--- title: Build eCommerce Store AI Agents on Amazon Bedrock AgentCore (2026) description: Hand this to your technical lead. The store decision: one lookup this week, a person signs money, skip when a rule already works. Sample uses 9 Gateway tools and is not a client case study. url: https://www.joinhorizon.co/blog/ecommerce-ai-agents-amazon-bedrock-agentcore-2026/ datePublished: 2026-08-04T00:00:00.000Z dateModified: 2026-10-28T00:00:00.000Z author: palaniappan-p category: AI Agents tags: bedrock-agentcore, ai-agents, multi-agent, ecommerce, amazon-bedrock, agentcore-gateway --- # Build eCommerce Store AI Agents on Amazon Bedrock AgentCore (2026) > Hand this to your technical lead. The store decision: one lookup this week, a person signs money, skip when a rule already works. Sample uses 9 Gateway tools and is not a client case study. This note is for the person who will build it. The store decision it protects: ship **one lookup** this week (usually where-is-my-order or a support answer from the order record), keep **a person on money** (refunds, cancels, stock changes, discounts), and **skip the agent** when a rule already closes the case. We have no published agent case study that invents ticket or conversion results. Everything below is a sample supervisor-plus-specialists architecture with cloneable stubs. It is for your technical lead, not for Monday Slack. Pass it to them after you agree the week-one boundary. > **AWS lifecycle notice (June 30, 2026):** Amazon Bedrock Agents Classic is in maintenance for new customers after **July 30, 2026**. Net-new agent builds should use [Bedrock AgentCore](https://www.joinhorizon.co/blog/amazon-bedrock-agentcore-production/). Full matrix: [lifecycle roundup](https://www.joinhorizon.co/blog/aws-service-lifecycle-updates-june-2026/). **On June 17, 2026**, AgentCore **Harness** reached general availability on the same platform as Runtime, Memory, Gateway, Identity, and Policy ([What's New](https://aws.amazon.com/about-aws/whats-new/2026/06/amazon-bedrock-agentcore-harness-generally-available/)). For an eCommerce storefront, that stack is the paved road: a **supervisor** that routes to **sales**, **order ops**, **support triage**, and **inventory** specialists, with Gateway as the write-path choke point. This post is an **end-to-end sample architecture** with cloneable stubs. It is **not** an anonymized client engagement. Commerce order volumes, refund rates, and fixture IDs (`ORD-1001`, `SKU-TEE-BLU-M`) are demo data. > **First-party signals we reuse (not eCommerce outcomes):** Gateway server-side tools cut median tool round-trip **~180 ms → ~95 ms** on a **B2B CRM assistant** (12 tools, ~8k turns/day), per the [Gateway post](https://www.joinhorizon.co/blog/amazon-bedrock-agentcore-gateway-server-side-tool-execution-2026/). Platform TCO silhouette: support-style AgentCore at **50K sessions/mo ~$791/mo** platform + model ([decision guide](https://www.joinhorizon.co/blog/aws-bedrock-agentcore-vs-amazon-q-enterprise-decision-guide-2026/)). Model your own mix on the [AgentCore pricing calculator](https://www.joinhorizon.co/tools/amazon-bedrock-agentcore-pricing-calculator/). > **Reproduce this:** Clone the artifacts under [`examples/architecture-blog-2026/ecommerce-agentcore-store-agents/`](https://www.joinhorizon.co/examples/architecture-blog-2026/ecommerce-agentcore-store-agents/README.md). `python3 -m py_compile supervisor_agent.py specialists/*.py` syntax-checks the stubs. Deploy steps and Policy gates are in [`monday-checklist.md`](https://www.joinhorizon.co/examples/architecture-blog-2026/ecommerce-agentcore-store-agents/monday-checklist.md). ## Why multi-agent for commerce (and when not to) A single agent with catalog search, cancel, refund, and warehouse adjust tools will mis-route under load. The [multi-agent supervisor pattern](https://www.joinhorizon.co/blog/aws-bedrock-multi-agent-supervisor-pattern/) still applies, but on **AgentCore Runtime** rather than Classic `InvokeAgent` + action groups. **Opinionated take:** use **Runtime + Strands** for supervisor and specialists when routing, hop caps, and role-aware tools are product logic. Collapse to one **Harness** agent only if you have ≤5 tools, one team, and no associate-only writes. Trade-off: multi-agent adds invoke latency and ops surface; you buy clearer prompts, IAM, and Policy scopes. ## Reference architecture ```text Shopper/Associate → IdP JWT → AgentCore Identity → Supervisor Runtime (Strands) ├─ Sales Runtime (catalog / cart) ├─ Orders Runtime (status / cancel) ├─ Support Runtime (returns / escalate) └─ Inventory Runtime (stock / merch) → AgentCore Memory (user-scoped) → AgentCore Gateway (9 OpenAPI tools) → Policy (Cedar) → OMS / catalog / WMS APIs → Observability (OTEL → CloudWatch) ``` [Open the draw.io diagram](https://www.joinhorizon.co/examples/architecture-blog-2026/ecommerce-agentcore-store-agents/architecture.drawio). | Component | Role in this sample | | ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Runtime** | Host supervisor + 4 specialists (microVM session isolation) | | **Identity** | Shopper vs associate/admin JWT claims into Gateway | | **Memory** | Short-term turn context; long-term preferences / order episodes per shopper id; FGAC + flexible namespaces as of August 28, 2026 | | **Gateway** | 9 OpenAPI tools from [`commerce-openapi.yaml`](https://www.joinhorizon.co/examples/architecture-blog-2026/ecommerce-agentcore-store-agents/gateway/commerce-openapi.yaml) | | **Policy** | Cedar gates on `cancelOrder`, `createReturn`, `updateInventory` | | **Observability** | Routing distribution, tool errors, Policy ALLOW/DENY spans | ## Specialist contracts ### Sales / shopping assistant Read-heavy: product search, SKU detail, cart. No shopper payment capture in this sample. AgentCore Payments reached GA on August 18, 2026 for gated agent-to-API spend with a session budget. It is still not a replacement for checkout. See [What this post doesn't cover](#what-this-post-doesnt-cover). Local fixtures live in [`specialists/sales_agent.py`](https://www.joinhorizon.co/examples/architecture-blog-2026/ecommerce-agentcore-store-agents/specialists/sales_agent.py). Production should call Gateway `searchProducts` / `getProduct` / `getCart` instead of in-process dicts. ### Order automation Status, shipment tracking, cancel/modify inside the cancel window. Delivered orders should **DENY** cancel and route to support for returns. ### Support triage Returns, refunds under a cap (**$75** in the demo Cedar), policy FAQs, human escalation for chargebacks / legal / over-cap amounts. ### Inventory / merchandising Stock reads for associates (and optionally via sales for availability). **Writes** require `associate` or `admin` claims. Shopper JWTs must fail at Policy even if the model asks. ## Supervisor routing Intent → agent matrix: [`routing-decision-matrix.md`](https://www.joinhorizon.co/examples/architecture-blog-2026/ecommerce-agentcore-store-agents/routing-decision-matrix.md). Rules we bake into the supervisor: 1. Classify once; invoke **one** specialist per turn (unless the specialist returns an explicit follow-up). 2. Cap hops at **2**; then clarify or `escalate_to_human`. 3. Never call cancel/refund/inventory write tools from the supervisor; specialists + Gateway own writes. Context: Python 3.12+, `strands-agents` ≥ 1.x, `bedrock-agentcore` Runtime entrypoint, model pin `global.anthropic.claude-sonnet-5-5` (Claude Sonnet 5.5, Global cross-Region profile). Full file: [`supervisor_agent.py`](https://www.joinhorizon.co/examples/architecture-blog-2026/ecommerce-agentcore-store-agents/supervisor_agent.py). ```python # Excerpt — dry-run route tools; replace invoke_specialist with InvokeAgentRuntime. @tool def route_to_orders(user_message: str) -> str: """Route order status, cancel, modify, and shipment tracking to the orders agent.""" return invoke_specialist("orders", user_message, {"hop": 1}) @tool def escalate_to_human(reason: str, user_message: str) -> str: """Hand off when risk is high or specialists are ambiguous.""" return json.dumps({"status": "escalated", "reason": reason, "queue": "commerce-tier2"}) ``` ## Gateway tool catalog (9 tools) Attach [`gateway/commerce-openapi.yaml`](https://www.joinhorizon.co/examples/architecture-blog-2026/ecommerce-agentcore-store-agents/gateway/commerce-openapi.yaml) as an OpenAPI target: | operationId | Risk | | ----------------------------------------- | ---------- | | `searchProducts`, `getProduct`, `getCart` | Low (read) | | `getOrder`, `getShipment`, `getInventory` | Low (read) | | `cancelOrder`, `createReturn` | High | | `updateInventory` | Critical | When the catalog grows past ~10 tools, use Gateway semantic search so the model sees a shortlist. This is the same failure mode called out in the [Gateway server-side tools post](https://www.joinhorizon.co/blog/amazon-bedrock-agentcore-gateway-server-side-tool-execution-2026/). ## Cedar Policy on the write path Sample policies: [`policy/refund-and-cancel.cedar`](https://www.joinhorizon.co/examples/architecture-blog-2026/ecommerce-agentcore-store-agents/policy/refund-and-cancel.cedar). NL equivalents: - Shoppers/associates may `cancelOrder` only while status is `processing` or `pending`. - `createReturn` auto path only when `refundUsd <= 75`. - `updateInventory` only when JWT `role` is `associate` or `admin`. **Run Policy in `LOG_ONLY` for a canary window, then `ENFORCE`.** Prompt text is not a substitute. ```cedar // Excerpt — auto-refund ceiling (demo). Align entity shapes to your Gateway schema. permit ( principal, action == Action::"createReturn", resource ) when { principal has role && ["shopper", "associate", "admin"].contains(principal.role) && resource has refundUsd && resource.refundUsd <= 75 }; ``` ## What broke (counter-case) > **What broke:** Early supervisor drafts that “helpfully” called all four specialists on ambiguous prompts (`help with my purchase`). Result: duplicate tool calls, conflicting status text, and cancel attempted on a delivered fixture after support also opened a return. **Detection:** Gateway traces showed two write tools in one turn; Policy `LOG_ONLY` logged a would-be DENY on cancel. **Fix:** hop cap = 2, clarify-first on ambiguous intents, forbid cancel on delivered at Cedar, escalate chargeback language. **Lesson:** multi-agent without hop and Policy discipline is worse than a single agent. ## Observability Enable AgentCore Observability (OTEL into CloudWatch) on supervisor and Gateway. Track: - Routing distribution (sales / orders / support / inventory / escalate) - Specialist and Gateway p95 latency (platform signal from CRM canary: **~95 ms** median tool RTT after server-side Gateway; your OMS will dominate absolute numbers) - Policy ALLOW vs DENY counts (`aws.agentcore.policy.authorization_decision` spans) - Escalation rate to `commerce-tier2` Traces show **what happened**. Pair with [AgentCore Evaluations](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/evaluations.html) before you scale session volume. Batch, online, and A/B testing are generally available as of June 2026; confirm your Region before launch. ## Shopify on this architecture There is still **no** native Shopify AgentCore connector as of **25 September 2026**. The storefront sits behind an app you own. The shopper path on current UCP Catalog, Cart, and Checkout MCP is [Amazon Bedrock Shopify integration](https://www.joinhorizon.co/blog/amazon-bedrock-shopify-integration/). This page stays the multi-agent store sample. - Admin GraphQL, current stable version pinned in the app, with `X-Shopify-Access-Token` on that app's token, not a staff password. - Week-one scopes are reads (`read_orders`, `read_products`, `read_inventory` or the narrower set the field actually requires). `write_orders` stays off. - Webhooks (`ORDERS_CREATE` and the topics you name) notify your adapter. The agent does not poll Admin in a loop. Each topic needs the matching scope. HTTPS, EventBridge, or Pub/Sub are the documented destinations. - Gateway exposes `getOrder` and `getShipment`, not "run this GraphQL string." - The longer platform note is [Shopify AI agents](https://www.joinhorizon.co/blog/shopify-ai-agents-ecommerce-2026/). Adobe Commerce and BigCommerce use the same Gateway shape with different tokens: [Magento](https://www.joinhorizon.co/blog/magento-ai-agents-ecommerce-2026/), [BigCommerce](https://www.joinhorizon.co/blog/bigcommerce-ai-agents-ecommerce-2026/). The shopper path on BigCommerce Storefront MCP is [Amazon Bedrock BigCommerce integration](https://www.joinhorizon.co/blog/amazon-bedrock-bigcommerce-integration/). Order and stock reads on Odoo are [Amazon Bedrock Odoo integration](https://www.joinhorizon.co/blog/amazon-bedrock-odoo-integration/). Product and order reads on WooCommerce are [Amazon Bedrock WooCommerce integration](https://www.joinhorizon.co/blog/amazon-bedrock-woocommerce-integration/). ## Where this sits in the control loop The sample is a supervisor and four specialists. It is not a production store, and it is not a client engagement. Writes in the local stubs do not commit unless an approval token is passed in tool context, and even then the stub does not call a live order system. A shopper message is untrusted data. It is not appended to the system prompt and it is not parsed for approval. Gateway and Cedar remain the deploy-time policy. The Python `harness.py` next to the sample is the local stand-in so a prompt cannot act as a permission. The wider loop is the [AWS store-agent architecture](https://www.joinhorizon.co/blog/aws-ai-agents-for-ecommerce-factualminds-2026/). ## What this post doesn't cover - AgentCore **Payments** as shopper checkout or card capture. Payments GA (August 18, 2026) is for agent-to-API / MCP / content microtransactions with a PaymentSession budget; it is not for PAN in Memory or unbounded purchase. Architecture: [production guide](https://www.joinhorizon.co/blog/amazon-bedrock-agentcore-production/). - AgentCore **Browser** for third-party seller portals - Full request collections for every ERP. The boundary is in [the integration post](https://www.joinhorizon.co/blog/ai-agent-ecommerce-integration-2026/). Platform specifics are the Shopify, Magento, and BigCommerce posts linked above. - AgentCore **Optimization** A/B on prompts - Classic Agents migration playbooks (see [production guide](https://www.joinhorizon.co/blog/amazon-bedrock-agentcore-production/)) - Measured eCommerce engagement KPIs: this sample does not invent them ## What to do this week 1. Clone [`ecommerce-agentcore-store-agents`](https://www.joinhorizon.co/examples/architecture-blog-2026/ecommerce-agentcore-store-agents/README.md) and run `python3 -m py_compile` on the stubs. 2. Stand up Identity JWT with `role` claims (`shopper` | `associate` | `admin`). 3. Upload `commerce-openapi.yaml` to Gateway; attach Cedar from `refund-and-cancel.cedar` in **`LOG_ONLY`**. 4. Deploy supervisor + four specialist Runtimes; wire ARNs into supervisor env. 5. Prove DENY paths: cancel on `ORD-1001` (delivered), refund `$100`, inventory write with shopper JWT. 6. Build a CloudWatch dashboard for routing + Policy DENY; alarm on DENY spikes. 7. Flip Policy to **`ENFORCE`** only after the canary week. 8. Model platform + token cost on the [AgentCore pricing calculator](https://www.joinhorizon.co/tools/amazon-bedrock-agentcore-pricing-calculator/). Full gate list: [`monday-checklist.md`](https://www.joinhorizon.co/examples/architecture-blog-2026/ecommerce-agentcore-store-agents/monday-checklist.md). ## If you only do one thing Put **Gateway Policy** in front of `cancelOrder`, `createReturn`, and `updateInventory` before you polish the shopping prompt. A clever sales agent without write gates is an automated refund machine. ## Related reading This post is the store-agent reference build. The workflow-by-workflow treatment lives in the [eCommerce AI Agents series](https://www.joinhorizon.co/resources/ecommerce-ai-agents/), which has 64 parts covering [support and WISMO](https://www.joinhorizon.co/blog/ai-customer-support-agent-ecommerce-2026/), [inventory reorder](https://www.joinhorizon.co/blog/ai-inventory-agent-reorder-ecommerce-2026/), [autonomy per action](https://www.joinhorizon.co/blog/ecommerce-ai-agent-autonomy-spectrum-2026/), and [when one agent stops being enough](https://www.joinhorizon.co/blog/multi-agent-ecommerce-architecture-2026/). For which store workflows to automate first, start at [AI agents](https://www.joinhorizon.co/ai-agents/); for the Bedrock build itself, see [Amazon Bedrock consulting](https://www.joinhorizon.co/services/aws-bedrock/). ## How the AgentCore store-agent sample stays bounded Show a supervisor and four specialists whose writes do not commit from the model call. - **Maturity:** Level 2 — reference architecture - **Risk:** high - **Oversight:** approval - **Starts when:** A builder clones the store-agent sample. - **Tools:** A write goes through a router, a permission check, a policy check, and a budget check. The model does not commit it. An approval token lives in tool context, not in the user message. - **Stops for a person:** createReturn, cancel, and inventory update require an approval token in tool context. The sample still does not commit to a live store. - **Checked by:** A shopper path cannot write inventory. Hop cap is enforced. The sample is not a client engagement. - **Untrusted data:** User text passed through as if it were a system instruction or an approval. - **If it fails:** If the AgentCore store-agent sample stops, name the reason: completed, budget_exceeded, timed_out, cancelled, guardrail_blocked, approval_required, tool_failure, verification_failed, or partial_completion. Retry a timeout at most twice. Back off on rate limits. After repeated verification failure, escalate. Stop when the budget is exhausted or a permission is denied. No unbounded loop. createReturn, cancel, and inventory update require an approval token in tool context. The sample still does not commit to a live store. - **Lifecycle:** Explore, then act, then confirm, then verify. Explore gathers the context for the AgentCore store-agent sample. Act stays reversible. Confirm stops before an irreversible step. Verify is a separate check of the outcome. Reference architecture, not a published production deployment. The shared contract is the [AWS store-agent architecture](https://www.joinhorizon.co/blog/aws-ai-agents-for-ecommerce-factualminds-2026/#operating-contract). ## FAQ ### When should we NOT use a multi-agent supervisor for eCommerce? Skip the supervisor when you have ≤5 tools owned by one team, no Policy-gated writes, and a single conversation shape (for example order-status only). A single AgentCore Harness or Runtime with Gateway tools is cheaper to operate. Multi-agent pays off when sales, orders, support, and inventory prompts and IAM diverge. ### What could go wrong if we skip AgentCore Policy on refunds and cancels? The model can call cancelOrder or createReturn with bad amounts or on delivered orders. Prompt instructions are not an authorization boundary. Put Cedar (or NL→Cedar) on Gateway in LOG_ONLY first, then ENFORCE, and alarm on DENY spikes. ### Should specialists use AgentCore Harness or Runtime? For this pattern we recommend Runtime with Strands (or LangGraph) for the supervisor and specialists because routing, hop caps, and A2A/MCP are custom code. Use Harness for a thin single-domain agent if you later collapse the supervisor. Do not pick Runtime "for flexibility" if one Harness covers the whole workflow. ### How does Memory differ from a product Knowledge Base for commerce? Knowledge Bases hold catalog docs, size charts, and return policies (documents). AgentCore Memory holds session cart/order context and long-term shopper preferences. Namespace Memory by shopper id (and tenant, using flexible namespace variables as of August 28, 2026). Front Memory with Gateway Cedar FGAC so a shopper JWT cannot retrieve another actor. Do not dump the full catalog into Memory. ### Can shoppers and associates share the same Runtime? They can share the supervisor entrypoint, but Identity JWT claims (role=shopper vs associate) must flow into Gateway Policy. updateInventory and other merchandising writes should DENY for shopper tokens even if the inventory specialist is invoked by mistake. ### Is this the same as the Classic multi-agent supervisor pattern? No. The older Bedrock Agents Classic supervisor + Lambda sub-agents path is a different control plane. Agents Classic enters maintenance for new customers after July 30, 2026. Net-new commerce agents should use AgentCore Runtime/Harness + Gateway. See the AgentCore production guide and the Classic-oriented supervisor post for contrast only. ### Where do platform costs show up vs model tokens? Runtime bills vCPU-hour and GB-hour for session time; Gateway bills tool invokes/search; Memory bills events and retrievals; model tokens are a separate Bedrock line and usually dominate. Model spend on the AgentCore pricing calculator before you scale chat volume. ### What if the supervisor keeps re-routing the same turn? Cap specialist hops at 2 per turn, require clarifying questions on ambiguous intents, and escalate chargeback/legal language to humans. Ambiguous "help with my purchase" should not fan out to all four specialists. --- *Source: https://www.joinhorizon.co/blog/ecommerce-ai-agents-amazon-bedrock-agentcore-2026/*