Let in, lock out or offer it yourself: How companies decide on access for AI agents
English translation of the German original of 21 October 2026.
AI agents are supposed to shop, book and manage accounts for their users. But the companies on the other side are not playing along everywhere. Amazon locks out a new shopping agent; banks keep third-party agents away from customer accounts. Others build their own access points for AI. Right now it is being decided who may act on behalf of customers, and on what terms.
- →Since 20 September, Amazon has been blocking a new shopping agent, twelve days after its launch. The reason: the agent does not identify itself as AI, and nobody asked the retailer.
- →Banks, an airline and a review platform also keep third-party agents out, or only admit them for payment or with restricted rights.
- →Others take the opposite route: property portals offer their own apps in ChatGPT and Claude. The AI shows the listings; the next step runs through the portal.
- →Legally, much is open. In August, a US appeals court saw the user, not the agent, as the one accessing the website. Whether the user thereby consents to every single step the agent takes, it did not decide.
Locked out twelve days after launch
On 8 September, Meta launched Muse in the US, an agent that shops in online stores for its users. On 20 September, Amazon started blocking it. Anyone using Muse on Amazon saw a notice: access by an unauthorised AI agent violates the conditions of use. Amazon had asked Meta beforehand to exclude the website. Meta declined.
Amazon justifies the block with three points: Meta did not disclose that Muse accesses Amazon. The agent does not identify itself as AI while browsing. And it apparently stores customers' login credentials. Meta disagrees: Muse sees neither passwords nor payment data. Blocking a personal agent, it says, ultimately turns away the customer behind it.
On 17 October, The Verge reported that Amazon is not alone. The US banks JPMorgan Chase and Charles Schwab keep third-party agents away from customer accounts. The airline Delta has no agreements with third-party agents. The review platform Yelp only admits agents that pay for the data.
“We don’t want someone just giving their password to Muse, and letting Muse come in and take action on that client’s behalf.”
Rick Wurster, CEO of Charles Schwab, according to The Verge
Who accesses the site: the user or the agent?
The background is a dispute that has been running for almost a year. In November 2025, Amazon sued Perplexity because its Comet browser shopped on Amazon with a built-in agent without identifying itself as an agent.
The appeals court argued technically: Comet sends screenshots from the user's device to Perplexity and receives instructions back on where to click. So on Amazon, it is the user who accesses the site, with the help of the agent. But the court explicitly stressed that it was not laying down new rules for AI agents.
Amazon amended its complaint in September. The iPhone version of Comet, it says, copied users' Amazon logins to Perplexity's own data centres and accessed Amazon directly from there, daily between 18 March and at least 11 May. In addition to the federal Computer Fraud and Abuse Act and California law, Amazon now also relies on its conditions of use: Perplexity, it argues, induces Amazon's customers to breach their contract with Amazon. The block on Muse is based on the same conditions. Perplexity counters that the new complaint repeats arguments the appeals court has already rejected.
Since 30 May 2025, these conditions have contained a section of their own for AI agents. An agent must identify itself by name as an agent on every access. It must not imitate human typing and clicking, must not solve CAPTCHAs and must answer truthfully when asked whether a human or a computer is acting. If Amazon asks an agent to stay away, it must do so. And Amazon reserves the right to limit, at its own discretion, whether and how agents access the site. According to the complaint, Comet instead posed as an ordinary Chrome browser.
Limitation: the details of the new complaint come from the filing of 21 September 2026. They are Amazon's allegations, on which the court has not yet ruled.
Let in, lock out or offer it yourself
Sorting the cases reveals four stances. In each, it is the customer who acts. They differ in who the customer's next step runs through and who gets to see it.
For the own-app route, there are examples from German-speaking countries. ImmoScout24, Germany's leading property platform, has had an app in ChatGPT since the end of January. Listings appear in the chat with photos and prices; one click leads to the listing on the portal. On 19 October, the US portal Zillow introduced a connector for Claude, following an app in ChatGPT. Zillow states the goal openly: the next step, whether viewing, agent or financing, should run through Zillow.
The stances are not mutually exclusive. Amazon only lets third-party agents in on its own terms and at the same time runs its own. So the question is less whether agents should shop, and more whose agent it is. How this brings its own interests into play is shown in our insight on Amazon's AI agents for sellers (in German).
An instruction is not the same as consent
Behind the dispute lies a question no court has decided yet: if a user gives an agent a task, do they consent to every single step the agent takes along the way? Saying “buy me new running shoes” does not necessarily mean having decided which cookies are accepted, which personal data are passed on and which terms are agreed to.
The complaint against Perplexity shows how concrete this is. According to Amazon, every customer agrees to the conditions of use with every order; the notice sits right next to the order button. If an agent clicks that button, the question is who agreed. Amazon itself writes that such agents sometimes act on a user's request, “but without the user's knowledge or specific instruction”.
Agentic browsers often simply close cookie banners or do not display them at all. In a non-binding note from the summer, the French data protection authority CNIL recommends making it visible when an AI acts on a person's behalf. There are no binding guidelines from a European authority yet. For companies, this means: if you admit agents, you should be able to record which action came from a human and which from an agent.
That agents need limits is also shown by our insight “The agent knows your account balance” (in German). There, the question was whose interests an agent pursues when it recommends. Here, it is how far the task a human gives it reaches.
“Until now, the point was to be mentioned in the AI answer. Now it is also about who the next step runs through: directly with the company, or through someone else's agent.”
Dr. Michael Mohaupt, rethink.expert
Claim: “Locking out AI agents loses you customers.”
Assessment: Hardly in the short term: according to analysts, shoppers so far mainly use agents for research and then buy themselves. In the long term, it depends on how many customers actually hand over purchases. There are no reliable figures on this yet.
Claim: “An agent simply acts on the user's behalf; that is legally settled.”
Assessment: Only partly. In Amazon v. Perplexity, the US appeals court saw the user as the one accessing the site. But it stressed that it was not creating new law for AI agents. Whether an agent may accept terms or pass on data for the user is open.
Claim: “An app of your own in ChatGPT is worth it for every company.”
Assessment: That has not been shown. Neither platforms nor companies publish figures on usage or transactions through such apps. For many, it should be enough at first that the path from the AI answer to their own website works smoothly.
Four questions for companies
For your five most important customer requests, record: what does an AI already do today? Which step remains open, such as booking, enquiry or purchase? And who offers it?
Decide which stance fits which step. Letting agents retrieve information is different from allowing orders, payments or contracts.
Make agents recognisable: set rules for how agents must identify themselves, for example with their name in every request, as Amazon requires. Report agent access separately in your analytics and log which action came from a human and which from an agent.
Before building your own app in an AI, check whether the path from the AI answer to your own website already works smoothly. There are no reliable figures on the benefit of such apps yet.
AI agents and access to companies
In the US, companies rely on their conditions of use for this. Whether that holds against agents acting on a customer's behalf has not yet been decided in court. In August, a US appeals court saw the user as the one accessing the site, but explicitly did not lay down general rules for agents.
Mainly for security reasons. Giving an agent your password gives it access to the whole account. Some banks instead offer their own interfaces through which an AI can retrieve information but cannot move money.
That is open. The instruction “buy me this” does not automatically cover every decision along the way, such as cookie consents, data sharing or accepting terms. There are no binding rules on this in the EU yet.
Not necessarily. Own apps ensure that the next step runs through your own offering. But nobody publishes figures on usage and transactions yet. For many companies, it matters more at first that the path from the AI answer to their own website works.
Which of your customers' steps will an AI soon take over? Get in touch to work out where your company should offer the next step itself.
Get in touch →