> For the complete documentation index, see [llms.txt](https://docs.icme.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.icme.io/documentation/use-cases/e-commerce.md).

# E-COMMERCE

An AI shopping agent browses listings, compares options, fills a cart, and completes checkout with saved payment credentials. The person who delegated the task sees a result, not a checkout page.

That delegation is the point, and it is also the exposure. Everything the agent reads on the way to the order button comes from a party with an incentive to influence what it does next.

***

### Why it matters

**The storefront is untrusted input.** Product titles, descriptions, specifications, reviews, and seller messages all arrive as text the agent reads to do its job. Hidden instructions in a listing enter the same context as the shopping task itself, and the model has no reliable way to treat one as data and the other as direction.

**Nobody is looking at the final page.** A person buying manually glances at the domain, the total, the quantity, and the ship-to address before confirming. An agent working unattended skips all of that. The first human signal is a confirmation email, or a charge.

**The manipulations are small.** A quantity changed from one to eleven. A shipping address swapped after cart review. A checkout domain off by one character. A price override injected into a listing field. Each of these produces an action that looks exactly like a normal purchase, which is why review after the fact tends to arrive too late to matter.

***

### How PreFlight closes the gap

Write the rules the way you would tell a person: a spend ceiling per order, an approved merchant list, no shipping address outside the ones on file, no checkout on a domain that was not the one being browsed. PreFlight compiles those rules into formal logic and checks the proposed action with a solver before the agent commits to it.

`SAT` proceeds, `UNSAT` is blocked, and the block happens before payment credentials are submitted rather than in a fraud report afterward. Because the decision comes from a solver rather than model judgment, an instruction hidden in a product listing cannot argue its way past the rule. It is not talking to the thing making the decision.

Every check produces a zero-knowledge proof receipt, so a merchant or payment provider can confirm that a buyer agent was operating inside its limits without being handed the policy behind them.

The pages below walk through the two attack patterns hitting shopping agents most directly, with the policies that stop them.