Agentic AI in retail: when AI agents start taking action

Retail has evolved from store-centred operations to omnichannel experiences and then to shared platforms exposing business services, applications and data. Agentic transformation extends that progression: business capabilities become accessible to agents able to coordinate multiple operations in pursuit of an objective.

The change goes beyond employee automation. Customers may increasingly delegate product discovery, comparison and purchase preparation to their own personal agents. Instead of starting on a retailer's website, they could interact with an intermediary that compares suppliers and only contacts the retailer when a service needs to be executed.

The strategy identifies a specific commercial risk: becoming a provider of products, inventory and logistics while an external agent controls recommendations and the customer relationship. Its proposed response has two dimensions: build agentic experiences customers choose directly, and expose business capabilities that external agents can consume.

The organisation does not aim to build every component itself. It seeks to retain control over the assets that differentiate its business: customer knowledge, business rules, contracts governing service access, and information used to learn from interactions and outcomes. Control over these assets becomes as important as control over the customer-facing interface.

The strategy distinguishes a chatbot that answers a request from an agentic system that pursues a goal through a sequence of actions. Its execution framework describes seven stages: define intent, select authorised context, act, retrieve the outcome, verify it, correct the execution when necessary, and preserve useful information in memory.

Every execution loop needs a business owner, explicit permissions and an escalation mechanism. It also needs a reference against which results can be checked, an understanding of its full operating cost, and a record of decisions. The model may participate in execution, but accountability, judgement and sensitive approvals remain human responsibilities.

The strategy identifies a fundamental organisational challenge: companies can build agents faster than they can formalise their own processes. Tacit business rules, local exceptions and informal decisions become problematic when a system is expected to act rather than merely provide advice.

Agentic transformation therefore requires three things to be explicit: what is authoritative, what is permitted and who is accountable. Without this clarity, agents may apply an inappropriate rule or continuously escalate to humans, undermining the value of automation.

The strategy organises transformation around common foundations: knowledge management, an agent execution environment, model access and security. It also includes parallel efforts covering architecture, organisational change and skills. Technical choices are expected to evolve alongside business processes and responsibilities rather than becoming disconnected projects.

The proposed environment combines several complementary functions: a common intake and programme management entry point, a shared context environment, a reusable skills library, tool access through MCP and a gateway for working with multiple AI models. Existing prototypes can become extensions of this environment instead of being discarded.

Shared capabilities reduce duplicated integrations and help teams reuse what others have already built. They also require explicit decisions about which tools are exposed, which agents may call them, what data they can receive and which operations they are authorised to perform. A central tool catalogue is not, by itself, an authorization system.

The strategy also separates AI models, which may be supplied by multiple providers, from enterprise knowledge and rules that the organisation intends to control. The model becomes replaceable, while business context and decision mechanisms remain durable assets.

The following principles are Ariovis recommendations derived from the strategy. They do not describe an infrastructure whose deployment has been independently established within the retail group.

The first requirement is to identify the agent, its owner and the mandate under which it operates. When acting on behalf of a user, the relationship between that user, the agent, the task and the duration of delegation must be explicit. Secrets and technical capabilities should be restricted to what the mission genuinely requires.

The second requirement is to evaluate business authorization when an action is requested. A valid OAuth token may allow an API call without describing the precise operations that are appropriate in a particular business context. A fine-grained authorization architecture can evaluate a request using identity, action, resource and context, then enforce that decision through a component on the execution path.

This control must remain independent of the model's preferences. An agent should not be able to bypass a refusal by choosing another interface that exposes the same operation. Policies may also need to consider business relationships, parameters, destinations, volumes, time limits and required approvals.

Action-level control must be integrated with broader agent security. Retrieved documents, injected instructions, tools, MCP servers, memories and workloads can influence an agent's behaviour or expose capabilities that exceed its intended mission.

Security mechanisms should discover agents and their dependencies, inspect interactions, constrain dangerous actions, observe execution and respond to behavioural drift. Tracing the sequence from intent to effect helps both incident response and the production of reliable evidence.

These requirements involve distinct but complementary capabilities: IAM for identities and mandates, privileged access management for secrets and elevated capabilities, fine-grained authorization for business decisions, and AI agent protection for tools, data and runtime threats. None should be presented as a universal solution to every agentic security risk.