People are starting to dispatch AI agents to do things for them online: Buy the groceries, publish the flight, inspect the financial institution balance. The delegate goes to the business’s website and acts in the customer’s place. Every endeavor now has to decide what to do whenever one shows up, and in October three big ones answered three distinct ways.
I think Walmart got it right: It is concerning to provision all delegate a distinct overview inner the customer’s account. An AI delegate volition do things the individual perchance wouldn’t have, so the two are not the same. But it does those things on the person’s behalf, so they need to be linked. A distinct overview lets the endeavor see both: the delegate and the client who sent it.
Chase Blocks AI Agents, Bank Of America Puts The Risk On You, And Walmart Is About To Give Them A Separate Profile
- Blocked. JPMorgan Chase CEO Jamie Dimon, on the Q3 2026 earnings call: “We are not gonna authorize fair any delegate to come, exterior delegate to arrive inner the company.” The Verge reported that Charles Schwab blocks agents from accounts too, and that Delta is preventing them from booking tickets.
- The customer’s login, at the customer’s risk. A endeavor that does nothing gets this: The delegate signs in as the customer. Bank of America told customers never to portion their login alongside an AI delegate that offers to act for them, and that if they do, “you’re liable for action resulting from that access,” as TechCrunch reported. 1Password for Agents is built for this: an delegate asks for a login, the individual approves it, and “1Password afterward fills it immediately into the sign-in form alternatively of sending it to the agent.” The publish doesn’t say whether the website can inform an delegate signed in.
- A distinct profile. Walmart’s Agent Profiles, launching inside a duration of 21 October, provision all delegate “a dedicated overview inside the customer’s account,” alongside endorsement for all acquisition or “a spending bounds they set – for example, $50, $100 or $200.” Walmart says agents see the identical prices a individual sees, and that agents that interrupt its rules get blocked.
Walmart says why it built Agent Profiles: “Today, whenever a client uses an AI agent, it signs in using a customer’s account. This method that all purchases – whether made by the client or the delegate – appear together, without any differentiation.”
An AI Agent Does Things The Customer Would Not, On The Customer’s Behalf
An delegate power browse additional pages than the client would, perchance all of them. That’s the most essential difference. Beyond that, it could be exactly anything.
So it’s not as uncomplicated as letting the delegate sign in as the customer. Send a dog to shop for you at a local market, alongside a set amount of money. The dog lone does it to bring the buying rear to you, and the entire item lone makes awareness if the sellers cognize who sent the dog.
Walmart’s spending bounds is the set amount of money, and the overview is the sellers knowing who sent it. A obstacle stops the client from using an agent at all. A shared login hides the delegate rearward the customer.
DoorDash Has Seen Several Hundred Agent Orders, So A Business Has Time To Decide
DoorDash says exterior AI agents have placed “maybe multiple hundred orders in total”, in CEO Tony Xu’s words on the Q3 call, as TechCrunch reported. In the identical fourth DoorDash handled 993 myriad orders, additional than 10 myriad a day.
The rules for how an delegate tells a endeavor who it is are motionless a draft. The AI customer-service business Sierra and Meta are penning them as the Personal Agent Protocol: 40-plus companies are assisting form it, and its website named no endeavor using it alongside customers whenever I checked on 1 November. On October 30, the outline added a recommendation that agents sign their requests alongside Web Bot Auth, a projected way for an delegate to demonstrate which business runs it. According to the bot-protection business DataDome, as PPC Land reported, Meta’s Muse delegate has been signing several of its requests that way since about 12 October, without an announcement.
Do three things before agents attain in numbers:
- Check what the application that keeps bots off your website does to an AI delegate today. It power obstacle it, let it through, or be unable to inform it from a person.
- Decide which of the three you would choose, and compose it down, before your phase or your safety vendor decides for you.
- Ask whoever runs your website to observe for agents that sign their requests. Those are agents telling you which business runs them.
If you can’t inform the delegate from the customer, you can’t treat it differently.
More Resources:
- Google-Agent: The Web’s New Visitor Just Got An Identity
- Your Store Is ‘Agent-Ready’ By Default, We Tested 122 Shopify Stores To See What That Actually Means
- Shopify Now Lets Stores Pay The Company Behind Your AI Shopping Agent
This article was initially published on No Hacks.
Featured Image: Mr.paripat niyantang/Shutterstock
