Your Store Needs an AI Shopping Agent Access Policy Before Peak
This holiday season, a US brand can answer one question three ways: let AI shopping agents buy from you, let them browse but not buy, or keep them out. According to PYMNTS reporting on October 5, Amazon has blocked dozens of outside agents, including Meta's Muse assistant, while it builds its own. QVC and HSN let agents complete purchases. Kohl's told The Wall Street Journal it does not let agents make purchases.
Those are three different policies, and each was chosen on purpose. Most mid-market brands have not chosen at all. Their agent policy is whatever their platform, bot rules and checkout happen to do when an agent shows up. This post is about replacing that accident with a decision.
Agent-ready is not the same as agent-governed
Agent-readiness, meaning structured product data and protocols such as ACP, Google UCP and Retail MCP, answers whether an agent can understand and transact with your store. It does not answer whether you want it to, for which actions, or under what limits.
The numbers show why the second question matters. In an August PYMNTS Intelligence survey of 2,191 US consumers, 23% said they start shopping research with AI, which PYMNTS puts at about 61 million people. But in the October report, only 6.3% of recent AI-assisted purchases were completed on a brand's own website or app, against 59.7% on Amazon. Being found by an agent is not the same as being chosen, and neither is the same as selling on your own checkout.
Trust is thin too. Shopify's 2026 holiday report says 65% of shoppers will use AI for at least one shopping task this season, yet only one-third say they trusted an AI agent to buy on their behalf. Security vendor Cheq told Semafor it saw a 100x surge in agentic traffic over 45 days, while agents remain a small share of shoppers. That is a vendor-reported figure, so read it as direction, not forecast.
Quick answer: what is an AI shopping agent access policy?
Quick answer: An AI shopping agent access policy is a written decision about which agents may reach your store, which actions each may take (read the catalog, quote, reserve, pay), and which identity checks, limits and logs apply. Set it per agent and per action, not as one allow-or-block switch, and review it before holiday peak.
Four actions, four levels of risk
Treat agent access as a ladder. Each rung carries different risk, so each deserves its own answer.
Read. The agent reads your catalog, descriptions and reviews. Risk is low; the question is accuracy and who gets your data. Shopify's Agentic Storefronts channel, per PYMNTS, sends merchant catalogs to ChatGPT, Microsoft Copilot, Perplexity and others, which makes catalog quality a distribution issue.
Quote. The agent asks for live price, stock, shipping cost or delivery date. This is now a statement a shopper may rely on, so it has to come from the same source of truth as checkout.
Reserve. The agent builds a cart or holds inventory. This is where abuse appears. Tapestry, which sells Coach and Kate Spade in Google's AI Mode and Gemini, told The Wall Street Journal it keeps agents off its own checkout, and PYMNTS reports the company tied that limit to fraud and inventory hoarding.
Pay. The agent completes the purchase. This is the highest-risk rung: authorization, fraud, returns and chargebacks all land here. Tapestry's answer is a good example of a rung-level policy: each order sold through Google's AI surfaces needs explicit shopper approval, and agents cannot check out on the brands' own sites.
Make the policy enforceable
A policy in a slide deck does nothing. Five controls turn it into behavior.
- Agent identification. Treat user-agent strings as hints, not proof. Use whatever verified identity the protocol or agent provider supports, and sort traffic into verified, unverified and blocked.
- Scoped permissions per action. An agent with read access should not be able to create an order. Separate the endpoints and the credentials.
- Limits. Rate limits, cart-hold expiry and per-agent quantity caps are the direct answer to hoarding.
- Approval evidence. Store the shopper's approval and the agent's identity with the order, so a dispute can be answered with a record rather than an argument.
- Logging and a per-agent kill switch. Log every agent action by agent, action and outcome, and be able to suspend one agent without touching human traffic.
Underneath all five sits a single source of truth for price and stock. If the agent, the storefront and checkout can disagree, no policy can protect you.
What nobody knows yet
The right posture is not settled. Amazon blocks outside agents to protect its advertising business and checkout experience. A smaller brand with no ad network may gain more from reach than it loses in control. Walmart lets Gemini show its products, then its own Sparky assistant takes over the basket, which a Walmart executive described to The Journal as "intermediation."
A sensible starting posture for a mid-market brand is open Read and Quote broadly and accurately, open Reserve and Pay selectively, per agent, with evidence, and review the setting monthly through January. That is a starting point, not a proven answer, and the agent landscape is changing every few weeks.
Where MnT Future fits
MnT Future builds AI-native, agent-ready commerce platforms and the agents that sell on them for US D2C and marketplace brands, so these access questions are the ones we raise early, and we run them on MnT Commerce, our own reference build. Our free agent-readiness audit checks how an agent sees your store today across ACP, Google UCP and Retail MCP, and which of the five controls above are missing. If you want to work through your own posture before peak, book the audit or a free strategy session.
Sources: PYMNTS, "AI Agents Knock. Retailers Decide How Wide to Open the Door" (October 5, 2026); Shopify, "Welcome to the first holiday season of the agentic era" (October 6, 2026); Semafor (October 16, 2026).