AI agents are about to ask permission. Decide what you’ll say yes to.

SPECIAL EDITION · HOW AGENTS SHOP

This week is a special edition on the new rules for letting AI agents into your store. But first, the week’s trending news.

Trending news of the week

1. Retailers are choosing how far to let agents in

PYMNTS reports that QVC and HSN let AI agents complete purchases, while Kohl’s doesn’t let them buy. Tapestry allows Coach and Kate Spade orders through Google’s AI Mode and Gemini, with the shopper’s approval each time, but not on its own sites. Walmart lets Gemini show its products, then hands the basket to its own assistant, Sparky.

So “allow agents or block them” is no longer the only choice. Large retailers already set a level of access per channel, through contracts and custom integrations. What has been missing is a shared way to say so.

Read more: AI Agents Knock. Retailers Decide How Wide to Open the Door (PYMNTS) →

2. American Express tells merchants to check whether they can see agents at all

On October 6, American Express released a free playbook for agent shopping, set up a pilot merchant advisory council and repeated its plan to cover charges caused by errors from “registered” AI agents (the terms aren’t public yet). Its most useful line is the plainest: “merchants may not have full visibility into whether a transaction has come in through an AI agent.”

Amex suggests asking your payment processor and commerce platform before changing anything, and warns that controls built to stop harmful bots “may also encounter legitimate AI agents acting for customers.”

Read more: Amex Business Playbook for Agentic Commerce (American Express) →

3. Mastercard adds a “know your agent” score

On October 8, Mastercard said it is adding identity and fraud signals to Agent Pay, its agent payments programme. One is a score telling the card issuer how likely it is that a legitimate AI agent is on the site. Merchants can weigh it, along with details about the agent and the person behind it, when approving a purchase.

All three stories make the same point: before anyone can set rules for agents, someone has to know which agent is shopping, and for whom.

Read more: Who’s behind the AI agent? (Mastercard) →

Amazon blocked Meta’s agent. Two weeks later, Meta helped propose the front door.

Meta launched Muse, its personal AI agent, on September 8. Twelve days later, Amazon stopped it from placing orders on Amazon.com. Amazon’s complaints, as reported by Adweek, were specific: it hadn’t agreed to Muse shopping on its store, Meta hadn’t told it, and Muse didn’t identify itself when it browsed. Amazon told Gizmodo that agents buying for customers “should operate openly and respect service provider decisions about whether or not to participate.”

On October 6, Meta and Sierra, the customer-service AI company co-founded by Bret Taylor, announced the Personal Agent Protocol, an open standard for how personal agents deal with businesses. Its first principle: “consumers decide what access to give their personal agents, and companies set parameters for what those agents can do.” Three days later, Sierra published the first draft, nicknamed Poppy, which says agents always identify themselves, “so the company always knows when an agent is acting for a customer.”

Meta hasn’t linked the two events, and we won’t either. But together they show the problem. Today a store has two options when an agent arrives: let it pass as the shopper, or block it. It can’t set rules for a visitor it can’t recognise. The protocol offers a third option: the agent says who it is, and the store decides what it may do.

My short answer for store owners: this is the first serious proposal that has your store set the rules instead of finding out afterwards. It’s a first draft, so don’t build anything yet. But the decisions it asks for don’t depend on the final version, and they’re worth making this month.

What was announced, and who has signed on

• Personal Agent Protocol (“Poppy”), from Sierra and Meta. Announced October 6 with Genesys, Instinct, Rocket, Shopify, Stripe and Walmart. On October 9, Sierra published draft 0.1 under an open-source licence and added 35 “design partners,” including OpenAI, Visa, Mastercard, PayPal, Target, Gap Inc., Nordstrom, Cloudflare, Okta and Zendesk. Workshops and a sample implementation for developers are due within a month.
• PACT, from Decagon and Instinct. Also October 6. Decagon builds customer-service AI agents for brands. PACT covers what happens when a shopper’s agent talks to a brand’s agent: each business lists the actions it allows, with names like “orders:read” and “orders:cancel,” and each action comes back with a signed receipt. Decagon is joining the Personal Agent Protocol group, so read PACT as an early, more detailed take on one part of it.

Amazon, Google, Microsoft and Anthropic aren’t on either list, several partners back competing efforts, and being a design partner isn’t the same as adopting. “Industry-wide” is the ambition, not the current state.

The permission ladder

The protocol is easiest to understand as a ladder. Each rung gives an agent more access to your store, and you decide how high each agent may climb.

Take one shopper and one request: “The sweater I ordered last week came in the wrong size. Swap it for a medium.”

The shopper decides how much access to give; the store decides the most any agent can have. The draft defines two basic permissions, read and write, and lets stores add their own, such as saved addresses. Either side can disconnect, and a store can switch off an agent app that misuses the protocol.

The ladder doesn’t fix whether your answers are right. Rung 1 settles who is asking about stock, not what your site tells them. In September, our tracker caught two agent answers describing sweaters as in stock when the store’s own pages showed them unavailable. An agent that identifies itself can still read the wrong stock level.

What this means for your store

You set the top rung, and you can set it per agent app. This “opt in on your terms” part is real in the draft. A store can offer signed-out access only, allow reading but not changes, or keep lists of agent apps it allows or blocks. Tapestry, Kohl’s and Walmart make these choices today through deals with each AI company; the protocol would let a smaller store state them once, in one file on its own site.

But opting in isn’t today’s default. If you sell on Shopify, you may already be in. Shopify enrols eligible stores in new AI shopping channels automatically: it shared catalogues with Meta when Muse launched and switched on direct checkout by default for several AI apps. You can turn this off, but catalogue sharing can take up to seven days to stop. The protocol describes a choice; your platform settings describe what is happening now.

The protocol only helps with agents that use it. The draft says nothing about agents that don’t, which is exactly what the Amazon dispute was about. Until most agent makers adopt it, your bot and fraud controls need to tell apart agents that identify themselves, agents that don’t, and ordinary scrapers. That’s the Amex advice too: don’t lower your defences, but find out whether they recognise a legitimate agent.

Three ways in, two kinds of agent

The protocol lets a store choose how each task reaches it: through its website, its systems directly, or its own customer-service agent. Each choice suits a different kind of agent.

Your website. The agent uses your normal pages. This is how browser agents such as Claude in Chrome, Comet’s agent mode and Muse’s built-in browser work today. It’s tempting to think this route is free once your product data is well structured. The draft says otherwise: a signed-in agent needs a sign-in hand-off, and your pages have to apply the shopper’s permissions, so a page that lets people change the card on file must refuse an agent without that permission. Without the hand-off, agents browse “as ordinary signed-out visitors” and nothing changes. It’s the cheapest place to start, but it is still engineering work.

Your systems directly. The agent skips your pages and uses an API or an MCP server. MCP (Model Context Protocol) is a common way to give an AI app a ready-made set of actions, like “look up order” or “start return,” without it reading web pages. This is how connected agents like Muse prefer to work: Meta says Muse uses an API where one exists and falls back to a browser where it doesn’t, and I’ve seen that fallback in my own testing. It’s faster and more reliable for the agent, but the agent never sees your product page, recommendations or sponsored placements. Our ad study last month found the same with connectors: they go around the page where the ads are.

Your own customer-service agent. The shopper’s agent talks to yours. For messy tasks like a warranty claim, that may be the best option.

My view: every merchant, and Shopify merchants especially, should look at their agent settings now rather than wait for the protocol. Find out what is switched on by default. Then ask your platform, payment processor and bot-protection provider for numbers on agent traffic: which agents arrive, what they try to do and what gets blocked. Those numbers tell you where to set each rung, whether today with your platform’s switches or later in a protocol file.

What store owners should check

• Write your ladder on one page. For each rung, list what a named guest may see, what a signed-in agent may read, which changes it may make, and what it may never do, such as change payment details. This doesn’t depend on the final spec.
• Check your defaults. If you sell on Shopify, open your agentic channel settings and see what is switched on, including direct checkout.
• Ask for the numbers. Ask your platform and bot-protection provider to report agent visits and attempts: which agents arrived, what they tried to do and what was blocked. Also ask whether they can tell an agent that identifies itself from one that doesn’t.

About this piece

This is an analysis piece, not a study, based on Sierra’s October 6 announcement, the Personal Agent Protocol draft 0.1 and design-partner list published October 9, Decagon’s October 6 PACT announcement and public specification, and the reporting linked above. Partner lists are as published on those dates.

We have not tested either protocol, and we have not yet seen a consumer agent use one in the wild. The draft will change. Payments, finer per-action permissions and how stores should treat agents that don’t use the protocol are all unresolved.

The sweater example comes from our Commerce Tracker on September 15–16, 2026: two agent answers described sweaters as in stock when the captured store pages showed them unavailable. These are examples, not a rate.

If you’re writing your own permission ladder, or already talking to agent makers about access, I’d be interested to compare notes. Subscribe free to How Agents Shop to follow our next tests.