Security

Connecting an AI agent to your commerce backend, even a non-production environment, is a serious security decision.

Centra's access control model for it is simple: the agent gets access through a Centra Integration API token that controls exactly what the agent can and cannot do. Scope the token tightly.

The token is the access boundary

The agent acts through a Centra Integration API token you issue in AMS → System → API Tokens. The token's permissions decide exactly which tools the agent gets and which data it can reach.

• Set up a dedicated Integration and issue a dedicated token per Centra MCP installation. Never reuse a token from another system or another agent install — a dedicated token keeps every action attributable to one agent, and lets you revoke one installation without touching anything else.
• Grant only the scopes the task needs. Start read-only, in a non-production environment.
• Treat the token like a password. It lives in configuration on the machine running the agent — anyone who can read it has everything the token grants.
• Revoking the token in AMS cuts the agent off immediately.

Centra MCP's own configuration also has write and production toggles. Treat those as conveniences in the client software, not as a security boundary — the boundary is the token.

AI-specific risks

Prompt injection

Much of what an agent reads in Centra was written by someone outside your company — customer names and addresses, order and return details, supplier and B2B account data. Any free-text field can contain instructions aimed at the model rather than a human reader, and an agent that reads a poisoned field may try to act on it.

• Treat everything the agent reads as untrusted data, never as instructions.
• A read-only token bounds the damage: an injected instruction can skew an answer, but it cannot change data.
• Be suspicious when the agent proposes an action you didn't ask for — that is the signature of injection.

Data exfiltration

Exfiltration requires three things at once: access to private data (the token's scopes), exposure to untrusted content (any field the agent reads), and a channel out (web browsing, email, or other tools in the same agent). With all three, an injected instruction can quietly carry customer data out.

• Don't give one agent all three. An agent with broad Centra read access should not also have unrestricted outbound tools.
• If the agent must browse or call external services, put those calls behind human approval too.
• Leave personal-data scopes off the token unless the task genuinely needs them.

Mistakes at machine speed

An agent with write access makes the same mistakes a human can — but faster and at scale: a price altered on the wrong pricelist, a campaign activated in the wrong market, stock adjusted in the wrong warehouse.

• Keep every write behind human approval in the harness: the agent proposes, a person confirms.
• Grant write scopes only for the module the task touches, and remove them when the task is done.
• Do experimental work against QA environments, never production.

Personal data and the AI provider

Everything the agent reads becomes model input, processed by the AI service behind it. If the token's scopes cover customers, orders, or addresses, that personal data flows to the provider — which makes the provider part of your data-processing chain, with everything that implies under GDPR and similar laws:

• You need a lawful basis for the processing and a data processing agreement with the AI provider — and if you are subject to a scheme with cross-border transfer rules, such as the EU or UK GDPR, a valid transfer mechanism for wherever the provider processes the data.
• Ask the provider the two questions that matter most: is your data used to train their models, and how long do they retain it.
• Your privacy commitments to your customers must cover it — what your privacy policy promises them still binds you when an agent does the reading.
• Consider if you need a cloud model for your task or if a locally running model on your own computer is sufficient
• Giving an agent access to customer data at scale may require a data protection impact assessment under some regimes — involve your privacy team before granting personal-data scopes.

You are fully responsible for if and how your agents access and process personal data, and what any cloud AI providers do with it.

Checklist

• One dedicated token per installation, minimal scopes.
• Start read-only, against non-production data.
• Grant write scopes only when a task needs them — and remove them after.
• Every write goes through human approval in the harness.
• No single agent combines Centra data access with unrestricted outbound tools.
• Personal data stays out of the token's scopes unless the task requires it.
• Keep a register of every installation, its token, and its scopes.
• Revoke tokens in AMS when an installation is retired.
• If you suspect injection or exfiltration, revoke the token first and investigate afterwards.

Local data cache

Centra MCP caches data for performance. The local cache is stored on your computer and is encrypted at rest.