On Monday you connect Claude to answer order questions. By Wednesday a freelancer wants access to rewrite product descriptions, and your 3PL is asking for an API key so it can push stock counts. Three jobs, three very different levels of risk, and the usual answer to all of them is an administrator login or a full read-write API key.
The agents that save time are not the ones with the most access. They are the ones with a narrow brief: read these things, change only these things, touch nothing else. A support assistant that cannot refund. A fulfilment connection that can add tracking but cannot cancel an order. The boundary is what makes an agent safe enough to leave running.
AI Agent OS, our MCP governance plugin for WooCommerce, ships six ready-made WooCommerce AI agent profiles, each built around a specific job. Below is what each one does, what it locks out, when it is worth setting up, and which jobs to keep away from agents altogether.
How permissions shape what a WooCommerce AI agent can do
Every tool a plugin offers to agents is rated Read, Write or Destructive. Each agent gets a grant per tool: None, Read or Write. A tool set to None is not shown to the AI app at all. Destructive tools, meaning deletes, cancellations and refunds, need a Write grant plus two switches: Allow destructive abilities site-wide in Settings, and the agent’s own Allow destructive abilities switch. None of the six profiles turns them on.
Each agent also has a customer data setting. With masking on, customer names, emails, phone numbers and addresses come back as [masked]. The tools keep working; the agent never sees who the customer is.
| Profile | The job | Locked out | Customer data |
|---|---|---|---|
| Support Agent | Answer order-status and policy questions | Every change: it writes nothing | Masked |
| Fulfillment Agent | Read orders and add shipment tracking | Refunds and cancellations | Masked |
| Supplier Agent | Read products and sync stock | Orders and prices | Masked |
| Shopping Agent | Search products for a shopper | Any admin access | Masked |
| Store Admin Agent | Your own day-to-day store work | Destructive tools, until you unlock them | Visible |
| Admin Assistant | Answer questions from your store knowledge | Orders, customers and products | Masked |
A profile is a starting point. When you add an agent, the permissions table below the profile cards shows exactly what will be saved, and you can change any row before you click Create agent or at any time afterwards. For the full creation and connection walkthrough, see how to give AI agents safe access to your WooCommerce store.
Answer order status questions without changing anything
The Support Agent looks up order status and answers from your store knowledge, such as the returns and shipping pages you have chosen in the Business Brain. It changes nothing. Customer details are masked: it can tell you order #1234 is Processing, but not whose order it is.
The job is drafting replies to order and policy questions without opening each order by hand. Ask it for the status of a list of order numbers, or what your returns window is, before you write back to a customer.
AI Agent OS is not a chatbot and does not reply to anyone itself. You bring the AI app, and whether its answers go straight to a customer or past a person first is decided in that app, not by the profile. If the goal is fewer questions in the first place, proactive tracking notifications stop many of them before they are asked.
Add tracking numbers to orders in bulk
The Fulfillment Agent reads orders and updates shipment tracking. Customer details are masked and refunds are out of reach. Order status changes to cancelled, refunded, failed or trash are treated as destructive, so even a Write grant on order status cannot cancel or refund an order while the destructive switches are off.
The tracking tools come from Advanced Shipment Tracking Pro (AST PRO), our WooCommerce shipment tracking plugin. With it installed, the agent can list unfulfilled orders that have no tracking, then add tracking to each one with the order number, the tracking number and a carrier name that matches one of your enabled carriers or an API alias. Give it the morning’s dispatch list and it works through the orders one by one.
Adding tracking through an agent follows the same rules as adding it by hand. Carrier validation, order status changes and customer emails all run according to your AST PRO settings, so if your shipping email is sent when an order moves to Shipped, that is still when it is sent. Removing tracking is a separate tool rated as a delete. Leave it off for this profile.
This profile suits a fulfilment coordinator or a logistics connection that needs to write shipment data with no path to financial actions. If you are still choosing a tracking plugin, our comparison of WooCommerce shipment tracking plugins covers the options.
Sync stock with a supplier or fulfilment partner
The Supplier Agent reads products and syncs inventory. It cannot see orders and it cannot change prices. Customer data is masked.
The job: a supplier or 3PL connects once, reads current stock counts and updates them as goods arrive or leave. The price lock is deliberate. A connection that can change stock and prices carries a different kind of risk, and very few supplier integrations need both.
Many supplier systems do not speak MCP and use WooCommerce’s REST API instead. For those, open the agent’s Connection section and click Create a WooCommerce API key. A key created the usual way under your own account acts with your full rights. A key issued from an agent can only do what that agent is granted, and requests for anything no agent tool describes, such as customers, coupons or reports, are refused. The WooCommerce API keys guide lists which routes map to which tools.
Help shoppers find products
The Shopping Agent searches products for a shopper. It has no admin access, and customer data is masked.
The job is a product discovery layer on a channel you control, such as a chat assistant you run. A shopper asks what sizes a jacket comes in, and the agent searches the catalogue and answers from your product data. If you upload your FAQ to the Business Brain as a Markdown file in the faqs collection, agents built from this profile can read it with no extra setup.
It cannot add to cart, place an order or change stock, because it has no tool for any of those. Which tools are available beyond product search depends on the plugins you run and what they expose to agents.
Run day-to-day store management tasks
The Store Admin Agent is the broadest profile: your own assistant across products, orders and content. It is the only profile where customer names, emails, phone numbers and addresses are visible.
The job is your own work, from your own device: drafting product descriptions, checking order volumes, updating stock, pulling a filtered list of recent orders, adding order notes. Because the access is broad and customer data is visible, do not share this agent with a partner, agency or automated integration. Create a narrower agent for every outside connection.
One trap is worth knowing. An agent created with No profile also acts for the store administrator and starts with customer data unmasked. If it is meant for anyone outside your team, switch masking on before you connect it.
Destructive tools stay off here too. The Store Admin Agent cannot refund or delete orders or products until you turn on the site-wide switch first and then the agent’s own switch.
Get answers from your own store knowledge
The Admin Assistant answers questions about your site’s plugins from the Business Brain. It has no access to orders, customers or products.
The job is a quick-answer layer for how-tos and internal process: where a setting lives, what your shipping policy says about oversized items, how a plugin you run handles a particular case. It looks answers up in your pages, a plain-English summary of your WooCommerce settings and plugin documentation, instead of guessing.
You choose that knowledge under AI Agent OS → Business Brain, and it is worth knowing what is and is not reviewed. A page you tick there can be quoted by every active agent. Uploaded Markdown documents are used straight away, without review, so check them before you upload. Edits to a chosen page by someone who cannot edit other people’s pages wait on the Review tab until you approve them. Text from the Brain always reaches an agent as a quotation, so an instruction written inside a page, such as “cancel all orders”, is repeated, never obeyed. The Business Brain docs cover which agents can read which knowledge.
What to keep away from agents for now
Refunds, cancellations, order deletion and product deletion are blocked for every agent unless you unlock them deliberately. That default is right for almost every store.
A refund issued because an agent matched the wrong order number, or a product deleted because it matched the wrong SKU, cannot be undone. The jobs that genuinely need those tools are narrow. Before unlocking one, ask whether the time saved is worth the exposure if the agent acts on bad input.
Two more limits are worth stating plainly:
- Masking stops at what you grant. Whatever an agent may read goes to the AI app and its provider. Masking hides customer contact details, but every other field the agent can read still leaves your site.
- The log’s description of a request is the AI’s own account. Each Activity Log row includes a one-line summary written by the AI app, and it is not checked. The tool name and the outcome are what to trust.
Every call an agent makes is logged under AI Agent OS → Activity Log with the agent, the app it used, the tool and the outcome: Worked, Changed something, Problem or Not allowed. Refused rows are tinted red and show the reason. Review that log before widening any agent’s permissions. The Activity Log docs explain each refusal reason and what to do about it.
Frequently asked questions
Can I change a profile’s permissions after creating the agent?
Yes. Go to AI Agent OS → Agents, open the agent and stay on its Permissions section. Set each tool to None, Read or Write, then click Save permissions; there is no unsaved-changes warning. The AI app sees the new tool list the next time it connects, usually a new chat. To add everything a profile has, pick it at the top of the table and click Apply.
Can two AI apps connect as the same agent?
Yes. Several apps can connect as one agent, and all of them work under its permissions. The Activity Log still shows which app made each call. Create separate agents when you want different permissions for each app, or want to revoke one without disconnecting the other, since revoking an agent disconnects every app connected as it.
How do I turn customer data masking on or off?
Open the agent, go to its Connection section, switch Mask customer personal data in the Access card, and click Save changes. It applies from the agent’s next call. The Support, Fulfillment, Supplier and Shopping profiles start masked. Store Admin Agent, and any agent created with No profile, start unmasked. See the customer data and privacy docs.
What if a plugin does not rate its tools?
AI Agent OS works out a rating from the tool’s name and description and picks the higher risk when unsure. An asterisk, such as WRITE*, marks a rating worked out this way. Order status changes to cancelled, refunded, failed or trash are always treated as destructive. An administrator can override any rating under AI Agent OS → Settings → Tool risk levels.
Do these profiles work with WooCommerce API keys, not just MCP?
Yes. A key issued from an agent gets the same permissions, the same customer data masking and the same Activity Log as that agent’s MCP connection. Reading orders, changing order status, adding order notes and working with products are covered. Requests for customers, coupons, reports and other order edits are refused, because no agent tool describes them.
Start with one agent and one job
The quickest way to judge whether any of these profiles is worth running is to create one, connect it, and ask it to do something outside its brief. Ask a new Support Agent to refund an order, then open the Activity Log. If the request is there as Not allowed, the boundary holds, and you can decide what to give the agent next. Widen the scope after you have seen how it behaves, not before.
Give every AI agent on your store one job and only the tools it needs.