Human-in-the-Loop E-Commerce AI Assistant

The challenge

The goal was a conversational front door for a catalogue of 275 artists, 347 albums and 3,503 tracks that can genuinely sell , recommend, build a cart, take a purchase request , while being structurally unable to spend the business's money on its own. Prompt instructions are a hope, not a control, so the objective was to design the tool surface itself so unauthorized orders and model-invented prices are impossible rather than unlikely.

Approach

• Gave the agent a single, deliberately narrow channel to the data: an MCP tool server running as an isolated subprocess with 8 tools, on a read-only database connection so even a bypassed application check cannot write. No tool in the toolbox can create an order , the agent can only file a purchase request into a review queue.
• Built the human-in-the-loop sales console as the one code path that turns a request into a billable order, gated by an atomic status transition so two employees acting on the same request cannot double-create it; every decision and the employee behind it is recorded by construction. Every amount shown or billed is recomputed server-side from live catalogue prices.
• Structured query tool: direct SQLAlchemy/SQL access for exact lookups , tracklists, precise matches, aggregates , returning in ~1ms so the conversation feels instant.
• Full-text relevance tool: Elasticsearch ranked, typo-tolerant search, so "Metalica" still resolves to Metallica when a customer's phrasing doesn't match the catalogue.
• Semantic vector tool: a local embedding model (no external API dependency) matches mood and vibe descriptions , "something moody and atmospheric" , against artist style descriptions by meaning rather than keywords.
• Knowledge-graph tool: a Neo4j graph of artists, genres and real cross-customer co-purchase patterns, queried with genuine multi-hop Cypher traversal to answer "similar to X" , which works with zero purchase history and so solves the cold-start case that history-only recommendation cannot.
• Layered a hybrid recommender over the tools, blending a customer's own history with patterns from customers who share their taste, cached per customer and invalidated the moment a new purchase changes what should be recommended.
• Made every optional service degrade gracefully to a working fallback, bound the acting customer identity server-side from the authenticated session so the agent's own output can never widen its access, and provisioned the search and graph infrastructure as Terraform-reviewed, cost-estimated AWS resources.

Outcome

The agent picks the right retrieval strategy per turn , exact catalogue lookups in ~1ms, graph-based similarity in ~1s , and returns grounded recommendations even for first-time customers, where purchase-history recommendation covers nothing by definition. 66 automated tests cover pricing correctness, concurrent-approval races, duplicate purchases and malformed input against an isolated database copy. The result is an agentic commerce reference build where unauthorized order creation isn't a low-probability risk but an absent capability, and the audit trail is a structural property of the approval workflow rather than a later addition.