Should your site let AI agents in? Yelp charges, JPMorgan says no.
Yelp sells agent access, JPMorgan refuses it, Shopify ships it as a toggle. Admission is a commercial call, and bot rules are the wrong place to enforce it.
Agent admission is the decision about which AI agents may act on your site or API, for whom, doing what, and on what terms. It's increasingly a commercial decision about pricing, liability and contracts. But most sites enforce it with bot-detection rules that can only tell automated traffic from human traffic. Giving each agent operator its own credential, with scopes, a rate ceiling and an agreement behind it, turns admission into something you can sell, change and revoke.
In late September, people trying to shop on walmart.com with Meta's Muse took to social media to say it couldn't finish a purchase. The site presented a button that had to be clicked to verify the visitor was human, and the agent got stuck there. Walmart is a Muse partner, announced at Meta's Connect developer conference in September, and a Walmart spokesperson told TechCrunch the blocks weren't intentional.
The commercial side of Walmart had already said yes. The enforcement side said no, because nobody had told it about the deal. That gap is the story of the past month. Which agents may act on your site has become a commercial question, and most companies are answering it with traffic heuristics that can't express a commercial answer. Admission belongs in the identity layer: the agent operator gets its own credential, with scopes, a rate ceiling and a contract behind it, so "which agents may act here" is a product tier you sell and revoke rather than a rule you tune.
What are companies actually deciding about AI agents?
In recent weeks, users of Meta's Muse, xAI's Grok, OpenAI's Dots and Instinct have reported blocks stopping their agents from finishing tasks across major sites, according to The Verge. Read the individual policies and the pattern isn't a wall. It's a price list with a lot of blanks in it.
Shopify gives the game away. In its Agentic Storefronts settings, a merchant decides per AI channel whether buyers can check out directly inside the AI interface and whether the channel gets catalog access. The money explains the effort: Shopify reported that AI-driven traffic to its stores grew eight times year over year in the first quarter of 2026, and orders from AI-powered searches grew nearly 13 times.
Why is letting agents in a pricing decision?
Yelp's position is the clearest. Agents are welcome once they pay for access through its data licensing program. That's a product, with a buyer, a contract and a revenue line, not a security control with a fee stapled to it. (TechCrunch's read is that without a formal arrangement, agent actions like quotes, waitlists and table bookings will likely fail.)
JPMorgan's is the same decision pointed the other way. A spokeswoman told CNBC: "Protecting our customers is our top priority. Because it is not safe, we do not permit third parties to access accounts by obtaining customers' banking credentials and logging in on their behalf." The bank also told Fortune: "We support secure, customer-authorized data sharing through open banking providers."
Read those together. The bank isn't opposed to agents; it's opposed to agents that arrive wearing a customer's password. The objection is to the credential, and a better credential is something someone can build and sell. Jamie Dimon said as much on the bank's third-quarter earnings call on October 13: "we're not going to allow just any outside agent to come in inside the company, because that's just too risky for clients and for JPMorgan."
Then he named the actual blocker: "There's a liability transfer." Liability transfer is a contract term. It describes who absorbs the loss when an agent moves money it shouldn't have, and no amount of request filtering resolves it. The bank has given no timeline for when its safeguards will be good enough to let agents touch accounts directly, which is what an unbuilt product looks like from the outside.
Even Amazon's statement on blocking agents is commercial language. A spokesperson told Bloomberg that third-party applications that buy on customers' behalf "should operate openly and respect service provider decisions about whether or not to participate." Openly, and with permission. That's an onboarding flow, described by a press office.
Why can't bot rules express it?
Compare the vocabulary each layer has. The commercial decision needs to say: this operator, for these actions, at this rate, under this agreement, revocable on notice. AWS, describing how a financial services company could share its agent directory with security vendors, gave a rule that reads exactly like that:
Traffic heuristics get one bit: this request looks automated, or it doesn't. Everything else is guessed by proxy. A paying Yelp licensee and an unpaid scraper arrive as the same shape of HTTP request, so the rule guesses, and the guess goes wrong in both directions. Walmart's shoppers hit the false positive. Zillow told TechCrunch it allows agents acting for consumers, but that its anti-bot measures could occasionally block some anyway. eBay separates unauthorized actions like scraping and model training from a legitimate purchase, a line no inference-based check can draw reliably, because the two look identical until you know who's asking.
Identification helps, and it's further along than most teams realize; we covered the state of it in Web Bot Auth: How to identify AI agents and set policy for them. It doesn't finish the job. The IETF's Web Bot Auth protocol draft says a valid signature "says nothing about who operates the Agent, whether the Agent is benign, or whether the request is authorized." You get a stable handle. What that handle may do is the part you design.
What does admission as a product tier look like?
None of this needs a new protocol. The pieces are the ones you already use for API consumers.
- Issue the operator its own credential. Not the user's session borrowed by a browser in a data center, which is exactly what JPMorgan says it won't accept. A credential that belongs to the agent operator and names the user it acts for lets your logs tell an agent apart from the person behind it, and from a different agent run by the same person. Which credential to issue, and when covers the options.
- Attach scopes to the tier, not the request. JPMorgan's current posture, read balances but don't move money, is a scope, and a perfectly saleable one. Express it once per operator rather than inferring it per request.
- Put the rate ceiling on the identity. The FinCo rule pins 100 requests per minute to a named set of agents. A quota attached to an operator is enforceable and negotiable. A quota attached to an IP range is neither.
- Write the agreement the tier implies. Dimon's liability transfer is the term that has to exist before a bank opens a write lane. Yelp already has one, in its licensing agreement. If you plan to charge for admission, the agreement is the product.
- Keep revocation in your hands. When an operator misbehaves, you downgrade or disable its credential, and the change takes effect on your side without waiting on anyone's cache or cooperation.
Put together, the record you're maintaining looks something like this:
That shape is illustrative, not an API anyone ships. The point is that every field is a business decision someone already made in a meeting, and now they all live on one record you can read, change and revoke.
An anonymous lane gets read access and a modest ceiling. Register, and the ceiling rises and a human contact comes with it. Sign the agreement, and write access opens at a quota someone negotiated. Which lane an agent lands in becomes a field on a record, not a rule somebody has to remember to update when sales closes a deal.
Isn't this out of your hands?
The strongest counterargument is that none of this is yours to issue. A consumer agent drives a browser, logs in with the user's own credentials, and never asks you for anything. You can't hand a credential to a client that doesn't want one.
For now, true. It's also already changing, and the companies building the agents are the ones changing it. Meta previewed a Personal Agent Protocol on October 6 with Sierra and partners including Genesys, NiCE, Decagon, Rocket, Shopify, Stripe and Walmart, and said the work covers how personal agents securely convey user identity and how businesses steer agents toward the APIs and skills built for them. Meta also said Muse asks for explicit user approval before consequential steps such as signing in, completing a reservation or making a purchase. On the commerce side, Google's Universal Commerce Protocol, co-developed with Shopify, Etsy, Wayfair, Target and Walmart, counts Amazon, Meta, Microsoft, Salesforce and Stripe on its tech council and payment networks like Visa, Mastercard and American Express among its backers.
Large groups are converging on the same capability: an agent that can say who it is and who sent it, before it acts. A site that has already decided what each kind of caller may do can plug into that quickly. A site that hasn't goes back to tuning heuristics, with a better header to tune them against.
There's a real risk here, and it's worth naming. A licensing tier is also a toll booth. Yelp's program is open to agents that can pay, which is a different sentence from open to agents, and an independent developer building a useful agent isn't Meta. If the only operators who clear admission are the ones with a business development team, the credential layer rebuilds the same walled gardens with better plumbing. The standards help only as far as registering is cheap and the free lane stays usable. Each site makes that call when it sets the bottom tier, and most of the attention right now is on the top one.
Meta's framing of the cost is the sharpest line any of these companies has written:
Self-interested, obviously. Also hard to argue with when the agent carries a real customer's intent and a real payment method. Delta's statement sits in the same territory:
No integration, and an open evaluation. The distance between those two clauses is a product nobody has built yet.
What should you decide this quarter?
Three questions:
- Which actions on your service would you sell to an agent operator, and at what rate ceiling?
- Which would you refuse whoever's asking (JPMorgan's answer for money movement today), and what would have to be true to change that?
- When a partner's agent gets blocked by your own defenses, the way Muse shoppers were at Walmart, who finds out, and how fast?
Answer them before a reporter answers them for you. The article that defines your agent policy in public is one blocked customer away, and it'll be written from their side of the door.
If you're building the registration side on WorkOS, Agent Registration covers the first and last of those pieces. Each agent gets its own credential (an access token or an API key, configured per environment). Registrations get one set of scopes before a person claims the agent and another after, which maps directly onto an anonymous lane and a trusted one. And a registration can be revoked, which permanently stops every token or key issued from it. The rate ceilings and the agreement are still yours to define. Agent Registration with auth.md walks through the setup.