delegated permissions are reused across the entire order lifecycle. Fraud teams should assume that a valid purchase can still be followed by a bad refund if the downstream action is not separately governed.
Practically, that means return and refund workflows need their own decisioning signals. Compare the order context, shipping address, refund destination, device or channel continuity, and prior exception history against the original authorization. When those signals do not align, treat the request as a new trust decision rather than a continuation of the original one.
This is also where lifecycle discipline and fraud discipline overlap. Joiner-Mover-Leaver (JML) Guide is useful because it shows why authority should be revoked or narrowed when context changes, while Identity Fraud Prevention Guide maps the kinds of signals that expose abuse patterns across the customer lifecycle.
Risk and Threat Considerations
Returns and refunds are attractive fraud targets because they convert a legitimate transaction into recoverable value, often with less scrutiny than the original purchase. In agentic commerce, stale delegated authority, weak destination checks, and exception-driven manual handling can let a compromised or over-permitted actor extract money or goods after the checkout decision has already been approved.
Failure mechanism: The control fails when downstream actions inherit the original trust grant without re-validating scope, destination, or time-limited authority, so a legitimate order becomes a vehicle for unauthorized refund, reroute, or cancellation.
Impact: Organisations can suffer direct financial loss, inventory loss, false-positive disputes, higher chargeback rates, and weaker fraud signal quality because abusive post-purchase activity blends into normal fulfilment operations.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-9 — Service Identification and Authentication | Post-purchase agents and services need bounded authentication for downstream value-moving actions. |
| AC-6 — Least Privilege | Refund, cancel, and reroute powers should be narrower than ordinary order processing rights. | |
| Recommendation — Bind refund and return actions to authenticated service or workload identity before allowing value recovery. Restrict post-purchase authority to the minimum actions needed for the workflow. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Agent-driven refund paths can become abusive when delegated authority exceeds the task. |
| NHI-07 — Long-Lived Secrets | Downstream refund abuse is easier when credentials outlive the original transaction context. | |
| Recommendation — Limit delegated post-purchase privileges to the exact actions and destinations required. Rotate or expire credentials that can still authorize post-purchase value movement. | ||
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Agentic refund and cancellation flows are exposed when delegated authority is reused beyond intent. |
| ASI02 — Tool Misuse | Refund systems are tool targets that agents can misuse if action boundaries are weak. | |
| Recommendation — Constrain agent authority so post-purchase actions cannot exceed the intended transaction scope. Require explicit policy checks before an agent can invoke refund or return tools. | ||
| MITRE ATT&CK | T1098 — Account Manipulation | Abuse of delegated access and retained authority can support unauthorized post-purchase actions. |
| Recommendation — Watch for manipulated access paths that let an actor retain refund-capable authority. | ||
| NIST SP 800-63 | IAL1 — Identity Assurance Level 1 | When a refund or return becomes a separate trust decision, assurance of the actor matters. |
| Recommendation — Require stronger assurance or step-up checks before high-value refund approvals. | ||
Practitioner Guidance
What to prioritise: Put post-purchase actions into the same governance model as purchase authorization, but give refunds, cancellations, and reroutes a narrower permission set than ordinary order processing. The highest-risk gap is any workflow that can both initiate and complete value recovery without independent review.
What to verify: Verify that refund and return requests are bound to the original order, that the destination is not silently changed, and that delegated authority expires or narrows when the order moves from fulfilment to recovery. If you cannot show that linkage, you do not yet have governance, only process speed.
Practitioner takeaway: Fraud teams should treat post-purchase actions as governed identity events, because the real control question is whether the actor is still entitled to move value after the sale, not whether the sale itself was authentic.
Related resources from NHI Mgmt Group
- Should identity teams treat proofing as part of access governance?
- Should teams treat server-side application permissions as part of identity governance?
- Should IAM teams treat policy-based access control as part of identity governance?
- Should IAM teams treat Linux authentication as part of workforce identity governance?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 11, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org