Governance and risk in e-commerce and retail
23 September 2026

Governance and risk in e-commerce and retail


Enforcing permission at retrieval in e-commerce and retail helps prevent unauthorised access to sensitive data, by ensuring only authorised personnel, such as the category manager or shift supervisor, can access specific information, and companies can track what was asked, what was returned, and on what data.

On a typical Monday morning, the category manager checks the sales performance of the latest product assortment, trying to understand what drove the unexpected surge in demand for a particular item, while the shift supervisor is dealing with a flurry of customer returns, attempting to identify the root cause of the problem, and the marketing team is analysing the effectiveness of the recent promotion, all of which can be complex and time-consuming tasks, especially when using enterprise AI systems like AsscherAi to inform their decisions.

Complexities of e-commerce and retail

The fast-moving nature of e-commerce and retail assortments, combined with the direct signal from customers, makes it challenging to implement effective controls, as the category manager needs to make quick decisions about product offerings, pricing, and inventory, while the shift supervisor has to handle returns and customer complaints in a timely manner, and the marketing team must assess the impact of promotions on sales and customer engagement, all of which can be difficult to manage without the right systems and processes in place.

For instance, when a new product is launched, the category manager needs to monitor its performance closely, taking into account factors such as seasonality, customer preferences, and competitor activity, and make adjustments to the assortment as needed, which can be a complex task, especially when using AI-driven systems to inform their decisions, and may require additional support and guidance to ensure that the right decisions are made.

The returns process is another area where e-commerce and retail companies face challenges, as the shift supervisor needs to identify the root cause of returns, whether it is a product quality issue, a sizing problem, or a customer expectation mismatch, and take corrective action to prevent future returns, which can be time-consuming and require significant resources, but is essential to maintaining customer satisfaction and loyalty.

Enforcing permission at retrieval

One approach to addressing the complexities of e-commerce and retail is to enforce permission at the point of data retrieval, rather than relying on the model to instruct users on what they can and cannot access, which can be problematic, as the model may not always understand the nuances of human decision-making, and may provide access to sensitive information that should be restricted, and by enforcing permission at retrieval, companies can ensure that only authorised personnel have access to sensitive data, and that the right controls are in place to prevent unauthorised access or misuse of data.

This approach requires careful consideration of the roles and responsibilities of different users, such as the category manager, shift supervisor, and marketing team, and the types of data they need to access to perform their jobs effectively, and companies must ensure that the right permissions are in place, and that users understand their responsibilities and the consequences of accessing or sharing sensitive information without authorisation, and for more information on how to implement this approach, users can visit the AsscherAi website.

Auditability

Auditability is another critical aspect of enterprise AI governance in e-commerce and retail, as companies need to be able to track what was asked, what was returned, and on what data, in order to ensure that the system is functioning correctly, and that users are accessing and using data in a responsible and authorised manner, and this requires careful logging and monitoring of system activity, as well as regular audits to ensure that the system is compliant with relevant regulations and standards.

For example, when the category manager uses AsscherAi to analyse sales data, the system should log the query, the data used to answer the query, and the results returned, and this information should be available for auditing and reporting purposes, to ensure that the system is being used correctly, and that the right controls are in place to prevent unauthorised access or misuse of data, and companies should also consider implementing additional controls, such as data encryption and access controls, to further protect sensitive information.

Routing to a human

There are certain categories of queries that should always be routed to a human, rather than being answered by the AI system, such as queries that involve sensitive or confidential information, or queries that require a high degree of nuance or judgment, and companies should carefully consider what types of queries should be routed to a human, and ensure that the right processes and procedures are in place to handle these queries effectively, and for more information on how to implement this approach, users can contact AsscherAi support.

For instance, when a customer contacts the shift supervisor with a complaint about a product, the query should be routed to a human, rather than being answered by the AI system, as it requires a high degree of nuance and judgment to resolve the issue effectively, and the shift supervisor needs to be able to empathise with the customer, and provide a personalised response to address their concerns, which may not be possible with an AI system.

Limitations of this approach

While the approaches outlined above can help to address the complexities of e-commerce and retail, they are not a silver bullet, and companies should be aware of the limitations of this approach, such as the need for significant investment in technology and processes, and the potential for errors or biases in the AI system, and companies should carefully consider their specific needs and requirements, and ensure that they have the right resources and expertise in place to implement this approach effectively.

For example, companies may need to invest in additional training and support for users, such as the category manager and shift supervisor, to ensure that they understand how to use the AI system effectively, and that they are aware of the potential limitations and biases of the system, and companies should also consider implementing additional controls, such as regular audits and monitoring, to ensure that the system is functioning correctly, and that the right controls are in place to prevent unauthorised access or misuse of data.

Frequently asked questions

What is the main challenge in implementing effective controls in e-commerce and retail?

The fast-moving nature of e-commerce and retail assortments makes it challenging to implement effective controls, as decisions need to be made quickly.

How can companies ensure that only authorised personnel have access to sensitive data?

Companies can enforce permission at the point of data retrieval, rather than relying on the model to instruct users on what they can and cannot access.

What is the importance of auditability in enterprise AI governance?

Auditability is critical to ensure that the system is functioning correctly, and that users are accessing and using data in a responsible and authorised manner.

When should queries be routed to a human rather than being answered by the AI system?

Queries that involve sensitive or confidential information, or require a high degree of nuance or judgment, should always be routed to a human, such as a shift supervisor handling customer complaints.