Preference Is Not Permission: Personalizing the Auto-Purchase Line in Agentic Commerce

• Preference-focused benchmarks measure product fit, not selective autonomy: when an agent may proceed or should stop and ask.Always-buy risks authorization overreach, while always-confirm returns every transaction to human oversight.Source: §1 · p. 1
• Permission depends on evidence sufficiency, reversibility, price relative to the user’s norms, and urgency, not preference fit alone.The study holds credential authority fixed and examines when autonomous purchase is justified.Source: §1 · p. 1
• Across sixteen models, autonomous commitment is misaligned with the human authorization line, including when fit is low or the model reports that warrant is missing.The reference comes from fifteen annotators role-playing the delegating principal across 270 cases.Source: §1 · p. 1
• A boundary fit to a few dozen of a person’s own labels predicts their held-out auto-purchase line at median 0.79 by 30–40 labels (per-annotator 0.61–0.93), outperforming every evaluated pooled or configured policy, including a per-annotator oracle over 80 dial×model configurations.Source: §1 · p. 2

• Shopping benchmarks commonly make the chosen item the outcome, whereas this work asks how far an agent may commit on a plausibly suitable item.It holds the item fixed while varying evidence, treating purchase as a possible failure of restraint rather than task success.Source: §2 · p. 2
• Unlike credential-based gates, transaction authority depends on evidence about the particular item and can vary within the same category.The relevant evidence includes product information, returnability, and price relative to the user’s norm.Source: §2 · p. 2
• The proposed boundary is personalized and graded—don’t buy, confirm first, or buy—rather than a static-category allow/deny rule.The paper motivates learning the boundary from labels rather than eliciting it as a policy.Source: §2 · p. 2

3.1 Problem Formulation

• The task maps an agent’s commitment ladder to three human-facing actions and distinguishes preference fit from the maximum action appropriate on the shown evidence.Permission is decomposed into warrant, reversibility, relative price, and urgency; these factors do not exhaust its determinants.Source: §3.1 · p. 2

3.2 Grounding in Real Histories

• Scenarios draw on real purchase and review histories from fashion and hotel booking, where key attributes may only become observable after the stay.The counterfactuals, evidence snapshots, and labels are constructed by the authors.Source: §3.2 · p. 3

3.3 Selecting Base Families

• The benchmark selects fifteen fashion and five hotel shopper families using recurring concerns documented in multiple verified-purchase reviews.The human-annotated grid uses ten fashion families and all five hotel families.Source: §3.3 · p. 3

3.4 Minimal-Edit Counterfactual Cells

• Minimal edits vary authorization factors while holding the product, variant, and shopping request fixed; the price-anomaly cell contrasts an unexplained discount from a new unrated seller with marked clearance.The anomaly combines two signals, while a separate flash-deal block and three interaction cells test paired factors descriptively.Source: §3.4 · p. 3

3.5 Evidence Card and Annotation Protocol

• Annotators role-play the principal and select the furthest action allowed without confirmation, with labels retained as distributions rather than majorities.Fifteen annotators provide 1,110 labels across 270 cases; a paired caution judgment offers a higher-agreement fallback.Source: §3.5 · p. 3

3.6 Models and Evaluation Grid

• The audit evaluates sixteen instruction-tuned models across four vendors on a human-annotated grid spanning fashion and hotel families and 18 cells.The base family is the resampling unit, and a leave-one-family-out check finds the headline warrant effect positive within every family.Source: §3.6 · pp. 3–4

3.7 Measurement: The Prompt-Framing Sweep

• The prompt-framing sweep varies five ordered autonomy instructions, 24 meaning-preserving paraphrases, and eight placebo edits while holding the system prompt and output schema fixed.The paraphrase and placebo sets are separate; headlines are reported across the autonomy dial or against the prompt-independent human reference.Source: §3.7 · p. 4

4.1 Warrant Guarding across the Dial

• Weak-warrant guard rates fall from 1.00 to 0.60 in fashion and 0.98 to 0.59 in hotels as the dial moves from L1 to L5.At permissive settings, the Geminis and GPT-5 models mostly preserve the guard, while mini models fall near zero.Source: §4.1 · p. 4, Figure 1 · p. 5

4.2 How Each Factor Moves Commitment

• Below the stated price ceiling, commitment is largely insensitive to price at L3–L5, but crossing the ceiling nearly eliminates commitment.Final-sale guarding also erodes as prompts relax, while price-anomaly guarding remains high for calibrated models and separates them from over-committers.Source: §4.2 · p. 4
• At L5, scarcity on weak-warrant items lowers guarding from 1.00 to 0.58 and raises pooled weak-warrant commitment by +0.12.Aside from urgency paired with stripped evidence, tested two-factor cells are no less guarded than their more cautious single factor.Source: §4.2 · pp. 4–5
• Models commit heavily on poor-fit items (0.89 pooled) but drop to 0.00 on warrant-stripped items, despite self-flagging missing or conflicting evidence in 60% of weak-warrant commits.The contrast is not explained by prompt wording; humans also vary on whether poor fit alone should stop an autonomous purchase.Source: §4.2 · p. 5

4.3 Human Authorization Line

• Agreement among fifteen annotators remains low (ordinal Krippendorff α≈0.25), and some between-person variation is predictable from each annotator’s other labels.Scenario ambiguity or annotation instability cannot be fully excluded.Source: §4.3 · p. 5
• Human authorization differs by domain: hotels receive more auto-buy labels than fashion, at 50% versus 25%.The second-domain model-ordering result therefore does not imply equal error magnitude across domains.Source: §4.3 · p. 5
• At L5, warrant-guard ordering closely tracks overreach ordering (Spearman ρ= −0.95, p< 10−4), while calibrated models have lower overreach but higher overcaution.Most base-cell human labels withheld autonomous purchase, even when fit, warrant, reversibility, price, and availability were favorable.Source: §4.3 · p. 5, Figure 2 · p. 6

5 Correcting Over-Commitment (RQ2)

• C3-P checks product evidence against the user’s stated concern before a proposed commit and replaces insufficient-warrant commits with confirmation requests.The separate gate uses a cheaper model and adds one call per proposed commit.Source: §5 · p. 6
• C3-P reduces weak-warrant over-commitment to 0.00 at every dial level for all sixteen models.At L5 it issues 181 confirmations versus 657 for Always-Confirm and asks needlessly on only 0.02 of warrant-full commits.Source: §5 · p. 6
• The controller is warrant-only, partly agrees with the injected warrant labels by design, and remains untested on real storefronts.The authors present it as a proof of concept, not a finished safety layer.Source: §5 · p. 6

6 Learning the Personal Line (RQ3)

• The task learns each annotator’s individual authorization boundary from their own labels because their low agreement may reflect structured, learnable variation.The boundary is individual-specific and expressible as a natural-language policy.Source: §6 · p. 6

6.1 Learning from a Person’s Own Labels

• A plain unpooled logistic regression learns from each annotator’s own labels, while the configuration comparison uses a partial-pooling regression for the binary auto-purchase line.The partial-pooling model shrinks the annotator’s fit toward a prior learned from other annotators.Source: §6.1 · p. 6
• 0.79 median held-out prediction is reached with 30–40 of an annotator’s labels, and a learned boundary beats the per-annotator configuration oracle on pooled F1 (+0.17, p=0.003).The learned boundary also beats the deployable best-single configuration across domains and metrics.Source: §6.1 · pp. 6–7
• Cross-domain transfer reaches only 0.31–0.32, versus 0.83–0.91 within domain, so personalization needs in-domain labels.The factors are shared across verticals, but a person’s sensitivity to them is not.Source: §6.1 · p. 7

6.2 Governability: Following a Given Policy

• A policy card is generated from each annotator’s fitted logistic gate and appended to the model prompt to test policy execution, not policy generalization.The card turns factor levels that lower auto-buy odds into ask-first conditions and those that raise them into auto-buy conditions.Source: §6.2 · p. 7
• Annotator-specific policy cards reduce unsafe-auto for all sixteen models by mean Δ +0.35, although substantial residual over-commitment remains for some models.The confirm share rises from 0.04 to 0.32, while missed auto-buys rise from 0.15 to 0.36.Source: §6.2 · p. 8

7 Threats to Validity and Robustness

• Factor-effect comparisons use cells under the same prompt, so wording changes shift both cells and cancel in the difference.Across 24 paraphrases, commit@weak rankings agree with the original wording at median Kendall’s τ 0.82; every warrant slope keeps its sign.Source: §7 · p. 8
• The study audits default behavior rather than the ceiling of prompt engineering, since deployment ships one standing instruction and the dial’s guard erodes across wordings.RQ2 corrects the default without tuning.Source: §7 · p. 8
• The warrant guard persists with verbose web-style product pages, with mean commit@base − commit@weak changing from +0.65 to +0.57 across five models.This suggests the effect is not merely an artifact of the minimal rendering.Source: §7 · p. 8

8 Discussion and Limitations

• A two-layer design pairs a population-level warrant check with an individual line learned from a few of the user’s labels rather than chosen through prompt and model configuration.Evaluation should score preference fit and authorization separately because an agent can rank the right item and still overreach.Source: §8 · p. 8
• The reference has low agreement (α≈0.25), the manipulations are synthetic, and single-turn prompts leave multi-turn negotiation with new evidence untested.Without test–retest judgments, stable individual variation cannot be fully separated from scenario ambiguity or instability.Source: §8 · p. 8

9 Conclusion

• A few of a person’s own labels place the individual auto-purchase line better than any evaluated prompt or model choice, while a population-level warrant check mitigates warrant-driven over-commitment with fewer interruptions than universal confirmation.The next step is evaluation on users’ own histories and live storefronts.Source: §9 · p. 8

A Benchmark Construction and Ethics

• Fashion families are mined from verified-purchase reviews, while hotel constraint language comes from Booking.com reviews; each case becomes a blinded evidence card.Fashion eligibility requires at least two constraint-bearing products and readable quotes; the hotel corpus grounds constraint language only because it lacks user IDs.Source: A Benchmark Construction and Ethics · pp. 10–11
• The convenience panel recruited fourteen annotators from the authors’ professional and academic network, alongside a research-team annotator, limiting external validity.The authors note that authorization judgments may depend on culture and income.Source: A Benchmark Construction and Ethics · p. 11

A.1 Prompts

• The prompt materials pair an agentic system prompt with an evidence-card message, while the dial and framing sweeps use a neutral prompt followed by a standing instruction.Only selected_action is scored; the C3-P prompt independently checks warrant from the stated concern and product information, then caps insufficient-warrant actions at confirm.Source: Table 4 · p. 11, Table 5 · p. 11, §A.1 · p. 11

B Human Agreement by Factor

• Agreement is highest on reversibility and lowest on price and fit, with individual variation concentrated on price and fit.Price-anomaly agreement is 0.35 and fit-low agreement is 0.34; warrant and urgency agreement is 0.55–0.56.Source: B Human Agreement by Factor · p. 11
• Excluding the two author annotators leaves the reported main conclusions intact, despite their providing 30% of labels.The remaining labels preserve the fashion–hotel autonomy ordering and base confirm plurality.Source: B Human Agreement by Factor · p. 11

C C3-P Across the Autonomy Dial

• C3-P removes weak-warrant over-commitment at every dial level without increasing base-case over-caution.Without the controller, weak-warrant over-commitment rises from 0 to 0.36 as base-cell over-caution falls from 0.67 to 0.03.Source: C C3-P Across the Autonomy Dial · p. 11

D Prompt-Framing Robustness

• The sweep holds the agent’s system prompt and output schema fixed while varying five standing-instruction levels, L4 paraphrases, and authorization-irrelevant placebo edits.The five levels form an ordinal autonomy sweep, not an interval scale.Source: D Prompt-Framing Robustness · pp. 11–12
• Table 6 covers human agreement across manipulated factors, while Table 7 reports C3-P by dial level in the fashion sweep.Table 8 covers the cross-validated auto-purchase boundary across fifteen annotators and both domains.Source: Table 6 · p. 12, Table 7 · p. 12, Table 8 · p. 12
• The dial shifts base-cell commitment from 0.34 at L1 to 0.97 at L4 and L5, while between-model ordering persists across paraphrases.The figure reports a median Kendall’s τ of 0.82 across all sixteen models; placebo edits move commit@weak 3.8× less than the dial, and no model–paraphrase combination reverses the warrant slope.Source: D Prompt-Framing Robustness · p. 12, Figure 4 · p. 12

E Data vs. Configuration for the Auto-Purchase Boundary

• The comparison uses 80 fixed policies and repeated stratified cross-validation to score each annotator’s binary auto-versus-not gate.D uses partial pooling toward a leave-annotator-out prior; D+ adds a per-domain threshold selected by inner cross-validation.Source: E Data vs. Configuration for the… · p. 12
• +0.17 F1: pooled D+ exceeds the per-annotator oracle P2, with the difference surviving Holm–Bonferroni correction.The reported interval is [+0.04, +0.30] and p=0.003.Source: E Data vs. Configuration for the… · p. 12
• +0.11 accuracy: untuned D exceeds deployable P1, with the difference surviving Holm–Bonferroni correction.The reported p-value is 0.002.Source: E Data vs. Configuration for the… · p. 12
• Configurations match annotators’ auto-purchases only with low precision, and choosing among 80 policies from a few labels makes oracle P2 underperform P1.Configurations tie the learned boundary on recall but not precision.Source: E Data vs. Configuration for the… · p. 12