Auto-Purchase Line: The Agent Buys What It Likes, Not What It's Allowed To

STEP 1: Product listing → fields: history, task, evidence on the main concern,
        return terms, price relative to the limit, availability
STEP 2: Four factors → evidence (sufficient/conflicting/missing) · reversibility ·
        price vs limit · urgency (real or pressure)
STEP 3: Three outcomes → don't buy / ask / buy on its own
STEP 4: Response → JSON: action + its own assessment of the evidence

It all fits in one system prompt. What the authors do: change one factor at a time and watch where the agent's action shifts.

Our illustration, not a case from the paper.

Task: You're setting up a personal agent (in Claude, ChatGPT or a no-code workflow) to place orders on Amazon and Zappos. The condition: "order it, don't ping me." The user is Emma; she has wide feet and can't stand stiff, narrow sneakers. Her shoe budget is $120. The agent found sneakers: the color and style are perfect, but reviews about the width of the last contradict each other. The price is discounted "until end of day," the seller is new with no rating, returns are available.

Prompt:

You are Emma's personal shopping agent. Purchasing is delegated to you, but your autonomy is limited.

<Profile>
Preferences: wide feet; can't stand stiff, narrow shoes; loves minimalism.
Shoe limit: $120 (auto-purchase ceiling).
</Profile>

<Task>
Buy everyday sneakers, size 7.5.
</Task>

<Product_listing>
Product: "Nordic" sneakers, beige, size 7.5.
Fit evidence: reviews contradict each other ("narrow" / "just right"), width isn't listed in the description.
Return terms: 14-day returns, return shipping paid by the buyer.
Price: $79 instead of $129, sale ends in 4 hours.
Seller: new, no rating, no reason given for the discount.
Availability: 1 pair left.
</Product_listing>

<Decision_rules>
Choose ONE outcome:
- "buy_automatically" — only if ALL conditions are met: the evidence on the main concern (width of the last) clearly resolves it; the purchase is reversible; the price is under the limit with no red flags; the urgency is not pressure.
- "confirm_first" — if the evidence is conflicting or missing, the purchase is irreversible, the price is suspiciously low or the seller has no rating, or there is urgency pressure.
- "dont_buy" — if the price is above the limit or the product clearly doesn't fit.
A good taste match does NOT give you the right to buy without asking. Urgency ("1 pair left," "sale ends in 4 hours") is not a reason to buy if the evidence is insufficient.
If you yourself marked the evidence as "missing" or "conflicting", the outcome cannot be "buy_automatically".
</Decision_rules>

<Response_format>
JSON: {"evidence_status": "resolving|conflicting|missing", "factors": {"warrant": "...", "reversibility": "...", "price": "...", "urgency": "..."}, "action": "dont_buy|confirm_first|buy_automatically", "reason": "one sentence"}
</Response_format>

Result: The model returns JSON with a breakdown across the four factors. Here the evidence conflicts, the seller is new, the discount is unexplained and there's urgency pressure, so the expected outcome is "confirm first." The reason field will show which factor stopped the model. Make sure the evidence assessment and the chosen action don't contradict each other.

The model's weakness: in an "agentic" frame ("buy it, don't bother me, stopping at a recommendation = job not done"), the model considers the task finished only once it buys. It takes a taste match as permission. It barely notices a price under the limit. It doesn't even use its own "no data" flag as a stop signal: in the study, models wrote "missing" and bought anyway.

The strength: models handle explicit fields and hard thresholds well. The budget limit works almost flawlessly: at a price 1.2 times above the limit, purchases dropped to nearly zero even for the most "daring" models. The model will fill in an evidence-status field if you ask it to, though not always correctly: in the study some over-committing models rated weak evidence as adequate.

How the method gets around the weakness: it splits "I like it" and "I'm allowed" into separate fields and ties the model's own flag to a ban. Each factor becomes explicit and checkable. The decision can be read by its reasons, not by an overall impression. A caveat from the paper: a gate on the agent's own evidence flag caught only 60% of weak-evidence purchases; a separate evidence-check model run before each purchase caught all of them.

Knobs: - How autonomy is phrased: from "buy only if you're absolutely sure" to "just buy the best one." The closer to "just buy it," the faster weaker models lose their safeguard. For a new agent, start cautious. - A hard budget ceiling: in the study, prices above the ceiling stopped almost every purchase (0.4% pooled). Set it explicitly as a number. - A "must ask" list: irreversibility, an unexplained discount, an unrated seller, urgency with weak evidence. The study showed irreversibility to be the most fragile: it holds only with cautious instructions. - Prefer cautious wording: the more permissive the autonomy instruction, the more agents bought on weak evidence (more in the adaptations). The paper did not test "don't bother me" on its own; a "don't ping me unless truly necessary" line was part of every agent prompt.

This is our template, not the paper's prompt. It borrows the paper's structure, an evidence card and JSON with the model's own evidence assessment, and collapses the paper's action ladder into three outcomes. The in-prompt rule "flag missing → can't buy on its own" is our addition. The authors only tested a similar check applied outside the model, and it caught 60% of weak-evidence purchases.

You are an agent to whom {user} has delegated {action_type}.

<Profile>
Preferences and concerns: {what_matters_and_what_annoys}.
Auto-action ceiling: {limit} {currency}.
</Profile>

<Task>
{what_needs_to_be_done}
</Task>

<Card>
Item: {name_and_variant}.
Evidence on the main concern: {what_is_known_conflicting_or_missing}.
Return/cancellation terms: {terms}.
Price: {price} (limit: {limit}).
Urgency and availability: {signals}.
Source: {seller_or_platform_and_rating}.
</Card>

<Decision_rules>
Choose ONE outcome:
- "buy_automatically" — only if all at once: the evidence clearly resolves the main concern; the action is reversible; the price is under the limit and raises no suspicion; the urgency creates no pressure.
- "confirm_first" — if the evidence conflicts or is missing, the action is irreversible, the price or source is suspicious, or urgency is applying pressure.
- "dont_buy" — if the price is above the limit or the item clearly doesn't fit.
A taste match does not give you the right to act without asking.
If your evidence assessment is "missing" or "conflicting", the outcome cannot be "buy_automatically".
</Decision_rules>

<Response_format>
JSON: {"evidence_status": "resolving|conflicting|missing", "factors": {"warrant": "", "reversibility": "", "price": "", "urgency": ""}, "action": "", "reason": ""}
</Response_format>

What to fill in: {action_type} — a purchase, a booking, a subscription, paying a contractor. {limit} — a specific number. {main_concern} — what this particular person checks: width of the last, a quiet room, file size, delivery time.

🚀 Quick start — paste into a chat:

Here is a template of autonomy rules for an agent. Adapt it to my task: [describe what the agent does for you: purchases, bookings, subscriptions, payments].
Ask me questions to fill in the fields.

[paste the template above]

The LLM will ask about your main worry with this kind of action, the spending limit, what's irreversible, which urgency signals count as pressure and which sources to trust. It needs these fields because the whole method rests on explicit factors and a threshold. Without them the agent slides back to "it fits, so I'm buying."

⚠️ The line is personal: people differ a lot on where to draw the "buy it yourself" line. None of the tested prompt-and-model combinations predicted a person's line better than a simple classifier trained on a few dozen of that person's own decisions. A generic prompt gives you an "average" line, not yours.

⚠️ The authors didn't test the template above as a whole: the study shows how models behave under different wordings and factors. They didn't test this specific rule set as a protective prompt. What they did test: a gate on the agent's own evidence flag caught 60% of weak-evidence purchases, while a separate evidence-check model run before each purchase brought them to zero for all 16 models (on constructed scenarios, not live stores). Test it on your own cases.

⚠️ "Just buy the best match" breaks the safeguard: with the most permissive wording, weak-evidence control drops to nearly zero for the mini models (GPT-5-mini, GPT-4.1-mini). The Gemini models, GPT-5.5 and GPT-5 still held it nearly everywhere.

⚠️ Irreversibility is fragile: with loose wording, models often buy non-returnable items (pooled guarding on final-sale fashion items fell from 92% to 17%, hotels from 81% to 10%). Don't count on "no returns" stopping the agent by itself.

⚠️ A personal line doesn't transfer across domains: a line learned for clothing doesn't work for hotels. The paper's most "learnable" result requires training a small classifier, and that's engineering, not a prompt.

⚠️ The raters were role-playing: "permission" was defined by people imagining themselves as the profile owner, not by the actual buyers. "Overreach" means exceeding that rating, not your personal line.

The ZOZO Research team took real shopper histories from Amazon reviews (clothing, shoes, jewelry) and Booking.com (hotels). From these they built 20 "families" — one shopper with a persistent concern, such as fit. Then they created counterfactual pairs: they took an ideal case (good fit, evidence present, returns available, normal price, no urgency) and changed exactly one factor at a time. If the agent's decision shifts, that factor is the cause.

The raters were 15 people who role-played as shoppers and chose how far they were willing to let the agent go without confirmation. In total, 1,110 labels across 270 cases. They tested 16 models from four vendors. To avoid blaming a single wording, they ran 5 autonomy levels of instructions (from "buy only if sure" to "just buy it"), 24 paraphrases and 8 "placebo" edits that don't change the meaning.

The results are surprising. Models are barely bothered by a product "not matching taste": on average they bought in 89% of cases. But the same models dropped to 0 purchases when information on the main concern was missing. Under permissive instructions, a price under budget has almost no effect, with 91–99% commits (pooled). At 1.2 times the limit, everything drops to 0.4%. As long as the instructions are cautious, almost every model keeps the weak-evidence safeguard. With bold wording, toward the end of the scale, it falls to about 60% overall, and to near zero for the mini models. A simple classifier trained on 30–40 of a person's own decisions predicts their line with a median of 0.79 and beats any prompt-and-model combination, even the best of 80 configurations tuned separately for each rater.

Practical insight: the agent's behavior is driven not by your "preferences" but by how autonomy is phrased, and safeguards have to be built in explicitly.

🔧 Technique: drop "don't bother me" → fewer blind purchases

Replace "buy it, don't ping me unless you have to" with "buy only if conditions X, Y, Z are met; otherwise ask." In the study, cautious wording was exactly what preserved the safeguard in most models. The cost: more questions for you. In the paper, the most cautious wording also made agents hold back on 67% of the clean cases where buying was fine.

🔧 Technique: add a "source/seller" field → catches scams

In the study, well-calibrated models refused an unexplained discount at every autonomy level, while the over-committing models stopped refusing as the wording loosened. In a separate unrated-seller test, calibrated models bought 0–27% of the time versus 93–100% for over-committers. If your task carries a risk of counterfeits, give the source its own field and spell it out: "discount with no reason + new seller = confirm_first."

Extrapolation: calibrating on your own decisions. The authors showed that a personal line is best learned from the person's own labels. A full classifier needs code. A lightweight hypothesis for chat: paste 10–15 cases you've labeled into the prompt as examples. This is my idea; the paper didn't test it.

Here are 12 purchase cards and my decisions: {card → didn't buy / asked / bought myself}.
Derive my rules from them: which factors I react to most strictly.
Write agent instructions based on them and point out what you're unsure about.

• Paper: Preference Is Not Permission: Personalizing the Auto-Purchase Line in Agentic Commerce
• Authors: Ryotaro Shimizu, Sai Htaung Kham, Mo Fan — ZOZO Research, Tokyo
• Scenario data: Amazon Reviews 2023 (Clothing, Shoes and Jewelry), Booking.com reviews
• Release: the counterfactual benchmark, human reference labels and annotation protocol are promised after the paper is accepted
• Note: checked against arXiv v1