What can an AI agent do with
Read your customer list?
It can see your customers and their contact details, purchase history, and marketing preferences.
How to spot it
On a Shopify connection or settings screen, this is read_customers.
With it, an agent can
- See customer names, emails, and locations
- See what each customer bought and how much they spent
- See marketing preferences and customer segments
It cannot, on its own
- It cannot add, change, or delete customers
- Protected customer details stay hidden until Shopify approves the app to use them
What a bad day looks like
If it is tricked, it could hand your customer list, with emails and spending history, to someone outside your business.
Set it up safer
- Grant read_customers without write_customers if it only needs to look people up
Ask the company selling the agent
- Do you use my customer data to train AI models?
- Has Shopify approved your app for protected customer data?
- Where is my customer data stored, and who can see it?
Source
Checked against Shopify documentation on 2026-09-28. All Shopify permissions →
Thinking about a specific agent?
Tell us what it connects to, what it is allowed to do and who approves its work. You get a plain-language label of what it can touch and what to ask the seller. It takes a couple of minutes, and your answers stay in your browser unless you choose to post a test job.
Or have a person go through the AI apps on up to 3 of your business services with you and get a written report, for $249.
This page explains what a permission allows. It does not describe, test or rate any product. Permission details are summarized in our own words from the provider's documentation, linked on the page; providers change their documentation, so check the source before you rely on a detail.