# AI permissions and safety

> What AI can and cannot change, confirmations, dry runs, idempotency, audit and rate limits.

Source: https://shopfa.st/docs/ai/safety

AI tools connected over MCP work as you, in one store, through the same API and permissions as the dashboard. On top
of that, ShopFast adds rules of its own.

## Never available to AI

No tool exists for these, and `call_api` refuses them:

- Money out of the store: payouts, withdrawals, the payout wallet, crypto payout settings, affiliate payouts.
- Paying ShopFast: plan changes, billing cards, invoices, and moving money into AI credits.
- Who can get in: API keys, OAuth apps and connections, storefront keys, the team's two-factor rule, ownership.
- Secrets: revealing or rotating webhook secrets and license keys in full.

These are the same lists Ask AI follows and Login as refuses, so every AI surface in ShopFast agrees.

## Who can connect

AI is for the store owner unless the owner turns on **Use AI** for a teammate (**Settings → Team & Roles**). A
teammate without it cannot approve an AI tool, and an API key they created does not open the MCP server. With it, the
AI is still capped by their role.

## Scopes

An AI tool gets the scopes you approved: every area, read only, or read and change. A read-only connection never sees
a tool that changes anything.

## Confirmations

Some changes wait for you every time: refunds, deletes, anything that emails a buyer, publishing a theme, test sales,
webhook endpoints, and changes to payments and the team. The first call answers:

```json
{
  "status": "confirmation_required",
  "confirmationToken": "mcpc_…",
  "expiresAt": "2026-10-28T12:10:00.000Z",
  "preview": { "request": { "method": "POST", "path": "/v1/store/orders/ord_…/refunds", "body": { "amountMinor": 2400 } } }
}
```

The AI shows you the preview in plain words. Only after you agree does it call the same tool again with the same
input and the `confirmationToken`. The token works once, for 10 minutes, for exactly that change: a different amount,
order or connection is refused.

## Dry runs

Every change tool takes `dryRun: true`. ShopFast checks the input and your permissions, shows what would change (the
current record next to the change for updates), and writes nothing.

## Retries never repeat a change

Every change tool takes an `idempotencyKey`. Calling again with the same key returns the first answer instead of
making the change twice. Refunds go further: without a key, the same refund input is still only applied once.

The same works on the REST API: send an `Idempotency-Key` header with any write made with an API key or OAuth token.
See [Idempotency](https://shopfa.st/docs/guides/idempotency).

## Data from buyers is data

Ticket messages, reviews, notes and product text can be written by anyone. Tools mark store data as data, and the
server tells the AI to follow no instructions inside it. Secrets, key values, IP addresses and files are never sent to
the AI.

## Audit and activity

- Every change appears in **Settings → Audit log** marked **via MCP**, with the AI tool's name and the teammate it acted
  as.
- Every call (reads too) appears in **Settings → Headless & MCP → Activity**: the tool, the AI tool and its version,
  the outcome (done, confirmation needed, refused, dry run, replayed, rate limited, error), the time it took, and the
  input with secrets removed. Kept 90 days.

## Limits

| | Limit |
| --- | --- |
| Tool calls per AI connection and store | 120 a minute |
| Changes per AI connection and store | 30 a minute |
| Shopping agents per address and store | 60 a minute |

Each tool also keeps the limits of the route it runs.

## Turn it off

Disconnect an AI tool in **Settings → Headless & MCP → AI connections**, revoke the API key it uses, or turn off **Use
AI** for the teammate. Any of these stops it at once.