Storefront Operation Policy

cXML setup and OCI requests can describe the buyer's intent as create, edit, inspect, detail or detail_add. The frontend operation policy uses that value to decide which Magento full-action names may run while the PunchOut token is active.

Supplied behavior

• create permits every action by default (*), so the buyer can browse and build a new cart.
• edit permits normal catalogue and cart editing by default. Magento reconstructs an isolated quote from the supplied ItemOut lines and recalculates them in the mapped customer context.
• inspect reconstructs the supplied cart but presents it as read-only. Quantity, edit, remove, wishlist, coupon, shipping-estimate, cross-sell and checkout controls are not rendered. The cart and minicart retain viewing and Return to System actions.
• detail opens the product resolved from OCI PRODUCTID without starting a normal cart-building flow.
• detail_add opens the resolved product, permits one successful Add to Cart action and immediately returns that single line to the procurement system.

In a DETAIL session the exact product remains visible for inspection, while the normal Add to Cart action is unavailable.

DETAILADD enables that action only for the resolved product and completes the return after the first successful add.

The difference is visible in the storefront: EDIT retains quantity and item controls, while INSPECT displays the same reconstructed lines without mutation or checkout actions.

When a route is not allowed, Magento redirects to the configured landing route, which defaults to checkout/cart.

Change a policy safely

Open Stores > Configuration > MageB2B > Punchout > Operation Policy.

1. Capture the exact Magento full-action name, such as catalog_product_view or checkout_cart_index.
2. Add it only to the operations that need it.
3. Separate entries with semicolons, commas or new lines.
4. Test direct navigation, product search, cart changes and Return to System for every enabled operation.

Do not enter URL paths such as /catalog/product/view. The guard compares normalized full-action names. An incorrect list can redirect a buyer away from a required page without changing the underlying role or customer permission.

The policy is a storefront-flow control. It does not replace buyer authentication or Magento catalog permissions. Integrations can extend actor and permission resolution through the module's public service contracts and events.