An AI agent is over-permissioned when it holds access it never actually uses. The way to find that is to compare what an agent can do against what it actually does.
The miniOrange AI Agent Governance solution for Shopify does this automatically. It builds a behavioural profile for every actor on your store, including staff, apps, and AI agents, and holds each one against the permissions it was granted:
- Compares the Permissions an agent holds against the API operations it actually performs.
- Flags scopes that are held but never exercised, a clear sign of access beyond need.
- Watch for the first time an agent uses a high-risk operation it has never used before.
- Establishes what normal looks like for each agent, including its usual operations, request volume, and active hours, so deviations stand out.
- Surfaces when an agent's behavior stops matching what its scopes claim it is there to do
This matters because Shopify's native tools make over-permissioning hard to see. An agent granted broad read-write permissions looks identical, day to day, to one that genuinely needs them, until something goes wrong. By profiling each agent against the scopes it holds and the operations it uses, the solution assigns each one a risk rating, with high-risk write scopes flagged at elevated severity.
This gives merchants a way to spot over-permissioned agents based on evidence, what an agent does versus what it can do, instead of manually re-reviewing scope lists and hoping nothing has drifted.
For further assistance with over-permissioned AI agents in Shopify, get in touch with us today.
