The short answer

Separate general policy answers from private order lookups. Use reviewed knowledge for policies and an authorised server-side connection for live order data. When the bot cannot resolve a request, create a helpdesk task with the relevant context and keep a person responsible for the next step.

The connected workflow

Reference design · Proposed steps to validate in a pilot, not a deployed customer case study.

  1. Customer asks

    Classify whether the question is general or needs access to an individual order.

  2. Access checked

    Use the shop’s approved customer verification flow before returning private information.

  3. Source selected

    Retrieve policy text from approved knowledge or current order status through an authorised lookup.

  4. Answer or handoff

    Explain the verified status or open a staff task when information is missing or conflicting.

  5. Outcome saved

    Record the case state and owner without automatically closing an unresolved ticket.

  6. Knowledge reviewed

    Send recurring unanswered questions to a content owner for a reviewed policy update.

What each tool does

Shopify
An example commerce system holding the authoritative order state. Use the supported API and approved access scopes.
Chatbot platform
Select a platform with grounded answers, authenticated server-side actions and a usable human handoff.
n8n / integration backend
Validate requests, call approved tools and synchronise the outcome with the helpdesk.
Helpdesk + policy library
Staff own exceptions; reviewed policies supply reusable answers. These serve different purposes.

Separate two sources

Shipping policy belongs in a versioned knowledge base. The current status of an individual parcel belongs in the order or fulfilment system. A policy document cannot establish whether a specific order shipped today. Define which questions need live data and which can be answered from approved documents before choosing the chatbot.

Verify the customer

Use an authenticated customer session or another approved verification flow. An order number alone should not unlock a stranger’s address or purchase history. Enforce access on the server for every lookup, not just in the agent’s instructions. Return only the fields needed to answer the question and avoid collecting payment-card details in chat.

Connect order information

Give the bot a narrow lookup action rather than unrestricted store access. Read the current order through the supported commerce API before making a time-sensitive claim. Shopify webhook delivery can support background synchronisation, but event delivery needs duplicate handling and reconciliation. Treat a cached record as potentially stale and make an unavailable lookup visible to staff.

Make the answer specific

If the verified system only says “fulfilled”, do not invent a delivery date. Where an approved tracking link is available, return it with the status and explain what is known. Distinguish a general delivery estimate from a carrier-confirmed event. For refunds and cancellations, use a separate authorised workflow; answering a question should not silently trigger a financial action.

Create a useful handoff

When a parcel appears lost, an identity check fails or a policy is unclear, open or update the helpdesk case. Include the permitted order reference, the question, checks already completed and the next action. Assign an owner or queue and explain the next step to the customer. A ticket is not resolved merely because the chatbot conversation ended.

Improve approved knowledge

Review repeated gaps with the policy owner. Create a reusable answer without customer details, record its source and effective date, then test it against normal questions and exceptions. Replace superseded policy text. Do not automatically feed raw support transcripts into shared knowledge: they can contain personal data, customer claims and answers that were later corrected.

Prove the boundaries

Test a valid order, a guessed order number, stale tracking, conflicting policies, a failed API call and a repeated helpdesk request. Ask the bot to ignore its rules and reveal another customer’s order; server-side authorisation must still reject it. Measure correct answers, appropriate handoffs, unresolved cases and repeat contacts. Lower staff workload only counts if customers still get an accurate resolution.

Common questions

Do we need AI for every order question?

No. A verified order-status page or rule-based reply may cover predictable requests. Add conversational AI where it helps interpret varied questions and choose the right approved source.

Can the bot learn from support conversations?

Conversations can reveal missing topics. A content owner should review and approve new reusable answers before publication. Customer-specific facts remain in the authorised customer or ticket record.

Sources & scope

Provider documentation checked on 20 October 2026. The workflow is our proposed implementation design; platform features, plans and integrations must be confirmed for your project.

Your next step

Tell us your store platform, helpdesk and most common support questions. We can identify which steps need a bot, which need a simple workflow and how the tools should connect.

Explore the related solution

Keep reading