The rise of agentic commerce—where AI performs tasks such as grocery shopping, flight booking, or financial management—has forced a critical re-evaluation of digital access policies. While some organizations are opting for a total exclusion of these agents to mitigate security and data integrity risks, others are attempting to integrate them into existing workflows, albeit with varying degrees of transparency.
The Emerging Landscape of AI Agents
AI agents are software programs designed to execute specific tasks by navigating websites, filling out forms, and interacting with databases in the same manner as a human user. Unlike traditional bots, which often follow rigid scripts, these agents are driven by large language models (LLMs) that allow them to make decisions, browse multiple pages, and handle complex multi-step processes.
The primary friction point for businesses lies in the identity of these agents. When an AI agent accesses a website, it often utilizes the credentials of the user who commissioned it. This creates a "black box" scenario for the business, which cannot distinguish between a human customer and an automated proxy. Without clear differentiation, businesses struggle to enforce spending limits, manage inventory, or analyze user intent accurately.
Three Distinct Strategies: A Snapshot of October 2026
Data from the recent quarter indicates that companies are reacting to the agentic surge with three primary strategies: outright prohibition, risk-shifting, and architectural integration.
1. Total Exclusion: The Chase Model
Financial institutions, governed by stringent regulatory requirements and high security standards, have largely opted to block AI agents entirely. Chase, among others, has implemented rigorous bot-detection mechanisms that identify and deny access to automated agents. The rationale is rooted in risk management; allowing an unverified AI to initiate financial transactions or access sensitive account information presents a liability that many banks are not yet prepared to underwrite.
2. The Liability Shift: Bank of America and Others
Other institutions have adopted a "user-responsibility" approach. In this scenario, access is permitted, but the burden of security and outcome lies solely with the consumer. If an AI agent commits an error, initiates a fraudulent transaction, or incurs unintended costs, the bank maintains that the customer is liable. This approach places the onus on the user to vet the AI provider, effectively outsourcing the risk assessment to the consumer rather than the technology platform.
3. Architectural Integration: The Walmart Approach
Walmart has emerged as a leader in formalizing agent interactions by introducing "Agent Profiles." This strategy acknowledges the inevitability of automated commerce while creating a necessary layer of transparency. By providing a separate, distinct profile for the agent within the customer’s account, Walmart ensures that the business can track the agent’s activity independently from the human user’s activity. This allows the company to apply specific rules—such as modified spending limits or restricted access to sensitive data—to the agent without inconveniencing the primary user.
Data and Volume: The Scale of the Challenge
The urgency of these strategies is not necessarily driven by current volume, but by the trajectory of growth. DoorDash, a leader in the gig-delivery space, reported in its Q3 2026 earnings call that it has processed only "several hundred" orders from AI agents. When viewed against the company’s total quarterly volume of 993 million orders, the current impact of AI agents appears negligible, accounting for a fraction of a percent of overall traffic.
However, industry analysts note that the volume is irrelevant to the structural challenge. The infrastructure required to handle 100 AI orders is the same as that required for 10 million. Businesses are currently using this "quiet period" to build the digital infrastructure necessary to distinguish between human and machine behavior before the adoption of AI agents reaches a critical mass.
The Push for Standardization: The Personal Agent Protocol
To solve the identification crisis, the tech industry is attempting to coalesce around a set of standards known as the Personal Agent Protocol. Spearheaded by companies like Sierra and supported by over 40 industry participants, the initiative aims to create a universal framework for how agents communicate their identity and intent to the websites they visit.
The protocol includes recommendations for agents to sign their requests using "Web Bot Auth," a system that allows an agent to provide cryptographic proof of the company that developed it. This verification is vital; it prevents malicious actors from masking their activity as legitimate agentic traffic. Evidence suggests this is already in motion; as of mid-October 2026, Meta’s "Muse" agent has been observed signing its requests in quiet tests, signaling a move toward a more transparent and regulated digital environment.
Implications for Business Operations
The transition to agentic commerce has three immediate implications for digital strategy:
- Authentication and Identity: Businesses must move beyond simple cookie-based tracking. True identity management in the age of AI requires verifying the provenance of the software initiating the session.
- The "Agent Persona" Problem: As noted by Walmart, an agent does not always mimic human behavior. It may browse an entire catalog in seconds or attempt to compare pricing in ways a human never would. Web architecture must be updated to handle these non-linear navigation patterns without triggering false-positive security flags.
- Policy and Terms of Service: Companies must clarify their terms of service regarding autonomous agents. If a company does not have a stated policy, it remains vulnerable to legal ambiguity should an agent cause a system failure or financial loss.
Strategic Recommendations
As the digital landscape shifts, experts suggest that organizations prioritize the following actions to prepare for the surge in automated traffic:
- Implement Differentiated Tracking: Businesses should invest in analytics that can categorize traffic by source type. Knowing that 5% of traffic is "Agentic" versus "Human" is the first step in effective capacity planning.
- Define Agent Permissions: Much like the permission models used in mobile operating systems, websites should develop granular controls that specify what an agent can and cannot do. Can it add items to a cart? Can it initiate a checkout? Can it read user reviews?
- Support Open Standards: Rather than building proprietary "walls" that may quickly become obsolete, businesses should participate in industry-wide standardization efforts like the Personal Agent Protocol. Establishing a common language for bot-to-business communication will reduce long-term maintenance costs and improve interoperability.
Looking Ahead
The current state of AI agent adoption represents the "early adopter" phase. While the absolute number of transactions remains low, the technological foundation being laid today will dictate the rules of commerce for the next decade.
The approach taken by companies like Walmart suggests that the future of the internet will not be a binary choice between allowing or blocking bots. Instead, it will be a transition to a more sophisticated, metadata-rich environment where every participant—human or synthetic—is identified, authenticated, and governed by a set of clearly defined digital rights and responsibilities. As standardization efforts mature, the industry expects a move away from the current fragmented approach toward a unified global standard, ensuring that as AI agents become more prevalent, they remain a productive and manageable component of the global digital economy.
