What can an AI agent do with
Read recent orders?
It can see your store's orders from the last 60 days. That includes who bought, what they bought, payments, and shipping.
How to spot it
On a Shopify connection or settings screen, this is read_orders.
With it, an agent can
- See orders placed in the last 60 days
- See customer, items, and status on each order
- See payment transactions and fulfillment details on those orders
- See abandoned checkouts
It cannot, on its own
- It cannot change, cancel, or refund orders
- It cannot see orders older than 60 days unless it also has read_all_orders
What a bad day looks like
If it is tricked, it could copy your customers' names, addresses, and order history to a place you never agreed to.
Set it up safer
- Grant read_orders without write_orders so it can look but not change anything
Ask the company selling the agent
- Where do you store my order data, and for how long?
- Do you send my order data to any other company?
- Can I delete my data when I stop using your product?
Source
Checked against Shopify documentation on 2026-09-28. All Shopify permissions →
Thinking about a specific agent?
Tell us what it connects to, what it is allowed to do and who approves its work. You get a plain-language label of what it can touch and what to ask the seller. It takes a couple of minutes, and your answers stay in your browser unless you choose to post a test job.
Or have a person go through the AI apps on up to 3 of your business services with you and get a written report, for $249.
This page explains what a permission allows. It does not describe, test or rate any product. Permission details are summarized in our own words from the provider's documentation, linked on the page; providers change their documentation, so check the source before you rely on a detail.