A refund desk for Shopify shops, within limits you set
How a refund desk would work for one Shopify shop, followed through a whole day: the agent handles routine refunds within the owner's limits, and asks the owner about anything bigger.
Writing
Notes from building a governance runtime
Mostly what broke, and what we changed because of it.
2026
A refund desk for Shopify shops, part 2: it ran
The refund desk from part 1, run on a Shopify development store with six test customer emails: two test refunds within the limits, one held for the owner, who answered Return first.
An approved refund can still fail
KIFF records the tool’s response beside its authorization decision and brings pending approvals back into the agent’s session through MCP.
From a refund tool to an agent with a €50 Card
Build a Stripe test-mode MCP tool, connect it to KIFF, and reproduce an allowed refund, an owner approval, and a limit change with Codex.
Outside the card, the work comes home
A KIFF Card now holds an action that falls outside it for its owner, who can approve it once, change the card or reject it; we tested all three on production.
Putting KIFF between an agent and its tools
The KIFF MCP gateway checks every tool call an agent makes against its Card. Since 2 October it is set up from the dashboard, held calls are emailed to the owner, and a hold nobody answers is refused.
We gave a real agent a €50 card and asked it for refunds
A live Agno agent on Bedrock, governed by a KIFF Card through kiff-guard on production: what it was allowed, what it was refused, and what the card recorded.
Our injection defence held 100% of the attacks and 100% of the work
We gated an agent's public writes on whether the run had touched untrusted content. It stopped every attack and every legitimate post too, because it was watching the first link of a three-link chain.
The test passed. The approval did not exist.
Building a control that holds an agent's action for a human, we wrote the same bug four times: something that read as present and was not. Here is each one.