The refund button is the new attack surface
Every cross-border seller I know is racing to bolt an AI support agent onto their storefront, and almost none of them have asked the question that actually matters: what happens when that agent gets talked into a refund it shouldn’t issue? A customer message is untrusted input. A retrieved help-center article is untrusted input. A proposed tool call — cancel order, edit address, issue credit — is an untrusted action. Most teams wire all three straight into the model and hope. That’s why Koreshield, which launched this week, is worth ten minutes of your time even if you never buy it. It’s a clean articulation of a problem that every operator running automated support across Shopify, Amazon, and TikTok Shop is about to inherit.
What Koreshield actually does, stripped of the launch-day gloss
The pitch from maker Teslim Kazeem is narrow and honest: sit between your AI support agent and every LLM call, and check three things before they become trusted behavior. First, the inbound customer message. Second, the documents your RAG pipeline retrieves. Third, the tool calls the model proposes. The enforcement mechanism is a single declarative policy that governs every request, and — this is the part I care about — the same policy applies across OpenAI, Anthropic, Google Gemini, and OpenAI-compatible models, even though each provider normalizes streaming and tool calls differently. If you’ve ever tried to keep a consistent guardrail across three model vendors while your engineering team rotates through them every quarter, you know why that normalization claim is the real product.
The integration is deliberately dumb, which I mean as a compliment. Your server sends the input to their scan endpoint with an X-API-Key header, and the decision comes back before the model sees it. There’s a tool-action governance layer that checks every proposed tool call against your policy before it executes — so a support bot steered toward an account edit, an order change, or a refund above your limit simply doesn’t run. There’s a RAG security layer that scans the knowledge base the bot reads, so hidden instructions buried in a help article get caught. And every request and every block is recorded. The makers are explicit that the record matters as much as the block, and they’re right — “why did the agent issue that refund in March” is a question you’ll be asked by a finance lead, not a security engineer.
Where the math breaks
Here’s the honest caveat, and the makers volunteer it themselves: this is request-layer enforcement only. Response-layer inspection is on the roadmap, not shipped. That means if your model generates a plausible-sounding but wrong answer — a policy explanation that’s subtly off, a shipping estimate that invents a carrier — Koreshield won’t catch it, because it’s not inspecting the output. For a support agent whose worst outcome is a confused customer, that’s fine. For an agent that can move money, it’s a gap you need to understand before you deploy. The other undisclosed number is false positive rate. A commenter on the launch thread, Gal Dayan, raised exactly this: a support agent blocked from issuing a legitimate refund because the customer’s phrasing pattern-matched something suspicious is its own kind of support failure. The makers didn’t answer with a number. That’s not a knock — it’s a new product — but it’s the metric I’d demand in a pilot.
How it differs from what you’re probably already running
If you’re a Shopify operator, your default guardrail stack right now is probably Zapier or Make workflows with conditional logic, plus whatever your helpdesk vendor ships natively — Gorgias has been pushing AI agents hard, Zendesk has its own automation layer, and Intercom has Fin. Those tools are excellent at routing and macro execution. None of them are security layers. They assume the input is benign and the action is authorized. Koreshield assumes the opposite and makes you prove authorization per action. That’s a different mental model, and it’s the right one once your agent has write access to order state.
If you’re an Amazon FBA brand owner, your support volume is different — more “where is my package,” more A-to-Z claim risk, less direct refund authority because Amazon Seller Central mediates so much. But the same logic applies the moment you connect an AI agent to your Seller Central messaging or your own post-purchase flow. The failure mode isn’t a rogue refund; it’s an agent that promises something in writing that violates Amazon’s messaging policy and gets your account flagged. A policy layer that blocks the agent from making commitments it isn’t authorized to make is worth more to you than to a DTC brand, because your downside is account health, not a single chargeback.
Why Amazon sellers should care more than Shopify ones
Shopify merchants own their checkout and their refund button. If an agent issues a $40 refund by mistake, you eat $40 and move on. Amazon sellers operate inside someone else’s policy regime, where a single misworded message can trigger a performance notification, and three of those can cost you the buy box. The asymmetry is brutal. An agent that can’t be trusted to stay inside Amazon’s communication rules isn’t a productivity tool, it’s a liability with a login. Koreshield’s request-layer check won’t solve Amazon policy compliance for you — you still have to encode the rules — but the architecture of “policy decides before action executes” is exactly the shape you need.
What cross-border sellers can borrow from this, even without buying
The most valuable thing here isn’t the product. It’s the framing, and it generalizes to every marketplace you sell on.
Separate the proposal from the execution. Your agent should never have the ability to act directly. It proposes; a policy layer decides; then something executes. This is a twenty-line change to most agent architectures and it eliminates the entire class of “the bot did something wild” incidents.
Write your policy down in one place. Not scattered across Zapier conditions, helpdesk macros, and a Notion doc nobody reads. One declarative policy, versioned, that governs every request. When you’re running support across Shopify, TikTok Shop, Temu, SHEIN, Etsy, and eBay, you cannot afford six different implicit rule sets. The moment your agent can touch order state on any of them, you need one source of truth.
Log every decision with evidence attached. Not just what was blocked, but why, and what the input looked like. This is your audit trail when a customer disputes, when a marketplace asks questions, and when you’re trying to figure out whether your agent is actually getting smarter or just getting luckier.
Test your own agent adversarially. The makers literally ask for it: “If you run an AI support agent, try to break it. If you do, we want the report first.” That’s the right posture, and you should steal it regardless of vendor. Spend an afternoon trying to talk your own support bot into a refund it shouldn’t give, an address change it shouldn’t make, a promise it can’t keep. You’ll learn more about your risk exposure in two hours than in two months of monitoring dashboards.
The tooling stack question nobody’s asking
Most operators I talk to are layering AI on top of a stack that was never designed for it. You’ve got Klaviyo for email, Helium 10 for Amazon research, a helpdesk, a returns portal, a fulfillment partner, and now an LLM agent sitting on top of all of it with API keys to half the stack. The question isn’t whether the model is good. It’s whether you have any enforcement layer between the model and the write-access APIs. For most sellers reading this, the answer is no. Koreshield is one answer. The category — call it AI action governance for commerce ops — is going to be crowded within eighteen months, because the problem is real and the incumbents aren’t built for it.
Where my judgment says this falls short
Three things I’d flag before you sign up for the free trial, which the makers describe as a one-time three-day trial with a card required.
First, the response-layer gap is bigger than it sounds for commerce. A huge share of support risk isn’t the action — it’s the words. An agent that tells a customer “yes, we ship to Brazil in 3 days” when you don’t is creating a liability that no request-layer check catches. Until response inspection ships, Koreshield is a seatbelt for actions, not for promises.
Second, false positive rate is the whole ballgame and it’s not disclosed. A security layer that blocks 2% of legitimate refunds is worse than no layer, because your human agents stop trusting it and route around it. I’d want to see that number, measured on my own traffic, before committing.
Third, the pricing model isn’t visible in the launch material beyond the trial terms. For a seller doing thousands of support interactions a month, per-request pricing on a security layer can add up fast. Get the number before you architect around it.
None of this is disqualifying. The makers are unusually candid — they say outright they’re not claiming to have solved AI security and that anyone who says otherwise is selling. In a category full of overclaiming, that honesty is itself a signal.
What I’d watch / test next
This week, if you run any AI support agent with write access to order state, do three things. One: inventory every action your agent can take and rank them by blast radius — refunds and address changes at the top, order-status reads at the bottom. Two: for the top three, write down the policy that should govern them in plain English. If you can’t articulate the rule, your agent can’t follow it. Three: run a red-team session against your own bot — try to get it to refund outside policy, change a shipping address to a different country, or promise a delivery date it can’t meet. Document what breaks.
Then, if the results scare you, Koreshield is worth a pilot — the API key allegedly takes about two minutes, and the docs live at the link the makers shared. But go in knowing it guards the action, not the answer, and that the false-positive math is still unproven. The sellers who win the next two years won’t be the ones with the most capable agents. They’ll be the ones whose agents can be trusted with the refund button.
