The AI Exchange: Innovators in Payment Security Featuring Shopify

Welcome to the PCI Security Standards Council’s blog series, The AI Exchange: Innovators in Payment Security. This special, ongoing feature of our PCI Perspectives blog offers a resource for payment security industry stakeholders to exchange information about how they are adopting and implementing artificial intelligence (AI) into their organizations.  

In this edition of The AI Exchange, Shopify Lead Security Engineer, Amir Pourafshar, offers insight into how his company is using AI, and how this rapidly growing technology is shaping the future of payment security. 

How has your AI strategy evolved over the past 12-18 months?

Shopify has moved from AI as an optional productivity tool to AI as a core operating principle. In April 2025, our CEO Tobi Lütke, publicly stated that reflexive AI usage is a baseline expectation across all functions and backed that up by integrating AI proficiency into our performance review cycles. The question shifted from "are you using AI?" to "why aren't you using AI for this?"

For security and PCI compliance specifically, the evolution has been dramatic. Eighteen months ago, we were using AI primarily for documentation assistance — summarizing standards, drafting policy language, and generating templates. Today, we operate multi-agent systems that support our security and compliance operations end-to-end: assisting code review, flagging compliance-relevant discussions for human follow-up, and accelerating evidence production for our assessments.

The strategic shift is from AI-assisted to AI-native. We don't bolt AI onto existing workflows; we redesign the workflow around what AI makes possible, then add human verification at the decision points that matter. Our PCI compliance programs now operate with a fraction of the manual effort they required two years ago, while producing more thorough, more consistent, and more auditable outputs.

What made this possible wasn't just better models, it was investing in the underlying infrastructure: centralized governance for internal AI usage, agent integrations with our engineering and collaboration tooling under appropriate authentication and access controls, and a culture where security teams are expected to be among the most advanced AI users in the company, not the most conservative. 

What is one AI initiative that has already delivered a measurable impact within your organization, and what made it successful?

Our AI-powered compliance monitoring system, what we internally call the "Certification Compliance Monitor Agent", has become indispensable to how we run PCI assessments.

The system continuously monitors our internal compliance channels, scanning hundreds of messages daily across PCI-related Slack channels, and produces structured reports that flag incorrect statements, misleading interpretations, unanswered compliance questions, and terminology errors. It catches issues before they surface in products and functions.

Since we started using the agent in our PCI work, it has already flagged issues that would previously have depended on a human reviewer noticing the right Slack thread at the right time. For example, it identified a proposed deployment-process change that would have created a separation-of-duties gap under PCI DSS, surfaced a physical-security assumption that would have delayed infrastructure work for a new compliance program, and caught key custodian access settings that did not match our documented procedures. All caught early and never materialized.

That has changed the timing and quality of our compliance work. Instead of discovering these issues during technical design reviews, quarterly reviews, or QSA interviews, when the fix creates rework and slows the assessment, we now catch many of them during the discussion phase. That lets us correct the assumption, bring in the right owner, and resolve the issue within hours rather than carrying it into the formal assessment process.

What made it successful was scope discipline, and that was a deliberate decision rather than just where we happened to stop. The seductive version of this project is an AI that "does compliance". It reads the standard, reads your environment, and renders a verdict. That version looks so achievable in a demo that it's easy to get carried away and try to build it. We chose not to.

Instead, we drew a hard line. The AI's job is to monitor conversations for factual accuracy against published standards and surface discrepancies for a human to adjudicate. It never renders the compliance decision itself.

What changed is not mainly speed. Before, checking a claim against the standard depended on a reviewer remembering the right requirement and choosing to go look it up, so subtle drift in a long conversation could pass unnoticed. The agent checks every claim against the published text and surfaces each discrepancy with the exact source passage attached. That does two things a manual review struggles to do at once: it catches errors a human skim might miss, and it puts the relevant standard in front of the reviewer, so the human adjudicates from the source rather than from memory.

The reasoning behind keeping it this narrow is simple. A compliance decision carries accountability, and accountability can't sit with a model. The moment the AI is making the call rather than informing it, you've built something you can't stand behind in front of an assessor. Keeping it to "surface, don't decide" also makes the failure mode cheap. A bad flag costs a reviewer a second look, where a bad decision would cost the integrity of the program. 

With that success behind us, we've taken the same approach to a second problem: evidence production for a new compliance program we had recently stood up, distinct from our established PCI DSS program and its current attestations. AI agents draft policy language and gap analysis against the standard, a human analyst validates and submits, and in that program's first evidence sprint we completed a material portion of the requirements in a week, something that might have taken several weeks without the support of AI. 

One important lesson is that AI-generated compliance content needs aggressive quality control. During a policy addendum review we caught a few fabrications such as plausible-sounding verification artifacts that either overstated our current configuration or cited sources that didn't exist. These weren't sloppy errors. They were embedded in otherwise well-structured, correctly formatted, confident output, and that smooth integration is what makes them dangerous. A fabrication that reads like everything around it is harder to catch and more likely to be trusted, which is exactly when a wrong claim does the most damage. So, we now run a fabrication check as a standard step before any AI-assisted content goes for formal review. In practice, that's a human verification pass. Every factual claim about our environment has to be traced back to a real, current source before it can stay in the document, and anything that can't be traced is cut or corrected. We feed what we catch back into the prompts and agent guardrails, so the same class of error gets rarer over time. AI gets us to the draft faster. The human owns whether we can stand behind it.

How are you approaching AI governance, particularly around data privacy and security?

Our AI governance operates on a distributed, principle-based model anchored by a few non-negotiable rules:

Data boundaries come first: Our requirement is that Shopify data is not used to train third-party models, and we implement that contractually with the providers behind our primary AI tooling. Where a tool cannot meet that bar, we restrict what data can reach it rather than make an exception. Third-party AI tools are reviewed and approved before use, with the approval threshold scaled to spend and risk, and tracked in our vendor governance platform.

Centralized governance for internal AI usage: Rather than letting each team wire up its own access to models, internal traffic for primary AI tooling runs through a single governed path. That one enforcement point buys us three things we couldn't get if governance were spread across every team. First, we have an authoritative view of where AI is being used on that path and at what volume. Second, data-protection controls are applied at that boundary, so the rule that sensitive data stays out of third-party models is enforced once rather than reimplemented, and missed, team by team. Third, when we need to restrict a model, change a policy, or add a safety control for traffic on that path, we do it in one place. Not every AI capability rides that path. AI features built into other licensed or team-specific tools may be governed through vendor review and contractual terms instead. Keeping the central route the default is what keeps that second category small and known, and it means our commitments about AI data handling on that path are things we can demonstrate and audit, not just things we ask teams to honor.

AI features go through the same review as any other launch, and safety is built into the design: Anything handling personal data clears the same privacy impact assessment and security review as any product launch. What the design has to add is a safety layer that sits above the instructions the system receives at runtime, so a user prompt, a crafted input, or the model's own reasoning cannot override it, along with a bounded scope and a human handoff for actions that carry real consequences. Safety has to be structural, not a matter of the model choosing to comply.

Andrew Dunbar, our CISO, puts it plainly: "Responsibility can't be delegated, it can only be shared." Working from that principle, we've developed operating rules that govern what AI agents can and cannot do in our environment. They include hard prohibitions on destructive operations, secret exposure, and production modifications, plus mandatory stop-and-ask patterns for any change that touches sensitive data. We continue to validate those boundaries through ongoing security testing.

The philosophy is "green path" design: make the secure defaults easy, make deviations visible, and never let the pace of AI adoption outrun the security architecture that governs it. 

What challenges have become more apparent as AI capabilities have matured?

1. The fabrication problem is real and underappreciated in compliance. AI models produce confident, well-structured outputs that cite specific requirement numbers and use correct regulatory terminology. But sometimes the citations are wrong, the requirement numbers are invented, or the interpretation is subtly off. In a compliance context, acting on a fabricated requirement reference during an assessment can be worse than having no answer at all. So, we build systematic fabrication checks into every AI-assisted compliance workflow, and we treat an AI answer as a claim to verify, not a conclusion to act on. A model citing a requirement number is where the work starts, not where it ends. 

2. The attack surface is expanding faster than the defenses. Accuracy is one side of the problem. The other is that the AI systems themselves are now something to defend. Agents that connect to internal tools, process unstructured content, or ingest external data create new paths for prompt injection, where hostile input can steer an agent into doing something it shouldn't. Defending this takes detection at the infrastructure layer plus ongoing testing of where an agent's boundaries actually hold, and across the industry that defensive tooling is still maturing. 

3. Governance at scale requires infrastructure, not just policies. Writing an acceptable-use policy for AI is easy. Enforcing it at the scale of thousands of engineers building agents and handling data of every sensitivity level is the hard part. A policy document only works if people read it and follow it, which doesn't scale. What scales is building the rules into the path itself, so the governed way is the default way: model access is provisioned centrally rather than team by team, tool approvals are gates rather than guidelines, and usage is visible centrally. 

4. Broad AI adoption moves faster than traditional compliance. Across the industry, AI use is spreading through every function faster than compliance processes were built to absorb, and Shopify is no exception. Adoption runs on one clock, and assessment cycles run on another. A compliance function working at its old pace becomes the constraint on delivery, so we applied AI to our own work, the accuracy monitoring and evidence drafting described above, which moves the catch from the assessor interview to the discussion that preceded it and surfaces issues while a design is still being discussed, when the fix costs a conversation instead of rework. We also put the safe path into the infrastructure, so the governed route is the default route, and the easiest way for a team to use AI is already the compliant way. Staying compliant doesn't require slowing anyone down. 

What advice would you provide for an organization moving from early AI adoption to broader implementation?  

Start with your compliance operations, not your compliance policies. Most organizations approach AI in compliance by asking "what policy should we write about AI?" The better question is "which of our existing compliance processes can AI make 10x more efficient?" We found that evidence production, control monitoring, policy gap analysis, and assessment preparation are all dramatically improved by AI; and using AI there gives your team the fluency to credibly govern AI usage across the rest of the organization.

Build the infrastructure before you need it. A centralized AI gateway for traffic across the enterprise, a tool approval workflow, data classification controls, and agent-level access management aren't exciting. But the alternative, fifty teams each choosing their own AI tools, connecting them to production systems, and processing sensitive data through different models with different data handling agreements, is a governance nightmare. The infrastructure investment pays for itself the first time you need to switch models, update a policy, or respond to a data handling incident.

Pair every AI agent with a human verification point and be specific about what the human is verifying. "Human in the loop" is too vague. We define exactly what the human reviewer checks: requirement citations verified against the published standard, configuration details confirmed against actual system state, no fabricated entities or procedures, and the output actually answers the question that was asked. Without this specificity, "human review" becomes a rubber stamp.

There's a maturity arc worth naming. Today the human reviews every AI output, which is the right default while you're building trust. But the goal isn't a human checking every line forever. It's to earn your way, on a risk basis, to human over the loop: the human supervises the system and steps in by exception. You get there one control at a time, starting with the lowest-risk steps, and only once you can show the AI is at least as reliable as the human process it replaces, with the tooling to prove it and catch the misses. Accountability never leaves the human. What changes is whether they verify every output or govern a system they can demonstrate is trustworthy.

Make your security team the AI power users. If your security and compliance team is the most conservative AI adopter in the organization, you've lost the ability to lead. Our team builds multi-agent compliance systems, runs AI-assisted evidence production, and uses AI for daily operations. That credibility is what lets us set effective guardrails for everyone else. We know what AI can and can't do because we push its limits every day. 

What AI trend (not limited to payments) are you most excited about?  

The convergence of agentic AI and open commerce protocols. Shopify co-developed the Universal Commerce Protocol, an open standard that governs how AI agents connect and transact with merchants, supported by major retailers, payment networks, and technology companies. This isn't AI as a feature bolted onto existing checkout flows; it's a fundamental reimagining of how commerce happens when the buyer's first interaction is with an AI agent rather than a browser.

For the payments security community specifically, this shift opens questions the industry hasn't settled. UCP defines how agents connect and transact, but on its own it doesn't answer the security questions that agent-first commerce raises. How should an AI agent, acting on behalf of a buyer, be authenticated? How do fraud detection models adapt when the "user behavior" is algorithmic, not human? How do existing compliance frameworks apply when machine-to-machine commerce is part of the cardholder data environment? These are the questions that will shape the next generation of payment security standards.

The bigger point is timing. Standards that move early stay enablers of better, safer commerce for everyone. Standards that wait age quickly and become a slowing factor, forcing the industry to route around them rather than build on them. The window to get ahead of agentic commerce is now, while the patterns are still forming.

What excites me most is that PCI SSC is already engaging with these questions rather than waiting for the industry to outrun the standards. The Request for Comments on PCI DSS v4.0.1 explicitly invited feedback on AI innovation, which signals that the Council recognizes this isn't a future concern; it's a current reality that standards need to accommodate.

The organizations that figure out how to enable AI-native commerce while maintaining strong security controls won't just be compliant; they'll be the ones defining what compliance means in an agentic world.