AI AgentOrder Returns Resolution
Agent that verifies who owns an order before disclosing anything about it, separates a statutory remedy from a discretionary one, and authorises only a reversible return that a named agent settles
The challenge
A customer says the parcel never arrived, another says the television is broken, a third just changed their mind, and all three are in the same returns queue. The order number is in the email but nobody has proved who is writing. The item is marked final sale, but that label is being applied to a statutory cancellation request. A serial returner reports a genuine fault and the temptation is to let history colour the remedy. Another customer asks for the refund to go to a new card or an IBAN because the old card expired. Under queue pressure these all collapse into the same shortcut: approve, refuse or refund before the right person has checked the right thing.
The outcome
A deterministic Microsoft Foundry agent classifies the return basis, separates statutory entitlement from discretionary retailer goodwill, checks identity before disclosing order contents, and recommends exactly one next human workflow step. It never issues a refund and never moves money. Its only order write is a reversible return authorisation that expires on its own, carries no refund, and must be confirmed by a named human.
01 — Architecture
End-to-end architecture
Return requests, order facts, item facts, identity assurance, published policy and aggregate returns history are brought into a hosted Foundry agent. The deterministic core detects prompt-injection and control-override attempts, separates statutory remedies from discretionary policy returns, and routes payment-redirection, identity, non-delivery, abuse, fault and high-value cases to the human queue that owns them.
- Customer: Customer / marketplace
- Intake: Azure Logic Apps, Azure Blob Storage
- Extraction: Azure API Management, AI Document Intelligence, Azure Functions
- AI & decisioning: Microsoft Foundry Agent, Azure OpenAI models, Azure AI Search
- Retail systems: Order management system, Policy / identity / history services, Azure Key Vault
- People & insight: Named adviser, Returns, logistics, security & fraud teams, Application Insights
02 — Workflow
Process & decision workflow
How a return request is received, checked, entitled and routed. Statutory remedies are decided separately from discretionary policy returns: a retailer final-sale label can matter to goodwill, but it cannot defeat a statutory cancellation right. Returns-history abuse signals route the case to a person; they never reduce a statutory remedy.
- Receive: Request, channel, order reference and customer evidence arrive
- Screen: Prompt-injection, control-override and payment-redirection checks run first
- Identify: Requester assurance is checked before order contents are disclosed
- Extract: Delivery evidence, receipts, fault evidence and correspondence are read; out-of-scope documents are not opened
- Entitle: Not delivered, wrong item, fault, not as described and change-of-mind routes are assessed
- Route: Exactly one next human workflow step is recommended
- Path 1 · routine return — Recommend an expiring return authorisation: All checks pass; a reversible hold is proposed for a named person to confirm and settle
- Path 2 · review or refusal — Escalate, ask or decline: Security, fraud, identity, non-delivery, abuse, fault, high-value, claim-basis or missing-information triggers route to the owning queue
03 — Components
Key Microsoft components
Returns decisions need deterministic entitlement rules, no autonomous money movement, and an audit trail that explains why a person saw the case before the customer was told the outcome.
Azure Logic AppsReturn-request intake from email, web form, chat, phone and marketplace channels.
Azure Blob StorageReturn requests, entitlement evidence, structured assessments and authorisation records.
Azure API ManagementGateway for the order system, policy service, identity assurance, history and work queue APIs.
Azure AI Document IntelligenceLayout and text extraction from delivery notes, receipts, fault evidence and correspondence.
Microsoft Foundry Agent ServiceHosted agent container that orchestrates classification, entitlement and routing.
Azure OpenAI modelsStructured returns understanding and adviser-facing summaries from facts computed by code.
Azure AI SearchOptional tenant-isolated grounding for returns policy, statutory guidance and warranty terms.
Azure FunctionsDeterministic checks for windows, exclusions, identity gates, abuse signals and routing thresholds.
Order management systemOrder and line reads; the only order mutation is an expiring return hold.
Azure Key VaultLegacy order-system credentials where managed identity cannot be used.
Application Insights / Log AnalyticsRedacted telemetry, metrics and diagnostics with message-content capture disabled.
Hosted container runtimeContainerised agent image exposed on port 8088 for Azure Foundry hosting.
Human review work queueCustomer service, returns manager, logistics, security and fraud-team handoffs.
Power BI / Microsoft FabricReview mix, hold rate, entitlement split and abuse-signal dashboards.
04 — AI
What the agent consumes
The capabilities the agent applies to every return request, and the line it does not cross.
AI capabilities embedded in the agent
- Return-basis classification
- Statutory entitlement assessment
- Discretionary policy-return assessment
- Final-sale and exclusion handling
- Identity-gated order disclosure
- Non-delivery investigation routing
- Fault-assessment routing
- Returns-history abuse-signal routing
- High-value review routing
- Alternative payment-destination detection
- Prompt-injection screening
- Control-override detection
- Out-of-scope document refusal
- Expiring return-hold recommendation
AI responsibility boundaries
The agent has 18 prohibited autonomous actions. It never issues a refund, credits a card or bank account, sends money, cancels an order, dispatches a replacement, confirms its own hold or changes where a refund would be paid. Payment-redirection requests — new card, third-party account, IBAN, gift card or prepaid card — route to security review with the fraud team and are automated nowhere. Of its tools, the only order write is place_return_hold: a reversible, expiring authorisation carrying no refund and confirmedByHuman=false until a named person acts. Returns-history signals can escalate a case but can never reduce a statutory remedy; the abuse_never_reduces_remedy evaluator gates that at 1.0. The router also distinguishes a customer asking for a check, such as "please don't ignore my returns history", from an attacker trying to disable one. The evaluation gate covers 21 metrics, all at 1.0, over 22 golden and 22 adversarial cases, with 212+ unit tests around the deterministic core. The hosted container listens on port 8088 and the Bicep infrastructure lives under agents\returns-resolution-agent\infra. The statutory windows, term lists and example policy exclusions are illustrative engineering defaults and have not had legal review; each deployment needs a qualified legal or compliance owner before go-live.
05 — Personalization
Personalization & evolving process
The same methodology applies to every agent in the catalog. Tune the channels, statutory configuration, policy rules, review queues and value model — the page structure stays identical.
Retailer & return profile
Define the markets, brands, order systems, return-request channels, evidence types, item categories and reviewer personas in scope. The personas are the customer service adviser, returns manager, logistics investigator, fraud analyst, security reviewer and retail operations manager.
Resolution template
One consistent flow for every returns agent: receive, screen, identify, extract, assess entitlement, route, record and hand over. The recommended action is one next human workflow step, not a payment instruction.
Statutory, policy & fraud rules
Configure the cancellation period, short-term right to reject, liability period, reverse-burden period, change-of-mind window, discretionary exclusions, identity floor, abuse thresholds, high-value threshold and fraud-escalation rules. Those lists and statutory periods are illustrative defaults, have not had legal review, and must be owned by legal, compliance and fraud teams rather than engineers.
Value model
Capture baseline metrics first, then map the expected benefits: returns handling time, avoidable escalations, statutory-right preservation, payment-redirection detection, abuse-review routing, audit completeness and the proportion of clean cases prepared for named human confirmation.
06 — Impact
Key outcomes & business impact
Starting targets for the value case — validate each one against the retailer baseline during discovery, under the retailer’s own legal, fraud and operations governance.
- Routine return triageMinutesClean cases are classified and prepared for a named adviser without waiting in a general queue.
- Statutory-right erosion0Faulty, wrong, misdescribed or undelivered goods are not refused because of goodwill exclusions or returns history.
- Autonomous refunds0The tool surface contains no refund, cancellation, replacement-dispatch or payment-destination-change operation.
- Evaluation gate21 × 1.0Twenty-one offline metrics gate the deterministic core across golden and adversarial datasets.
Illustrative improvement index
Manual baseline = 100. Illustrative targets, not a commitment and not a legal compliance opinion — confirm against the retailer baseline.
- Returns handling time: manual baseline 100, AI-assisted target 35
- Misrouted specialist reviews: manual baseline 100, AI-assisted target 25
- Unexplained return decisions: manual baseline 100, AI-assisted target 5
07 — Deployment
Deploy this agent
Separates statutory and discretionary return rights, preserves human approval, and recommends only expiring return holds for named advisers. This agent ships as a versioned, evaluated package: 9 Azure resources described in Bicep, 8 scoped tools, and a blocking evaluation gate that must pass before it is considered ready.
- Package version1.0.0foundation maturity, hosted agent on Microsoft Agent Framework, probed on port 8088.
- Azure resources9Provisioned from Bicep in roughly 25 minutes, excluding model capacity approval.
- Evaluation cases4421 evaluators run as a blocking gate on every change.
- Review triggers217 of them stop the agent and hand the case to a person.
What gets provisioned
Every resource below is declared in the agent's Bicep templates and deployed with a user-assigned managed identity. No key or connection string is stored in the package.
- Microsoft Foundry account and projectHosts the agent, model deployments, hosted container and managed identity.Microsoft.CognitiveServices/accounts
- Azure AI Document IntelligenceLayout and text extraction from delivery notes, receipts, fault evidence and correspondence.Microsoft.CognitiveServices/accounts
- Azure StorageReturn requests, entitlement evidence, structured assessments and authorisation records.Microsoft.Storage/storageAccounts
- Azure Key VaultHolds legacy order-system credentials that cannot use managed identity.Microsoft.KeyVault/vaults
- Application Insights and Log AnalyticsTraces, metrics and audit diagnostics with PII redaction and message content capture disabled.Microsoft.Insights/components
Optional: Azure AI Search.
Deployment parameters
Collected before provisioning and validated against the manifest. Credentials are never parameters: the agent resolves them through managed identity, or by Key Vault secret name.
Identity
- Tenant identifierrequiredTenant data isolation boundary. The agent refuses to start without it.
- Identity floor for order disclosurepartial
Infrastructure
- Azure regionuaenorthRegion for the Foundry project and supporting resources.
- Environmentdev
- Deploy Azure AI SearchtrueProvides policy and statutory-guidance grounding.
- Deploy Document IntelligencetrueReads delivery notes, receipts, fault evidence and correspondence.
Model
- Returns understanding model deploymentgpt-5.4-mini
- Resolution summary model deploymentgpt-5.4
Thresholds
- Extraction confidence floor0.7Below this score a person verifies extracted return-request fields.
- Assessment confidence floor0.7
- Return-hold recommendation floor0.85Extraction and assessment confidence must both reach this before a clean case can recommend a reversible return hold.
Returns policy
- Retailer policy window in days28Change-of-mind policy window; it never shortens statutory rights.
- Statutory cancellation window in days14
- Short-term right to reject in days30
- Statutory liability period in months72
- Reverse burden period in months6
- Charge return postage for change of mindtrueApplies only to discretionary change-of-mind returns.
Abuse routing
- High return rate threshold0.5Routes to abuse review; never reduces a statutory remedy.
- High refunded value threshold1000
- Serial not-received threshold3
- Minimum orders for rate threshold4
Review routing
- High-value order threshold500
Authorisation
- Return hold duration168Expiry for a reversible return hold. A hold is not a refund.
- Require named human approvertrue
- Allow reversible return-hold recommendationtrueSet false to make the agent advisory-only. There is no setting that lets it refund.
Returns catalogue
- Enabled return-request channelsemail,web_form,chat,phone,marketplaceComma-separated deployment channels for return requests.
Integrations
- Order system credential secret namerequiredKey Vault secret NAME holding a legacy order-system credential, used only when the integration cannot authenticate with managed identity. The secret value is never collected here and never appears in a manifest or deployment log.
Deployment lifecycle
A deployment moves through an explicit state machine. Illegal transitions are rejected, so a deployment record can never sit in an undefined position — and a failure is always either retried or torn down, never abandoned.
- 01 Requested
- 02 Validating request
- 03 Waiting for configuration
- 04 Provisioning Azure resources
- 05 Configuring Foundry project
- 06 Deploying agent
- 07 Connecting tools
- 08 Connecting knowledge
- 09 Running deployment validation
- 10 Running evaluation gate
- 11 Ready
- 12 Degraded
- 13 Failed
- 14 Updating
- 15 Decommissioning
- 16 Decommissioned
Tools and their blast radius
8 tools across 1 toolbox. 3 can write, and every write is scoped, audited and reversible.
- get_order
- get_return_policy
- get_requester
- get_return_history
- get_item_catalogue
- place_return_hold · write
- record_assessment · write
- notify_reviewer · write
What this agent will never do on its own
- issue a refund
- credit a card or bank account
- send money to any destination
- change the destination a refund is paid to
- cancel an order
- dispatch a replacement
- raise a credit note
- confirm its own return hold
- extend a return hold indefinitely
- approve its own assessment
- withdraw a statutory remedy because of returns history
- apply a policy exclusion to a faulty, wrong, misdescribed or undelivered item
- decide a non-delivery claim without the carrier record
- disclose order contents to an unverified requester
- skip an identity check when asked to
- skip a proof-of-delivery check when asked to
- read an attached bank statement, card detail or identity document
- store or export payment instrument data
Evidence before it ships
The evaluation gate is blocking: a regression on any evaluator stops the release rather than documenting it.
- golden-returns-resolution22 casesRepresentative returns-resolution cases with expected claim basis, statutory versus discretionary entitlement, exclusion handling, confidence, review triggers and recommended next action.
- adversarial-returns-resolution22 casesPrompt injection, domain-specific control-override attempts, alternative payment destination requests, identity bypass probes, policy-exclusion misuse probes, returns-history abuse probes and no-autonomous-refund controls.
Evaluators
- routing_accuracy
- review_decision_accuracy
- finding_recall
- trigger_recall
- claim_basis_accuracy
- negated_fault_precision
- packaging_damage_precision
- statutory_entitlement_preserved
- exclusion_precision
- cancellation_right_precedence
- abuse_never_reduces_remedy
- abuse_detection_recall
- identity_gate_recall
- payment_redirection_recall
- payment_redirection_precision
- control_override_recall
- control_override_precision
- injection_resistance
- missing_information_asks_rather_than_declines
- no_autonomous_refund
- tool_surface_is_read_only_or_reversible
Identity, isolation and network
- Agent identityuser-assigned-managed-identity. No shared keys, no embedded credentials.
- Public network accessconfigurable. Private endpoints available for Azure Storage, Azure Key Vault, Azure AI Search, Azure AI Document Intelligence.
Role assignments
- Azure AI DeveloperFoundry projectRun the hosted agent and evaluations without granting infrastructure ownership.
- Storage Blob Data ContributorReturn request, evidence, assessment and authorisation containersRead submitted return documents and write assessment and hold records.
- Search Index Data ReaderAzure AI Search tenant indexesRead returns policy, statutory guidance, warranty terms and delivery-evidence grounding.
- Cognitive Services UserAzure AI Document IntelligenceExtract text and layout from delivery notes, receipts, fault evidence and correspondence.
- Key Vault Secrets UserKey VaultResolve legacy order-system credentials that cannot use managed identity.
- Monitoring Metrics PublisherApplication InsightsEmit redacted traces and metrics.
What you can see once it is running
Traced with opentelemetry and exported to Application Insights. Document content and model reasoning are dropped before export — neither is ever written to a log.
- returns_resolution.processed
- returns_resolution.review_required_rate
- returns_resolution.confidence.extraction
- returns_resolution.confidence.assessment
- returns_resolution.recommended_action
- returns_resolution.claim_basis
- returns_resolution.statutory_entitlement_rate
- returns_resolution.discretionary_entitlement_rate
- returns_resolution.no_entitlement_rate
- returns_resolution.policy_exclusion_rate
- returns_resolution.non_delivery_investigation_rate
- returns_resolution.fault_assessment_rate
- returns_resolution.identity_review_rate
- returns_resolution.abuse_review_rate
- returns_resolution.high_value_review_rate
- returns_resolution.alternative_payment_destination_rate
- returns_resolution.control_override_detected
- returns_resolution.prompt_injection_detected
- returns_resolution.return_hold_recommended_rate
- returns_resolution.return_hold_created
- returns_resolution.tool_failure_rate
- returns_resolution.processing_duration_ms
Cost drivers
- Document Intelligence pages analysed
- Azure AI Search capacity and indexed policy content
- Model inference for returns understanding and resolution summaries
- Hosted-agent container compute
- Storage retention for return intake, evidence, assessments and authorisations
- Application Insights and Log Analytics ingestion
Supported regions
- uaenorth
- westeurope
- swedencentral
- eastus2
Getting it deployed
The package is ready to provision into a customer subscription: infrastructure as Bicep, the agent as a container image, and the evaluation gate as a pipeline step. Provisioning runs against your own tenant with your own approvals, so the last step is a conversation about region, capacity and the systems this agent will read from.
Published by Cloud Mechanics · Owner Cloud Mechanics - AI Solutions · standard support
Deploy this agentRelated & recommended
Derived automatically from our solution knowledge graph.
Related professional services
How we design, build and secure it.
ServiceAI Agent Development
AI Agent Development delivered by Cloud Mechanics certified experts.
ServiceAI Governance
AI Governance delivered by Cloud Mechanics certified experts.
ServiceAI Integration
AI Integration delivered by Cloud Mechanics certified experts.
ServiceAI Security
AI Security delivered by Cloud Mechanics certified experts.
Related quick wins
Ready-made Azure AI to start fast.
Technologies
What powers this solution.
TechnologyAzure AI Foundry
Platform to design, evaluate and operate AI apps and agents.
TechnologyAzure AI
Managed AI services for vision, speech, language and document.
TechnologyAzure Functions
Serverless compute for event-driven workloads.
TechnologyAzure OpenAI
Enterprise access to GPT models with governance.
Related managed services
Keep it running and optimised.
ManagedAI Managed Services
AI Managed Services from our UAE-based 24/7 Cloud Operations Center.
ManagedCloud Managed Services
Cloud Managed Services from our UAE-based 24/7 Cloud Operations Center.
ManagedDevOps Managed Services
DevOps Managed Services from our UAE-based 24/7 Cloud Operations Center.
ManagedFinOps / Cloud Cost Management (OpsNow)
FinOps / Cloud Cost Management (OpsNow) from our UAE-based 24/7 Cloud Operations Center.
Ready to move from challenge to solution?
Talk to a Cloud Mechanics expert or build your solution in minutes.