You connected Claude to your store last week to answer a simple question: which orders from Tuesday still have no tracking number? It answered. It could just as easily have refunded an order or read every customer’s phone number, because most MCP setups give the AI app whatever the connected user can do, and that user is usually an administrator.
The fix is not to keep AI out of the store. It is to treat each AI app as its own worker with its own job description: a support agent that can look up orders but change nothing, a fulfilment agent that can add tracking but cannot refund, and a record of everything either of them did.
That is what AI Agent OS, our MCP governance plugin for WooCommerce, does. It launches today, 14 October 2026. Below: how it works, how to set up your first agent, what it does not do, and a launch discount.
Why connecting AI to WooCommerce needs permissions
WordPress 6.9 added the Abilities API, a standard way for plugins to describe what they can do: query orders, update a product, add a tracking number. The official MCP Adapter turns those abilities into tools that Claude, ChatGPT, Codex and other MCP clients can call.
Two gaps follow. Nothing tells you which tools exist or how risky each is: an order search and a product delete look the same to the AI app. And nothing separates one AI app from another, so when something changes you cannot see which one did it.
AI Agent OS sits between the MCP client and your store. Every agent request is checked against that agent’s grants, run or refused, and logged. Shoppers and checkout never pass through it.
What an agent is, and what it can be allowed to do
An agent is a named identity with its own MCP address, permissions and a setting for who it acts for: the store administrator, a partner or the public. Create one agent per job, not one per AI app.
Every tool on the site gets a risk rating, and each agent gets a grant per tool:
| Risk tier | What it covers | What the agent needs |
|---|---|---|
| Read | Lookups that change nothing, such as an order or product search | A Read grant |
| Write | Creating or changing data, such as adding tracking or an order note | A Write grant |
| Destructive | Deletes, cancellations and refunds that cannot be undone | A Write grant, plus a site-wide switch and the agent’s own switch, both off by default |
If a plugin does not declare a risk level, AI Agent OS infers one from the tool’s name and description and picks the higher risk when unsure. Order-status changes to cancelled, refunded, failed or trash count as destructive, so an agent cannot refund through the back door of a status update. A tool with no grant does not appear in the agent’s tool list at all.
Six ready-made profiles give you a starting point, from Support Agent to Store Admin Agent. A Support Agent can look up order status and read your policies, but cannot change or refund anything, and sees customer details masked: the agent you would put behind the kind of order-status questions covered in our post on reducing “where is my order” tickets.
How to set up your first AI agent in WooCommerce
You need WordPress 6.9 or later, PHP 8.0 or later, WooCommerce for the store tools, an administrator account, and an active AI Agent OS licence. To connect by signing in, the site must run on HTTPS and permalinks must not be set to Plain.
- Install and activate the plugin, then go to AI Agent OS → License and click Connect & Activate License. Sign in on zorem.com with the account you bought it with. The other tabs appear once the licence is active.
- Go to AI Agent OS → Agents and click Add agent. Name it after its job, such as “Order lookups”, not after the app that will connect. The name is what you will see in the activity log.
- Optionally set Expires. The agent stops at the start of that day (UTC), so pick the day after its last working day.
- Click a profile card, or keep No profile to start with no permissions. Review the permissions table, which shows exactly what will be saved, then click Create agent.
- Open the agent’s Connection section and click Copy next to the agent’s address.
- In Claude, go to Settings → Connectors → Add custom connector, paste the address, leave the OAuth client ID and secret empty, then click Add and Connect.
- Sign in to your site as an administrator, check that the approval screen names the agent you expect, and click Approve and connect.
ChatGPT and Codex follow a similar sign-in flow; Codex first needs Let clients register themselves to sign in under AI Agent OS → Settings switched on. Apps that cannot sign in can use a token instead. Full steps are in the AI Agent OS connection guide.
To change what an agent can do later, go to AI Agent OS → Agents → Configure → Permissions, set each tool to None, Read or Write, and click Save permissions. The app sees the new tool list on its next connection, usually a new chat.
How to confirm the agent is doing only what you allowed
Go to AI Agent OS → Activity Log. Each row shows when the call happened, which agent made it and from which app, the tool it used, how long it took, and the outcome: Worked, Changed something, Problem or Not allowed. Refused calls are shaded red and show the reason.
A good first test is to ask your new Support Agent to refund an order. The request should appear in the log as Not allowed. If it does not, check its permissions before connecting anything else.
A 30-day summary at the top shows which agents call your store and how often they were refused. You can filter by agent, outcome, tool or date and export up to 5,000 matching rows to CSV. Activity is kept for 30 days by default; change it with Keep activity for (days) in Settings, anywhere from 7 to 365.
How agents learn your store: Business Brain and Business Skills
Permissions decide what an agent can do. The Business Brain decides what it knows: your policies, pages and the documentation of the plugins you run, read on your own server, and shared with each agent only as far as you allow. Business Skills are short manuals that teach an agent to use a plugin’s tools well, such as which carrier names a shipment tracking plugin expects. Nothing generated reaches an agent until you approve it.
What AI Agent OS does not do
- It is not an AI model or chatbot. You bring the AI app; the plugin governs what it can reach.
- It cannot stop data leaving once you grant it. Whatever an agent may read goes to the AI app and its provider. Masking hides customer contact details for agents not acting for the administrator, but a grant is still a grant.
- It does not verify what the AI says it is doing. The one-line description in each log row is written by the AI app. The tool name and outcome are what to trust.
- It does not change your existing plugins. It governs only tools plugins expose as abilities, plus WooCommerce API keys you create for an agent.
- It does not work without a licence. Until a licence is active, agents, connections, tools and the Business Brain stay off.
Launch offer: 40% off until 31 October 2026
To mark the launch, use the code AGENTOS40 at checkout for 40% off any AI Agent OS licence. Licences start at $129 a year for one site, so the single-site licence comes to $77.40 for the first year with the code. The code is valid until 31 October 2026. Every licence includes a 14-day money-back guarantee, and staging sites are free.
FAQ
What is an MCP governance plugin?
MCP is the protocol AI apps such as Claude and ChatGPT use to call tools on another system. A governance plugin controls which of your site’s tools each connected app can use. In AI Agent OS, every app connects as an agent you configured, uses only the tools you granted, and every call and refusal is logged.
Does it slow down checkout?
No. Shoppers and checkout do not pass through AI Agent OS. It only checks requests that arrive from an agent over MCP or through a WooCommerce API key you created for that agent.
Can I connect several AI apps at once?
Yes. Each agent has its own MCP address, so you can add several agents as separate connectors in the same app, or connect different apps to different agents. Revoking one agent disconnects only the apps connected as that agent, and the activity log can be filtered by agent.
How do I stop an agent immediately?
Click Revoke on the agent’s row in AI Agent OS → Agents. The agent stops at once and every app connected as it is disconnected, while its permissions and history are kept. Reactivate brings it back, though apps must sign in again. Delete removes it permanently, but its activity history stays in the log.
Does AI Agent OS send my store data anywhere?
Not by default. The only calls to zorem.com are the daily licence check and the update check, and they carry no orders, products or customer data. Data reaches an AI provider only through an agent you connected and only within its grants, or if you add a provider key and switch on an optional AI feature yourself.
Conclusion
The question is not whether AI apps work on your store but whether each gets the job it was hired for or the keys to everything. Start with one agent, give it Read access to orders, ask it to do something it should not, and check the log. If the refusal is there, you have the control you need to give it more.
Use AGENTOS40 for 40% off until 31 October 2026.