---
title: Human-in-the-Loop AI Agents for eCommerce: Where Automation Should Stop (2026)
description: Human approval is a queue with order id and tool trace, not a prompt. The public worksheet uses a $75 refund ceiling above which a person must click Approve. Never auto-approve when the SLA expires.
url: https://www.joinhorizon.co/blog/human-in-the-loop-ai-agents-ecommerce-2026/
datePublished: 2026-08-27T00:00:00.000Z
dateModified: 2026-10-28T00:00:00.000Z
author: palaniappan-p
category: AI Agents
tags: ai-agents, ecommerce, human-in-the-loop, bedrock-agentcore, agentcore-gateway, amazon-bedrock
---

# Human-in-the-Loop AI Agents for eCommerce: Where Automation Should Stop (2026)

> Human approval is a queue with order id and tool trace, not a prompt. The public worksheet uses a $75 refund ceiling above which a person must click Approve. Never auto-approve when the SLA expires.

A prompt that says "ask a human if unsure" is not a control. The model will not be unsure, and it will call `createReturn` because the shopper asked nicely. Human-in-the-loop for a store is a **queue**: session id, tool trace, proposed action, and an associate who clicks Approve or Reject.

This post is where automation should **stop**. It is the approval architecture for the [autonomy spectrum](https://www.joinhorizon.co/blog/ecommerce-ai-agent-autonomy-spectrum-2026/): Request Approval and everything that must never reach Execute. It does not cover [support week-one reads](https://www.joinhorizon.co/blog/ai-customer-support-agent-ecommerce-2026/) or [agent vs workflow](https://www.joinhorizon.co/blog/ai-agent-vs-workflow-automation-ecommerce-2026/). If you already have an agent, you need a queue.

**The job.** Make every expensive or irreversible write wait on a ticket a person can see, not on model politeness.

**This week.** Name six stop-classes: high-value refund, price/discount, large PO, fraud/dispute, account change, irreversible inventory/catalog. Pick **one** queue (helpdesk is enough).

**A person still signs.** Refunds over your cap, POs before vendor cutoff, fraud language, account/PII changes, and anything the policy does not cover.

**Skip it** when there is no queue owner, when Approve would re-run the model instead of the workflow, or when timeout would auto-approve.

> **Copy the payload:** [`hitl-approval-architecture.md`](https://www.joinhorizon.co/examples/architecture-blog-2026/ecommerce-ai-agents-series/hitl-approval-architecture.md). Series folder: [`ecommerce-ai-agents-series/`](https://www.joinhorizon.co/examples/architecture-blog-2026/ecommerce-ai-agents-series/README.md).

FactualMinds is an AWS Select Tier Services Partner. SLAs below are worksheets, not client engagements.

**Our take:** HITL is **Gateway Policy plus a queue**. Associates still click Approve on expensive refunds and POs. The alternative is a prompt that says "be careful" and a finance ticket on Monday.

## Where the agent must stop

| Action | Why a human | Agent stops at |
| ------ | ----------- | -------------- |
| **High-value refunds** | Money, duplicate RMA, delivered-not-received | Recommend or Request approval |
| **Pricing / discount issuance** | Margin, stacking, unpublished codes | Draft; promo engine is source of truth |
| **Large purchase orders** | Vendor, quantity, cash | Draft + buyer Approve |
| **Fraud, disputes, chargeback language** | Processor + legal | Escalate immediately; **no write tools** |
| **Account changes** | Identity, PII, takeover | Request approval with proof; password/MFA never |
| **Irreversible inventory / live catalog** | ATP, PDP, oversell | Recommend; publish and qty writes HITL |

Support week-one already forbids `createRefund` until Policy is reviewed. This post is the **queue** those writes join when you do attach them.

Fraud-adjacent chat is not a slow HITL. **Stop writes now**, then send it to a risk queue. Do not "look up the order first" on attorney or regulator language: that adds tools to the trace and ends with the same human. That rule is in the [support post](https://www.joinhorizon.co/blog/ai-customer-support-agent-ecommerce-2026/); the architecture here is how the ticket is built.

## Two gates before money moves

```mermaid
flowchart TD
  proposal[Agent proposes named write]
  cedar[Gateway Cedar Policy]
  deny[DENY: stop and alarm]
  under[ALLOW under auto cap]
  over[ALLOW over HITL threshold]
  wf[Workflow executes with idempotency key]
  queue[HITL queue]
  human[Associate / buyer / risk]
  proposal --> cedar
  cedar --> deny
  cedar --> under
  cedar --> over
  under --> wf
  over --> queue
  queue --> human
  human -->|approve| wf
  human -->|reject| memory[Memory note + safe customer text]
```

**Gate 1: Cedar on Gateway.** Role, order status, amount cap. `LOG_ONLY` then `ENFORCE`. Prompt is not authorization. Identity JWT (shopper vs associate vs admin) must flow into Policy even if specialists share an entrypoint.

**Gate 2: HITL queue.** Helpdesk, Slack, or a Next.js + TypeScript + Tailwind ops dashboard. Required fields:

1. `runtimeSessionId` (Harness data plane: ≥33 characters)
2. Tool trace (which operations, which ids)
3. Proposed action + Cedar decision + HITL reason
4. Idempotency key the **workflow** will use

DENY does not create a ticket for every model hallucination. Alarm on DENY spikes. Queue only ALLOW-over-threshold and explicit escalate intents (fraud, PII, legal).

## What goes on the approval ticket

Context: illustrative JSON, not an OMS schema. Python 3.12+ if a Lambda posts this to helpdesk.

```json
{
  "approvalId": "hitl-2026-08-27-001",
  "runtimeSessionId": "11111111-1111-1111-1111-111111111111",
  "proposedAction": "createReturn",
  "orderId": "ORD-1001",
  "refundUsd": 140,
  "identity": { "role": "associate" },
  "cedarDecision": "ALLOW",
  "hitlReason": "refundUsd > storeCap75",
  "toolTrace": ["getOrder", "getShipment", "getReturnPolicy"],
  "idempotencyKey": "createReturn:ORD-1001:ret-88"
}
```

**Approve** calls OMS `createReturn` (or your return API) **once**. It does not `InvokeHarness` again with write tools attached. **Reject** stores a Memory note and a customer-safe sentence ("a specialist will follow up"), not an invented policy.

The **~$75** cap in public Cedar sketches is a demo ceiling. Your finance number goes in Policy, not in the model card.

## Queue design (fail closed)

| Queue | Owner | Worksheet SLA | On timeout |
| ----- | ----- | ------------- | ---------- |
| Support HITL | CS lead | Same shift for refunds | Stay queued / expire; **no auto-approve** |
| Merch HITL | Merchandiser | Before next publish | Draft stays draft |
| Buyer HITL | Purchasing | Before vendor cutoff | PO stays draft |
| Fraud HITL | Risk | Before goodwill | Writes stay DENY |

Auto-approve on SLA breach is Fully Automated with extra latency. Do not ship it. If leadership wants faster refunds, **lower the Cedar cap** and staff the queue. Do not delete the queue.

## What broke

> **What broke:** An RFC that treated HITL as instructions: "If the refund is large, ask a human." No queue, no payload, no owner. The model called `createReturn` at **$140** on a delivered fixture because the shopper typed "you already said yes in chat." **Detection:** Gateway trace with a write and zero helpdesk tickets that hour; Policy was `LOG_ONLY` and nobody watched ALLOW. **Fix:** strip the write; enqueue Request Approval with session id + trace; Approve hits the workflow; timeout fail-closed. **Lesson:** unsure-prompts do not create tickets.

The delivered-not-received auto-refund failure in the [support post](https://www.joinhorizon.co/blog/ai-customer-support-agent-ecommerce-2026/) is the same family: CSAT as authorization. HITL is the operational fix, not a nicer prompt.

## If you only do one thing

Write the ticket fields your helpdesk needs: session id, tool trace, proposed action, idempotency key. If Approve would call the model again, fix that before you attach a write tool.

## For your technical lead

**On June 17, 2026**, AgentCore **Harness** reached general availability ([What's New](https://aws.amazon.com/about-aws/whats-new/2026/06/amazon-bedrock-agentcore-harness-generally-available/)). A managed loop makes it easier to **call** `createReturn`. It does not make it acceptable to skip a human on the cases that wreck margin, identity, or trust.

> **AWS lifecycle notice (June 30, 2026):** Amazon Bedrock Agents Classic is in maintenance for new customers after **July 30, 2026**. Net-new agents should use [Bedrock AgentCore](https://www.joinhorizon.co/blog/amazon-bedrock-agentcore-production/). Full matrix: [lifecycle roundup](https://www.joinhorizon.co/blog/aws-service-lifecycle-updates-june-2026/).

> **First-party signals we reuse (not eCommerce outcomes):** Gateway server-side tools cut median tool round-trip **~180 ms → ~95 ms** on a **B2B CRM assistant** (12 tools, ~8k turns/day). See the [Gateway post](https://www.joinhorizon.co/blog/amazon-bedrock-agentcore-gateway-server-side-tool-execution-2026/). Platform TCO silhouette: support-style AgentCore at **50K sessions/mo ~$791/mo** platform + model ([decision guide](https://www.joinhorizon.co/blog/aws-bedrock-agentcore-vs-amazon-q-enterprise-decision-guide-2026/)). Model your mix on the [AgentCore pricing calculator](https://www.joinhorizon.co/tools/amazon-bedrock-agentcore-pricing-calculator/). Treat **~$791/mo** as a platform cost floor, not savings.

Harness hosts the loop (`CreateHarness` / `InvokeHarness`) on Runtime microVMs. Tools via Gateway or MCP. Memory is the shopper/associate notebook, not the approval ledger. Observability and CloudTrail on `bedrock-agentcore.amazonaws.com` are how you replay a bad Approve. Bedrock Converse + Guardrails complement Cedar; they do not replace it. Strands 1.0 after export still has **no** Policy or Identity, so keep Gateway.

Browser and Code Interpreter **off** by default. A Browser session is not an approval UX.

Gateway **~180 → ~95 ms** is tool RTT after server-side execution. Associates waiting on HITL are waiting on humans. Do not quote the CRM canary as an approval SLA.

## What to do this week

1. Name the six stop-classes: high-value refund, price/discount, large PO, fraud/dispute, account change, irreversible inventory/catalog.
2. Copy [`hitl-approval-architecture.md`](https://www.joinhorizon.co/examples/architecture-blog-2026/ecommerce-ai-agents-series/hitl-approval-architecture.md) into the RFC.
3. Pick **one** queue (helpdesk is enough). Attach session id + tool trace.
4. Prove Cedar `LOG_ONLY` on the first write; flip `ENFORCE` only after a canary.
5. Implement Approve → workflow, not Approve → second harness turn.
6. Write three goldens: over-cap enqueue, DENY no ticket spam, fraud stop-writes.
7. Price sessions on the [AgentCore pricing calculator](https://www.joinhorizon.co/tools/amazon-bedrock-agentcore-pricing-calculator/). Run [`monday-checklist.md`](https://www.joinhorizon.co/examples/architecture-blog-2026/ecommerce-ai-agents-series/monday-checklist.md).
8. If the first HITL is refunds, [contact us](https://www.joinhorizon.co/contact-us/) before chat goes public.

## Where this sits in the control loop

This page is the approval gate and the fail-closed timeout. Task intake, tool policy, and the budget live in the [AWS architecture for store agents](https://www.joinhorizon.co/blog/aws-ai-agents-for-ecommerce-factualminds-2026/). Identity and least privilege are in [securing store agents](https://www.joinhorizon.co/blog/secure-ai-agents-ecommerce-store-2026/).

Lookups can proceed. Refunds, purchase orders, price overrides, credit releases, and deletes wait. Approve calls the workflow once, with an idempotency key. It does not start another unconstrained model turn. A sentence in the prompt is not the approval.

## What this post doesn't cover

- Per-action Observe→Execute matrix: [autonomy spectrum](https://www.joinhorizon.co/blog/ecommerce-ai-agent-autonomy-spectrum-2026/)
- Secrets, PII minimization, payment out of tools: [secure store agents](https://www.joinhorizon.co/blog/secure-ai-agents-ecommerce-store-2026/)
- Week-one support allow-list: [support agent](https://www.joinhorizon.co/blog/ai-customer-support-agent-ecommerce-2026/)
- Helpdesk vendor bake-off (Gorgias vs Zendesk vs Salesforce)
- Guaranteed handle-time or CSAT from HITL (we did not measure a client here)
- PCI mapping of the approval UI (a dashboard is not a BAA)

## FAQ

### When should you NOT skip human-in-the-loop for an eCommerce agent write?

Do not skip HITL for high-value refunds, live price changes, large purchase orders, fraud or dispute language, account or PII changes, or any irreversible catalog/inventory mutation. Cedar ALLOW under a small cap is not a reason to delete the over-cap queue. Timeout must fail closed. Never auto-approve.

### What could go wrong if HITL is only a system prompt that says ask a human if unsure?

The model will not be unsure. It will call createReturn because the shopper asked nicely. There is no ticket, no session id, no tool trace, and no associate who can see why the bot stopped, or did not stop. HITL is a queue. Prompt humility is not a control.

### When should you NOT build a Next.js approval dashboard first?

Skip a custom dashboard when helpdesk or Slack already is the queue and you can attach session id plus tool trace to the ticket. Next.js + TypeScript + Tailwind is a typical FactualMinds ops surface. It is not the AgentCore runtime and it is not required for every merchant.

### What could go wrong if approve re-invokes the harness with write tools still attached?

The second turn can call a different tool, a different amount, or a second order. Approve must execute the workflow (OMS, ERP, promo engine) with the idempotency key on the ticket. The model does not get another unbounded loop to "finish up."

### Is Gateway Cedar a substitute for HITL?

No. Cedar is the first gate (role, status, cap). HITL is the second gate for over-cap and irreversible actions. Policy DENY should not spam the queue. ALLOW-under-cap may execute. ALLOW-over-threshold must enqueue. Prompt text is not authorization. LOG_ONLY then ENFORCE.

### What could go wrong if delivered-not-received auto-refunds while HITL is "coming later"?

You train friendly fraud and skip the investigation warehouse and carrier need. That failure is already the week-one support rule: read-only plus escalate. HITL is where reship or refund is decided after evidence, not a backlog item behind CSAT.

---

Need a HITL payload and Cedar on refunds before the bot can write? [Contact FactualMinds](https://www.joinhorizon.co/contact-us/) or see [AWS for retail / eCommerce](https://www.joinhorizon.co/industries/aws-retail-ecommerce/).

## How the human approval queue stays bounded

Stop the agent where money, identity, or an irreversible write is involved, and queue a ticket.

- **Maturity:** Level 2 — reference architecture
- **Risk:** critical
- **Oversight:** human-control
- **Starts when:** A tool call would refund, cancel, change an account, or release a hold.
- **Tools:** A write goes through a router, a permission check, a policy check, and a budget check. The model does not commit it. An approval token lives in tool context, not in the user message.
- **Stops for a person:** Approve runs the workflow. It does not start another unconstrained model turn. Timeout fails closed.
- **Checked by:** The ticket has session id, tool trace, proposed action, and an idempotency key.
- **Untrusted data:** Chat text that says a human already approved.
- **If it fails:** If the human approval queue stops, name the reason: completed, budget_exceeded, timed_out, cancelled, guardrail_blocked, approval_required, tool_failure, verification_failed, or partial_completion. Retry a timeout at most twice. Back off on rate limits. After repeated verification failure, escalate. Stop when the budget is exhausted or a permission is denied. No unbounded loop. Approve runs the workflow. It does not start another unconstrained model turn. Timeout fails closed.
- **Lifecycle:** Explore, then act, then confirm, then verify. Explore gathers the context for the human approval queue. Act stays reversible. Confirm stops before an irreversible step. Verify is a separate check of the outcome.

Reference architecture, not a published production deployment. The shared contract is the [AWS store-agent architecture](https://www.joinhorizon.co/blog/aws-ai-agents-for-ecommerce-factualminds-2026/#operating-contract).

## FAQ

### When should you NOT skip human-in-the-loop for an eCommerce agent write?
Do not skip HITL for high-value refunds, live price changes, large purchase orders, fraud or dispute language, account or PII changes, or any irreversible catalog/inventory mutation. Cedar ALLOW under a small cap is not a reason to delete the over-cap queue. Timeout must fail closed. Never auto-approve.

### What could go wrong if HITL is only a system prompt that says ask a human if unsure?
The model will not be unsure. It will call createReturn because the shopper asked nicely. There is no ticket, no session id, no tool trace, and no associate who can see why the bot stopped, or did not stop. HITL is a queue. Prompt humility is not a control.

### When should you NOT build a Next.js approval dashboard first?
Skip a custom dashboard when helpdesk or Slack already is the queue and you can attach session id plus tool trace to the ticket. Next.js + TypeScript + Tailwind is a typical FactualMinds ops surface. It is not the AgentCore runtime and it is not required for every merchant.

### What could go wrong if approve re-invokes the harness with write tools still attached?
The second turn can call a different tool, a different amount, or a second order. Approve must execute the workflow (OMS, ERP, promo engine) with the idempotency key on the ticket. The model does not get another unbounded loop to "finish up."

### Is Gateway Cedar a substitute for HITL?
No. Cedar is the first gate (role, status, cap). HITL is the second gate for over-cap and irreversible actions. Policy DENY should not spam the queue. ALLOW-under-cap may execute. ALLOW-over-threshold must enqueue. Prompt text is not authorization. LOG_ONLY then ENFORCE.

### What could go wrong if delivered-not-received auto-refunds while HITL is "coming later"?
You train friendly fraud and skip the investigation warehouse and carrier need. That failure is already the week-one support rule: read-only plus escalate. HITL is where reship or refund is decided after evidence, not a backlog item behind CSAT.

---

*Source: https://www.joinhorizon.co/blog/human-in-the-loop-ai-agents-ecommerce-2026/*