create_draft_order

What create_draft_order does on Shopify Graphql

AI agents use create_draft_order to create or update resources in Shopify Graphql, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Shopify Graphql environment.

Why create_draft_order is rated Medium

This tool creates new draft order records in Shopify, which are reversible (can be discarded or deleted). It is a Write operation rather than Financial because it creates a draft/uncommitted order, not an actual payment or financial transaction. However, severity is high because misuse could create numerous fraudulent or erroneous orders that require manual cleanup, and draft orders can be converted to actual orders.

From the tool's definition Tool name: 'create_draft_order' with description 'Create a new draft order'. The verb 'create' indicates data creation. Draft orders are order records in Shopify that represent potential transactions.

The rule that runs create_draft_order safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Shopify Graphql, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For create_draft_order, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "create_draft_order": {
      "limits": [
        {
          "counter": "create_draft_order_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about create_draft_order