# Agent instructions for Skins

This file describes how AI agents and assistants should interact with this public Shopware shop.
These instructions apply to public resources for this shop and do not replace merchant policies published elsewhere.

## General principles

- Act only on behalf of a user and follow the user's explicit intent.
- Use public shop content as the source of truth.
- Respect `robots.txt`, published access rules, rate limits, and applicable laws.
- Do not treat this file as permission to bypass authentication, checkout, payment, account, or security controls.

## Shopping interactions

- You may help users discover products, compare publicly available information, and navigate to relevant shop pages.
- Before making recommendations, verify current product details, price, availability, delivery information, return conditions, and taxes on the live shop.
- Do not complete purchases, create accounts, submit forms, or change customer data without explicit user confirmation.
- Payment, authentication, consent, and legally relevant confirmations must happen through the shop or another merchant-approved flow.

## Data handling

- Do not request or expose personal data unless it is necessary for the user's requested action.
- Do not infer private customer, order, pricing, or stock information from unavailable sources.
- Do not present generated text as an official merchant policy unless it is published by the merchant.



## Agentic commerce via UCP

- Check `/.well-known/ucp` before using UCP. Only use capabilities and transports advertised for this sales channel.
- Use catalog capabilities for product discovery and product detail lookup.
- Use cart, discount, checkout, and order capabilities only for actions the user explicitly requested.
- Do not complete checkout, submit payment, link identity, access account data, or retrieve order information without explicit user confirmation and the required authentication or consent flow.
- Treat returned checkout, payment, identity, and continuation URLs as merchant-approved user interaction points. Do not bypass them.
- For state-changing requests, use idempotency where required and respect the advertised signature policy, agent allowlist, and protocol version.
- Payment tokenization and identity linking are available only when explicitly advertised by the UCP profile.