The Catalog Bonfire, Again
Small town merchants used to burn Sears and Montgomery Ward catalogs at Saturday night bonfires. Some offered a bounty, as much as $50, to whoever brought the most “wish books” to the fire. With a catalog, a shopper could buy without walking into the local store. The store had no veto. It lost the buyer, period.
The same fight is back.
Shopify welcomes agents. Amazon holds them at the gate. I can buy at either one myself. The fight is over whether the agent I send is permitted to buy for me. If I dispatch a bot, and I’ve entrusted it to shop for me, who are the gatekeepers to tell me it can’t?
Recently I went to buy something on walmart.com. At checkout, Walmart asked for my phone number. I closed the tab. I wanted the thing. I didn’t want to hand over another identifier to get it. The store was deciding what I had to give up before I was permitted to buy.
Send an agent instead, and the question is whether it’s permitted to buy at all. In Amazon’s suit against Perplexity, a federal district court put the split in one line: Perplexity’s Comet browser acted “with the Amazon user’s permission but without authorization by Amazon.” Two permissions: one mine, one theirs. On August 4, the Ninth Circuit vacated the injunction that followed, writing that the agent “is a tool, not a person for statutory purposes.” If the agent is my tool, I’m the one buying. That’s a real win, and a narrow one. It covers federal hacking law only. Contract and terms-of-service claims are still live, and Amazon has already moved to them.
What Amazon did next is telling. On September 20, Meta’s Muse users who reached Amazon got a pop-up: “Continued access by an unauthorized AI agent violates Amazon’s Conditions of Use, to which our customers have agreed.” Amazon turned the customer’s own agreement against the agent the customer chose. Meanwhile, Amazon’s own Buy for Me agent buys from other brands’ sites. Amazon says this is about security and credentials. My presumption is that it’s about the ads. As Perplexity put it, agents “don’t have eyeballs to see the pervasive advertising Amazon bombards its users with.”
Plenty of retailers let agents buy, on their terms. Shopify makes merchants’ products discoverable in ChatGPT by default, and the merchant keeps the checkout. Walmart is listed among Muse’s connectors, and it runs its own Sparky assistant inside ChatGPT so the experience stays Walmart’s. That’s the same company that wanted my phone number when I tried to buy something directly. There was no guest option at checkout either. It’s signup, or go away. eBay bans “unauthorized” agents while courting authorized ones like OpenAI’s. And OpenAI itself backed off in-chat checkout in March, letting merchants use their own. In practice, an agent is permitted to buy only through a door the merchant built.
Retailers aren’t the only gatekeepers. The card networks decide which agents are permitted to buy, too. Visa wants to separate “malicious bots and legitimate AI agents.” Mastercard wants every agent credentialed. On October 13, American Express laid out a flow where the customer “authenticates their identity and signs off on the intent” before the agent buys. Of the three, Amex comes closest to putting my word at the center. The price, though: every one of these is an identity check. Cross River’s chief AI officer, Pravesh Rijal, says the industry already has a name for it: Know Your Agent, “the KYC equivalent, but for software.” His answer is scoped delegation, a defined perimeter on what an agent can touch, how much it can move, and for how long. He still makes a regulated bank the anchor, so a bank decides what my agent is permitted to do. I’ve been talking about KYC creep for years, including on Trust Revolution. Each delegation becomes another identity event. That’s much more than the phone ask at checkout. It’s ever-creeping KYC, now extended to our agents.
Then there are the bot cops. Cloudflare now offers sellers a “paywall for agents” on APIs and data: pay to pass. Akamai reported in July that attackers are hijacking legitimate assistants to “abuse stored payment credentials.” That fraud is real. A gatekeeper who says “prove this agent is really yours” is being reasonable.
On October 6, Meta, Sierra, Shopify, Stripe, Walmart and others announced a Personal Agent Protocol built on one principle: “consumers decide what access to give their personal agents, and companies set parameters for what those agents can do.” That’s fair if the parameters are about risk. It’s a toll if they’re about keeping my eyeballs on ads, or about gathering ever more data on customers and their actions.
So here’s where I land. My permission should be enough. When I’ve entrusted an agent with my money and my intent, that agent should be permitted to buy for me by default. A gatekeeper who refuses it needs a valid, specific concern. Attackers hijacking assistants to misuse stored payment credentials is one. My saved card autofilled on a fake store is another. When Amazon answers with its Conditions of Use and names no risk, that’s a pretext. Amazon did argue its harms before the Ninth Circuit, and the court called its evidence of customer harm, and its security argument, “weak.” Short of a real, specific risk, my agent gets to buy.