---
title: "Agents as customers: your business is built to keep them out"
description: "AI agents already buy, book and ask for support on people's behalf. Most businesses stop them at the door. What an agent needs from you, and what to do now."
type: Essay
url: https://sunilkumar.ai/writing/agents-as-customers/
author: Sunil Kumar (https://sunilkumar.ai/about/)
datePublished: 2026-10-19
pillar: Economics
tags: [agentic-ai, agents-as-customers, agentic-commerce, integration]
license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)
---

# Agents as customers: your business is built to keep them out

AI agents already buy, book and ask for support on people's behalf. Most businesses stop them at the door. What an agent needs from you, and what to do now.

## In short

- An agent that buys, books or asks for service on someone's behalf is a customer, and it is already here. UK and US merchants put agents at 3 percent of transactions in June 2026, and 89 percent of them were preparing for more.
- Everything built to serve human customers and stop machines, CAPTCHAs, PDF price lists, quote forms, chat widgets and login walls, now stops the next customer at the door. Amazon blocked Meta's agent in September because, in its words, the agent does not identify itself when it browses.
- An agent needs six things a human never asked for. An offer it can read, a door it can use, a way to prove who it acts for and within what limits, a way to pay, terms and a dispute path it can parse, and a route to a person when it is stuck.
- The liability question is open. 93 percent of merchants want the agent's provider to carry the loss when an agent buys wrong, and only 28 percent will sell agents their full range on the same terms. The businesses that write terms for agents first will get the agents' business.

One of our agents went to buy something last month. It is a procurement agent at a client, and its job is dull: when stock of a packaging item drops below a line, it reorders from the supplier the client has used for years. It had done this before. This time the supplier's website had a new bot check on the login page, the price list had moved into a PDF, and the order form had been replaced by a button that said "Request a quote". The agent did what we had told it to do when it is not sure. It stopped, wrote down what it had seen, and raised a ticket for a person. The person placed the order two days later, by phone.

That is a composite of things our agents have hit in the last year, with the details changed, and the pattern is the same every time. Nothing about the supplier was broken. The website worked for a human. It had been built, like almost every business on the planet, for a customer with eyes, a mouse and a phone number. The customer that arrived was software.

For twenty years businesses have optimised every surface for human customers, and a large part of that work was also, deliberately, keeping machines out. The next customer is a machine. It arrives with a person's authority and a person's money, and most businesses cannot take its order.

> **Agent as a customer**: A piece of software that discovers, evaluates, buys from or gets service from a business on behalf of a person or a company, with authority delegated to it and limits set on what it may do. The agent is the customer's representative; the person or company is still the customer.

## The month the customer changed

I would not have written this in August. In September and October the numbers arrived, from everyone at once.

Checkout.com surveyed more than 12,000 consumers and heads of payments across six markets. UK and US merchants said only 3 percent of their transactions involved an AI agent. The same merchants said 89 percent of them were actively preparing for agentic commerce, 42 percent were already testing it, and 72 percent expected consumers to adopt agent-led shopping faster than most merchants were ready for. Three percent of transactions is small. Nine in ten businesses preparing for it is not.

Then the platforms moved. Meta launched Muse on 8 September, a free personal agent that shops and pays on a person's behalf, and within a week it was the most downloaded free app in Apple's US App Store, ahead of ChatGPT. On 20 September Amazon cut it off, with a notice that "continued access by an unauthorized AI agent violates Amazon's Conditions of Use". Shopify had gone the other way in June: every eligible Shopify merchant's catalogue is now readable by agents by default, on the Universal Commerce Protocol it built with Google, so ChatGPT, Gemini and Copilot can find, cart and check out their products. Stripe had shown an Agentic Commerce Suite in April: catalogues agents can read, payment tokens agents can spend, single-use cards issued to agents, and a way to tell a legitimate agent from a fraudster. Patrick Collison said at the same event that in the not too distant future agents will account for most transactions online.

The rails moved too. On 29 September the Federal Reserve's Christopher Waller gave a speech at Sibos titled "Payments in the Age of AI Agents". The next day Mastercard expanded Agent Pay with a score that estimates whether a transaction was started by an AI agent, now in testing in the United States. In India, NPCI is building a Unified Agent Protocol so that agents can register, be verified and pay on UPI, which handled 22.71 billion transactions in June, 63.5 percent of them to merchants.

Every one of those moves answers the same question: how does a business tell a customer's agent from a stranger's bot, and what does it let the agent do once it knows?

## Twenty years of optimising for humans built a wall against machines

Look at what a business has built at its edges and ask what each thing does to a machine. The CAPTCHA exists to stop machines. The bot-management layer in front of the website exists to stop machines. The price list in a PDF, or behind a sales call, exists so that a human has to ask. The quote form exists so that a human can qualify the lead. The chat widget assumes a human is typing. The login wall assumes a human with a password and a phone for the one-time code. The terms are written for a human to scroll past. The support line is a human on hold.

None of this was a mistake. Each piece solved a real problem with human customers, or kept out the machines of the last decade, which were scrapers, credential stuffers and price crawlers. The trouble is that the next customer looks exactly like the last threat. Amazon's stated reasons for blocking Meta's agent were that it had not agreed to it, that Meta had not told it, that the agent "doesn't identify itself when it browses", and that it appeared to capture and store customer credentials. Strip out the rivalry and that is a fair description of every agent that reaches a business through a browser today. It looks like a bot because, from the outside, it is one.

A business that cannot tell a customer's agent from a scraper will block both, and lose the customer. The defences are not wrong. They are undirected. They cannot see the difference between a machine that wants your data and a machine that wants to give you money on behalf of a person who chose you.

## What an agent needs from you that a human never asked for

We have written down what it takes to put an agent in production: real work, bounded failures, an audit trail, a named owner and a budget, the tests I call [Agentic in Production](/ideas/agentic-in-production/). Being a customer is the mirror image. Here is what an agent needs from the business it is buying from, and almost none of it is on any website I have looked at this year.

An offer it can read. Prices, stock, options, lead times and terms as structured data, not as a PDF, an image or a paragraph. Shopify's number is the clearest I have seen: AI searches that run on its structured catalogue convert at twice the rate of searches that run on scraped pages. A human reads a brochure. An agent reads a schema, and if there is no schema it guesses, and a guessing agent is one your business does not want.

A door. Not a chat widget, which is a human interface pretending to be an API, and not the browser, which is the long way round. An agent wants an endpoint it can call: an API, or increasingly an MCP server, which is becoming the default way agents talk to tools. I wrote about [why the third agent costs more than the first](/writing/mcp-vs-api/) from the side of the business building agents; the business receiving them has the same choice in reverse. One well-described door is cheaper than twenty agents each learning your website.

A way to prove who it acts for and within what limits. This is the piece the payments industry spent 2025 and 2026 building, and the names are worth knowing. Cloudflare's Web Bot Auth lets an agent sign every request with a key, so a business can verify that it is a registered agent and whether it has come to browse or to pay. Visa's Trusted Agent Protocol and Mastercard's Agent Pay both use that signature, with directories of registered agents behind it. In the Checkout.com survey, 75 percent of merchants said revoking an agent's permission in real time was critical, and consumers said they would let an agent spend an average of £177 per purchase before they wanted to be asked. Authority, limits and revocation. A human customer never had to carry any of those in writing. An agent carries nothing else.

A way to pay. Agents have no wallet in a pocket. They pay with a token scoped to a merchant and an amount, a single-use virtual card, a credential the person released for a bounded purpose, or on UPI, under the protocol NPCI is drafting, a mandate the person gave in advance. If your checkout can only take a card typed by a human, with a code sent to a human's phone, the agent fails at the last step, after it has chosen you.

Terms it can parse, and a dispute path it can use. Who bears the loss when an agent buys the wrong thing? In PYMNTS Intelligence's survey of US retailers, 93 percent said the agent's provider should, 80 percent expect the provider to verify the agent's authority before it acts, and only 28 percent would sell agents their full range on the same terms as other channels. The sample was small, 60 merchants, but I have not met a merchant who would answer differently. Waller's line at Sibos was that the biggest barrier to scaling agentic commerce is "building sufficient trust". Trust between businesses is written down. The business that writes its terms for agents, what an agent may buy, how a wrong purchase is unwound and who pays, is the one agents will be allowed to buy from.

A route to a person. Every agent I have put in production has a rule for what to do when it is not sure, and the rule is to stop and ask a human. The business on the other side needs the same thing: a way for an agent to hand a half-finished transaction to a person, with the context attached, rather than a chat widget that asks the agent whether it is a robot. The agent that could not reorder packaging did not fail because the supplier had a quote form. It failed because there was no way to say "a person at my client will take it from here" without a phone call.

## The argument nobody wants to have yet

Read the merchant numbers again and the next two years are visible. Nine in ten businesses are preparing for agents. Fewer than three in ten will give agents the same deal as a human. Nine in ten want someone else to carry the risk. Nobody has agreed to carry it.

Deadlocks like this break when someone moves first and sets the terms everyone else copies. A business that publishes agent terms this quarter, with a cap per transaction, a verification requirement and a clear unwind, is writing the contract the market has not written yet. It will get some of it wrong. It will also get the agents, because an agent chooses the business it can transact with, and the consumer behind it mostly does not mind which. Checkout.com found that 57 percent of consumers would let an agent switch brands for better value. Loyalty, for an agent customer, is whether your door opens.

For the first time since the web, a business can be chosen for being easy for a machine to buy from. That is a new competitive advantage, and a cheap one, because the standards exist and the first mover in most categories has not moved.

## India will do this on UPI, and quickly

I run a company in Bengaluru, so I watch NPCI more closely than I watch Visa. The Unified Agent Protocol it is developing, reported in July, would give agents a common way to register, be verified and be authorised to transact on UPI without changing the rails. NPCI's role stays narrow: confirm that the payment request is genuine, with no view of what is being bought. The first use cases the industry expects are low-value and repetitive, groceries and dairy, the things a household agent reorders every week.

UPI did 22.71 billion transactions in June, worth ₹28.92 trillion, and 63.5 percent of them were payments to merchants. When agents can pay on UPI, every kirana with a QR code is, on the payment side, an agent-ready merchant. What none of them has is the other five things: a readable offer, a door, verification, terms and a route to a person. The Indian business that solves those for its category first, on rails the whole country already uses, will find a very large customer waiting.

## This is not a retail story

The retail numbers get published because payments companies publish them. The enterprise version is quieter and larger. Gartner predicts that agents will intermediate more than 15 trillion dollars of B2B spend by 2028 and that, within three years, 90 percent of B2B purchases will be handled by agents. Forrester expects 20 percent of B2B sellers to be forced into agent-led quote negotiations in 2026. I believe both, because the agents in my own portfolio are already on the buying side: reordering, reconciling, chasing deliveries, comparing quotes, renewing licences. The 306 agents I wrote about in [what production taught me](/writing/what-306-agents-in-production-taught-me-about-enterprise-ai/) are, from the point of view of the businesses they call, customers.

So the question for an enterprise is not whether consumers will send agents to its website. It is whether its own customers' procurement agents can get a quote, an order confirmation and an invoice without a human in its sales team being the API. For most companies I meet the honest answer is no, and the sales team does not know it is about to be negotiating with software.

I have put the six needs into a playbook with a scorecard you can run against your own business in an afternoon: [How to make your business agent-ready](/playbooks/how-to-make-your-business-agent-ready/). What follows is the short version.

## If you are doing this in your company

Send an agent to buy from yourself. Any capable assistant with browsing will do. Ask it to find your price, order something, change the order and get help, and write down where it stops. That list is your gap, and it will be shorter and more specific than any strategy deck.

Publish the offer as data: products, services, prices, availability and terms, on your own domain, in whatever schema your industry's agents already read. If you sell through Shopify or a similar platform, check that the agent channels are on and the catalogue is complete; the default is now yes.

Open one door and watch it. An API or an MCP server for the three things an agent most wants to do, with logging from day one, so that in a month you know which agents came and what they tried.

Decide what an agent may do without a person: a cap per transaction, a list of what needs approval on your side, and a written unwind for a wrong purchase. Put it on a page called terms for agents. You will be among the first in your category to have one.

Verify before you trust. Adopt the signature standards the card networks use, so that your bot defences can let a registered agent through and keep blocking everything else. Then stop treating every automated request as an attack.

Give agents a way to reach a person: a handover path with the context attached, not a CAPTCHA followed by a chatbot.

If you want a second pair of eyes on where your business stops an agent, that is a two-week piece of work and the [work with me](/work-with-me/) page has the shape of it. The rest you can do yourself, this quarter, and I would start with the first item today.

## Sources

- Checkout.com, [Consumer demand for AI shopping is forming fast but trust for agentic commerce is still catching up](https://www.checkout.com/newsroom/consumer-demand-for-ai-shopping-is-forming-fast-but-trust-for-agentic-commerce-is-still-catching-up), press release, 9 June 2026, and the report [Agentic Commerce 2026](https://www.checkout.com/guides-and-reports/agentic-commerce-2026): more than 12,000 consumers and heads of payments across six markets; 3 percent of UK and US merchants' transactions involving agents; 89 percent preparing; 42 percent testing; 72 percent expecting faster adoption than merchants are ready for; 75 percent on real-time revocation; £177 average spend without approval; 57 percent would let an agent switch brands.
- PYMNTS Intelligence, _Will the 2026 Shopping Season Go Agentic?_, reported in [AI makes the holiday shopping list, but who gets the sale?](https://www.pymnts.com/news/artificial-intelligence/2026/ai-makes-the-holiday-shopping-list-but-who-gets-the-sale/), 15 September 2026: 2,061 US consumers and 60 US retail merchants, fieldwork September 2025 to August 2026; the 93 percent, 80 percent and 28 percent merchant figures.
- Bishop, T., [Amazon blocks Meta's Muse AI assistant in new standoff over agentic shopping](https://www.geekwire.com/2026/amazon-blocks-metas-muse-ai-assistant-in-new-standoff-over-agentic-shopping/), GeekWire, 20 September 2026: the 8 September launch, the App Store ranking, the 20 September block, the notice wording and Amazon's reasons.
- Shopify, [Selling everything, everywhere, all at once: the Spring '26 Edition](https://www.shopify.com/news/spring-26-edition-merchant), 17 June 2026: Catalog and the Universal Commerce Protocol enabled by default for eligible merchants; ChatGPT, Gemini and Copilot as channels; AI searches on Catalog converting at twice the rate of scraped data.
- Stripe, [Everything we announced at Sessions 2026](https://stripe.com/blog/everything-we-announced-at-sessions-2026), 29 April 2026: the Agentic Commerce Suite, Shared Payment Tokens, Issuing for agents, Radar bot abuse prevention, agent guardrails, the Universal Commerce Protocol with Google, and Patrick Collison's remark on agents and online transactions.
- Mastercard, [Mastercard expands Agent Pay with new trust and intelligence services](https://www.mastercard.com/vn/vi/news-and-trends/press/2026/september/new-trust-and-intelligence-services.html), press release, 30 September 2026: the agent probability score in US testing; Know Your Agent with Skyfire; one in ten consumers routinely using agents to buy by 2030.
- Lohe, R. and Allen, W., [Securing agentic commerce: helping AI agents transact with Visa and Mastercard](https://blog.cloudflare.com/secure-agentic-commerce/), Cloudflare, 24 October 2025: Web Bot Auth, HTTP message signatures (RFC 9421), Visa's Trusted Agent Protocol and Mastercard's Agent Pay.
- Waller, C. J., [Payments in the Age of AI Agents](https://www.federalreserve.gov/newsevents/speech/files/waller20260929a.pdf), speech at Sibos 2026, Miami, 29 September 2026.
- Business Standard, as reported by Outlook Business, [India plans AI-powered UPI payments framework through Unified Agent Protocol](https://www.outlookbusiness.com/news/india-plans-ai-powered-upi-payments-framework-through-unified-agent-protocol), 9 July 2026: the protocol's scope, NPCI's role, the first expected use cases, and UPI's June 2026 volumes (22.71 billion transactions, ₹28.92 trillion, 63.5 percent person-to-merchant).
- Gartner, _Gartner Unveils Top Predictions for IT Organizations and Users in 2026 and Beyond_, press release, 21 October 2025, as reported by [Digital Commerce 360](https://www.digitalcommerce360.com/2025/11/28/gartner-ai-agents-15-trillion-in-b2b-purchases-by-2028/), 28 November 2025: agents intermediating more than 15 trillion dollars of B2B spend by 2028 and 90 percent of B2B purchases within three years.
- Scheibenreif, D. and Raskino, M., [When Machines Become Customers](https://www.gartner.com/en/publications/when-machines-become-customers), Gartner: CEOs expect machine customers to account for up to 20 percent or more of revenue by 2030.
- Forrester, [Predictions 2026: the "agentic commerce" race, and some potential regrets, in digital commerce](https://www.forrester.com/blogs/predictions-2026-the-agentic-commerce-race-and-some-potential-regrets-in-digital-commerce): 20 percent of B2B sellers forced into agent-led quote negotiations.


## Questions people ask

**Is this only about e-commerce?**

No. Shopping is where the numbers are first, because payments companies publish them. The same thing is happening in procurement, support, bookings, insurance and banking. Gartner expects agents to intermediate more than 15 trillion dollars of B2B spend by 2028, and Forrester expects a fifth of B2B sellers to face agent-led quote negotiations in 2026. Any business with customers has agent customers coming.

**Will agents just scrape my website anyway?**

Some will, and that is the problem. An agent that reads your site like a browser is slow, brittle and indistinguishable from a bot you want to block. The point of being agent-ready is to give the agent a better path than scraping, one where it identifies itself, pays properly and can be held to your terms. Shopify's data suggests AI searches that use a structured catalogue convert at twice the rate of those using scraped data.

**Should I block agents until the liability question is settled?**

Blocking agents is a decision to lose the customers who send them. In the Checkout.com survey, 57 percent of consumers would let an agent switch brands for better value, so a blocked agent simply buys from the business next door. Write the terms you need, cap what an agent may do, and let it in through a door you control.

**What is the difference between agentic commerce and agents as customers?**

Agentic commerce is the payments industry's name for agents buying things. Agents as customers is wider. It covers the agent that raises a support ticket, requests a quote, books a slot, checks an order, renews a policy or reconciles an invoice, and it includes the agents other businesses run, not only the ones consumers use.


---
Sunil Kumar, Co-founder and CEO, Ailoitte Technologies. https://sunilkumar.ai/about/