Scopes & Permissions Reference

Two layers of scoping protect your store: Shopify OAuth scopes (what the app itself may access) and Shopigent category toggles (what your agents may access). An agent can never exceed either layer.

Category → Shopify scope map

Shopigent category	Read scope	Write scope
Products	`read_products`	`write_products`
Orders	`read_orders`	`write_orders`
Customers	`read_customers`	`write_customers`
Discounts	`read_discounts`	`write_discounts`
Content (pages/blogs)	`read_content`	`write_content`
Themes	`read_themes`	`write_themes`
Inventory	`read_inventory`	`write_inventory`
Fulfillments	`read_fulfillments`	`write_fulfillments`
Translations (Pro)	`read_translations`	`write_translations`

How the layers interact

Agent calls tool
   │
   ├─ 1. Is the category enabled in Curated Tools?   ── no → tool not even listed
   ├─ 2. Does the plan allow this tool type?          ── no → plan_upgrade_required
   ├─ 3. Does the app hold the Shopify scope?         ── no → scope_missing
   ├─ 4. Is it destructive?                           ── yes → confirmation gate
   └─ 5. Execute → record in audit log

Principle of least privilege

Start with only the categories you need — you can enable more later without reinstalling.
Prefer separate API keys per agent/client, so revoking one doesn't break the others.
Review the audit log after enabling a new category to see how your agent uses it.