Credentialed Agents Are Buyers, Not Bots
Credentialed Agents Are Buyers, Not Bots
Thesis: When courts treat an AI shopping agent as an extension of the user’s credentials rather than an intruder under anti-hacking law, the merchant problem stops being “block the bot.” Credentialed shopping agents are first-class buyers. They inherit the session, act at machine speed, and re-rank inventory without ever loving your brand. Operators who still design only for human fingers and generic bot filters will miss the demand, misprice the risk, and hand default preference to whoever has the densest machine-readable shelf.
I am building an AI-native commerce company. I want agents in discovery and checkout. I refuse to pretend a logged-in agent is “just traffic” or “just abuse.”
The Signal: Access Follows the Login
The heat that matters this week is not another model scoreboard. It is who is allowed to shop with a real account.
A U.S. appeals court overturned an injunction that had blocked Perplexity’s Comet shopping tools from operating against Amazon with user-linked sessions. The framing that leaked into operator discourse is the product lesson: the human hands over credentials; the agent carries out the task. Liability and access law will keep evolving — trademark and terms fights are not over — but the commercial trajectory is clear. Shopping agents are being normalized as instruments of the buyer, not as third-party hackers to be CFAA’d out of existence.
Parallel chatter makes the same point from the infrastructure side. Shopify leadership calling agentic commerce a “new front door,” catalog sync into chat surfaces, and payment examples where buyer agents request a cart mandate and only commit after approval all assume one thing: agents will complete work under someone else’s authority, not only under a public scrape.
Founder translation:
| Old mental model | New operating model |
|---|---|
| Bot = scrapers, abuse, blocklists | Agent = credentialed buyer proxy |
| Optimize human scroll + SEO | Optimize machine shortlist + live truth |
| ”Is this traffic real?" | "Who authorized this session, and for what?” |
| Marketplace is a channel | Marketplace is the default agent shelf |
If your security stack still answers “is this a bot?” with a binary and your merchandising stack still answers “is this a customer?” with a browser fingerprint, you are measuring the wrong thing.
Why “Bot Filter” Thinking Loses Twice
Credentialed agents create a double surface.
As channel: An agent acting for a buyer can shortlist SKUs, compare price and stock, and complete or hand off checkout without a human browsing your homepage. Referral-style conversion can look excellent when intent is already formed upstream — people and agents arrive decided. That is distribution you want if your product data survives the comparison.
As rival and risk: The same agent can prefer the densest superstore catalog by default, substitute a near-SKU, or exercise a login in ways your fraud models never saw from a human. Finance, airline, and software operators lining up against open agent access on logged-in properties are not confused. They know session inheritance is power: order history, saved cards, addresses, loyalty, returns status. Whoever controls which agents may act inside that envelope controls a slice of the relationship.
So the Monday mistake is celebrating “agents are free to shop marketplaces again” as pure upside for independents. Courts clearing access on the largest shelf raises the gravity of the default destination. Independent brands and AI-native operators do not automatically inherit that traffic. Agents will go where tools work and truth is dense unless you make preference cheaper and safer elsewhere.
MerchantBench-style work is a useful second signal here, not a digression: even strong LLMs running long e-commerce ops land far under human capital outcomes when scoring is cumulative net assets over a year of delayed feedback. Translation for this essay: do not hand unrestricted operational authority to agents just because shopping agents can click buy. Buyer-side agents need scopes. Merchant-side agents need capital gates. Both need verification.
Preference Is Engineered. Access Is the Floor.
Default access is not default preference. That remains true when the access vector is a court-backed shopping agent instead of a platform toggle.
What agents optimize for under a buyer’s mandate is boring and brutal:
- Can I parse the offer? Structured price, stock, shipping promise, returns, identity of the SKU.
- Can I complete the task without lying to the principal? Live inventory beats pretty photography.
- What is the failure cost? Chargebacks, wrong size, MAP breaks, delayed feedback that wrecks the buyer’s trust in the agent.
Humans forgive a confusing PDP. Agents skip it. Humans brand-shop. Agents constraint-satisfy. If Amazon (or any superstore) is the easiest constraint solver for “get me X by Thursday under $Y,” that is where the agent spends — unless your catalog, policy, and fulfillment SLAs make you the lower-risk action.
Payment protocol experiments that require CartMandate → human or policy approval → CommitPayment are not crypto cosplay for commerce founders. They are the correct shape: authority is scoped; completion is explicit; success and failure are states, not vibes. Merchant stacks need the mirror: accept agent-mediated orders only with attributable principal, spend limits, and audit trails.
| Layer | Commodity | Scarce moat |
|---|---|---|
| Protocol / login access | ”Agent can reach the site” | Preferential shortlist for your SKUs |
| Catalog density | Superstore default | Vertical truth + service claims agents can check |
| Checkout | Card-on-file under user session | Dispute, refund, and agent audit as product |
| Fraud | Bot scores | Principal + mandate + anomaly on agent trajectories |
Operator Playbook: Think Big, Step Small, Do Smart
Think big. Design for a world where a material share of “customers” never see your homepage. The principal is a human; the operator is often an agent with credentials and a mandate. Your competitive set includes other brands and the default marketplace shelf the agent already knows how to drive.
Step small this Monday:
- Name the surfaces agents already hit. PDP, search API, cart, account, returns. Log user-agent + tool signatures + session type. You cannot govern what you cannot see.
- Pick top 50 SKUs and make them agent-hard to skip. Canonical IDs, live stock, ship-by promises, return window, warranty as fields — not paragraph folklore. Kill one ambiguous claim per SKU.
- Define one authority policy for agent-like sessions. Example: allow browse + cart; require step-up or human confirm for ship-to change, gift cards, or order over $N. Mirror the “approve payment mandate” pattern even if you are still on vanilla checkout.
- Attribute agent-sourced GMV separately. If you cannot separate agent-mediated demand from human browse, you will either over-invest in the wrong SEO or under-invest in the handoff that actually closes.
Do smart. Do not run a “block all bots” campaign that also blocks your future distribution. Do not open full account power to any agent that presents a password. Instrument first. Scope second. Scale autonomy only where unit economics and dispute rates stay inside a kill line.
What Not to Do
- Do not treat the Perplexity/Amazon fight as “big tech drama” with no SKU implications. The precedent is about who may act inside a logged-in commerce session.
- Do not confuse marketplace agent revival with free traffic for independents. Default gravity still pulls toward the densest catalog.
- Do not ship merchant-side ops agents with blank-check tool access because buyer-side shopping agents look cool. Cumulative capital is the scoreboard; delayed feedback punishes clever incoherence.
- Do not measure success only as “agent sessions up.” Measure preference rate, conversion after agent handoff, refund/chargeback delta, and margin after returns.
The Claim Worth Arguing
Credentialed shopping agents are buyers. Bot filters, human-only UX, and “we will deal with agentic commerce later” are strategies for a storefront that agents will route around or operate against without your consent design.
The companies that win will treat agent sessions as first-class principals: readable catalogs, scoped authority, verification before irreversible money and inventory moves, and attribution that proves the channel pays.
Disagree? Best counterexample wins — especially if you have data where agents with login access improved GMV and reduced fraud under a clear mandate model.
I write these as operating notes while building an AI-native commerce company. If you are a merchant or operator shipping agent surfaces, argue with me on X.
Sources
- MerchantBench: Benchmarking LLM Agents for Long-Term Coherence in E-Commerce Operations (arXiv:2607.28956) — best reported LLM config at 27.3% of human mean final net assets over 365 simulated days; cumulative capital scoring.
- Court / industry coverage of the Ninth Circuit overturning Amazon’s injunction against Perplexity Comet shopping tools (Aug 2026) — primary legal text evolves; treat secondary reports as directional on credentialed agent access, not as final doctrine.
- Public agentic commerce rails discourse: platform catalog sync / “new front door” framing; buyer-agent payment mandate patterns (CartMandate / CommitPayment style flows) as authority design references, not endorsements of any single vendor.