The agent that placed the order will ask for the refund

Four days ago, Retail Technology Innovation Hub published an interview with Walmart’s Dr. Astha Purohit about where agentic commerce actually stands. One line from it has been quoted all week: “You’re also competing for the agent’s attention, because the agent decides which handful of products the customer ever sees.”

That is the version of this shift everyone is planning for. Discovery, the basket, checkout. Bain puts US agentic commerce at $300 billion to $500 billion by 2030, somewhere between 15 and 25 percent of online retail, with 30 to 45 percent of US consumers already using generative AI to research a purchase before they make one.

Almost none of that planning covers what happens after the money moves.

Orders have a tail

Where is it. Can I change the delivery address. It came broken. I want to send it back. I think I was charged twice.

For most stores the tail is a small fraction of orders, and it lands on a support desk built for people. But if a machine placed the order, a machine handles the tail. Not because anyone designed it that way. Because that is what an assistant does. It made the purchase, it holds the order number, the confirmation is sitting in its context. When the package fails to show up on Thursday, the customer says “sort it out” and goes back to work.

So your support queue changes shape before your storefront does. And it changes in a specific way. A person chasing a late parcel asks once, maybe twice, then gives up or picks up the phone. A script asks at 3am, asks again at 3:04, and quotes back word for word what your agent said an hour ago. No fatigue, no embarrassment, no social reason to accept a no. That is not malice. It is what “keep trying until the issue is resolved” looks like when the instruction was written by someone who has never staffed a support desk.

Instructions are not controls

Researchers have started to measure what happens when a support agent meets a counterparty that does not give up. A benchmark published in December ran 100 scripted attempts at pulling unauthorized concessions out of customer service agents, across ten service domains and five models. Airline support turned out to be the softest target, conceding in roughly 56 percent of attempts, with most other domains between 13 and 28 percent.

A follow-up paper in June tested whether better prompting fixes it. Financial requests were the hardest to hold, with 26.7 to 33.3 percent of disguised attempts getting through at baseline. The strongest prompt defense they tried brought that down to between 3.3 and 13.3 percent, depending on the model. Never to zero.

Sit with the second half of that. The defenses were prompts. Telling a model to refuse improper refunds states a preference. It lowers a rate. It cannot turn a policy into a wall, because your instruction and the customer’s request travel in the same channel, and the request gets to speak last.

Deflection rate and tone are what most support automation gets judged on. Neither one tells you what your agent is capable of giving away.

Put the limit somewhere language cannot reach it

The fix is unglamorous and structural. Let the model propose the action. Let hard code decide whether it happens.

A refund ceiling enforced in the tool layer refuses the fortieth request exactly the way it refused the first. It does not weigh how urgent the wording was. It does not notice that the ask was split across three messages, which happens to be the most effective technique in that December benchmark. It is a number in a code path, and code paths cannot be talked to.

Order matters too. A support agent can answer order status questions long before it should be anywhere near a refund, because the worst case is not comparable. One wastes a customer’s afternoon. The other moves money out of your account on someone else’s say-so. Treating those as one setting called “AI support” is how a business ends up with a bot that is either useless or unbounded.

This is the whole design behind how Celeste works. Celeste learns from your own past tickets, practices privately where nothing it writes reaches a customer, and goes live one topic at a time, on the topics whose answers you have read and decided to trust. Every action the agent can take carries a limit you set, enforced outside the conversation. Celeste proposes. The rules decide. See what that covers.

When a quarter of orders start arriving from software, the businesses that come through it well will not be the ones with the most persuasive bot. They will be the ones whose limits were written down somewhere the conversation cannot reach.