---
title: "Architecture and Request Flows"
summary: "See how Shopar tools preserve the user's identity, send requests to backend services, and rely on server-side authorization."
canonical_url: https://shopar.app/agents/docs/en/architecture/
status: available
audience: people,agents
language: English
last_updated: 2026-10-08
---

# Architecture and Request Flows

See how Shopar tools preserve the user's identity, send requests to backend services, and rely on server-side authorization.

## Current CLI flow

An operator runs the CLI locally and signs in to their own Shopar Admin session with an email code. The CLI sends defined gRPC operations to Shopar's backend. The backend checks the active session and current role; business rules and audit records stay on the backend.

- The operator and CLI use the same Shopar identity.
- The CLI does not connect to the database or decide permissions.
- Backend authorization and field validation apply to every RPC.

## Future agent flow

In a planned MCP flow, a compatible agent would send requests through a Shopar tool that an operator explicitly connects. The tool would pass the request to the backend using the operator's current Shopar identity. MCP transport and session design are still in progress; this describes a future state, not a live feature.

## Source of truth

Shopar backend services backed by PostgreSQL are authoritative for users, catalog, permissions, and financial records. A client or agent must not treat its own cached copy as authoritative or try to bypass backend checks.