Businesses Treat Your AI Agent 3 Different Ways

We are entering an era where we no longer have to navigate every website ourselves. Instead, we can send AI agents to handle the tedious parts of digital life, like booking a flight, checking a bank balance, or ordering groceries. The agent acts as a proxy, stepping into the customer's place to execute a task. The same pattern also shows up in Then I Watched Claude Pay It, where the practical question is how the signal becomes visible.

This shift creates a fundamental problem for businesses. If a website cannot distinguish between a human user and an AI agent, it cannot decide how to treat that visitor. Recently, three major companies demonstrated three entirely different philosophies on how to handle this transition. Their choices reveal a tension between security, risk, and user experience. A useful companion note is What AI Says About Your Locations, because it looks at a nearby part of the same system.

The Spectrum of Access: Blocking, Risk Shifting, and Profiling

The first approach is the most rigid: total exclusion. JPMorgan Chase has taken a hard line, with CEO Jamie Dimon stating during a Q3 2026 earnings call that the company will not allow outside agents to enter their systems. They aren't alone in this; reports indicate that Charles Schwab and Delta are also blocking agents from accessing accounts or booking tickets.

The second approach is passive, which effectively shifts all risk onto the consumer. When a business does nothing to identify agents, the agent simply signs in using the customer's credentials. Bank of America has addressed this by warning customers against sharing logins with AI agents. Their stance is clear: if you give an agent your credentials and something goes wrong, you are responsible for the resulting activity.

To mitigate the danger of sharing passwords, tools like 1Password for Agents have emerged. These allow a user to approve a login request, and the software fills the credentials directly into the sign in form without ever handing the password to the agent. However, this solves the password leak problem without solving the identification problem; the website still sees a customer, not an agent.

The third approach is a middle ground: the dedicated profile. Walmart is implementing a system where agents get their own separate profile within a customer's account. This allows the agent to operate with specific constraints, such as a set spending limit (for example, $50 or $200) or a requirement for approval on every purchase. Agents see the same pricing as humans, but those that violate rules are blocked.

Expert Interpretation: The tradeoff here is between friction and control. Blocking agents is the safest security posture but creates the worst user experience. Shifting risk to the user is the easiest technical path but leaves customers vulnerable. Walmart's profiling approach is the most sophisticated because it acknowledges that an agent is a distinct entity acting on behalf of a human. For any business owner, the decision to inspect here is whether your current security stack is making these choices for you by default. This connects with Working Framework when the same signal needs a clearer operating decision.

Why Agents Cannot Be Treated as Customers

It is tempting to think that an agent is just a faster version of a human, but their behavior is fundamentally different. The most basic distinction is the scale of interaction. An AI agent might browse every single page on a website in seconds, something no human customer would ever do.

Because agents behave differently, treating them as the customer is a mistake. Consider the analogy of sending a dog to a local market with a specific amount of money. The dog is there to perform a task for you, but the transaction only works if the shopkeeper knows who sent the dog and how much the dog is allowed to spend.

In this scenario, the spending limit is the financial guardrail, and the profile is the identity link. If you block the agent, you prevent the customer from using a tool they value. If you allow a shared login, you hide the agent's identity, making it impossible to track agent specific behavior or apply different rules to the bot than you would to the human.

Expert Interpretation: This matters because your analytics and security triggers are likely tuned for human behavior. If an agent signs in as a human and scrapes 500 pages in a minute, your system might flag it as a malicious attack or a glitch. By separating the agent's identity from the customer's, you can create a separate set of "normal" behavioral baselines for bots, reducing false positives in your security monitoring.

The Window of Opportunity for Decision Making

While the conversation around AI agents is loud, the actual volume of traffic is still relatively low. DoorDash CEO Tony Xu noted in a Q3 call that outside AI agents have placed only a few hundred orders in total. To put that in perspective, DoorDash handled 993 million orders in that same quarter, averaging over 10 million per day.

This gap between the hype and the actual usage gives businesses time to decide their strategy before it becomes a crisis. Currently, the industry is still drafting the rules for how agents should identify themselves. Meta and the AI customer service company Sierra are developing the Personal Agent Protocol, with over 40 companies contributing to the framework.

A key part of this evolving protocol is the recommendation for agents to use Web Bot Auth. This would allow an agent to prove which company is running it, providing a layer of transparency. Interestingly, data from the bot protection firm DataDome suggests that Meta's Muse agent has already begun signing some requests this way, despite no official announcement.

Expert Interpretation: The current lack of volume is a strategic advantage. Most businesses wait until a technology is ubiquitous before planning for it, but by then, they are forced to react to the technology rather than shape their own policy. The decision to inspect now is whether your current bot protection software is silently blocking these agents or letting them through undetected. If you don't know, you aren't managing your AI strategy; your software vendor is.

Preparing Your Infrastructure for the Agent Era

Before AI agents arrive in significant numbers, there are three practical steps to take to ensure you aren't caught off guard.

First, audit your current bot protection software. You need to know exactly how it handles AI agents today. Does it block them outright, allow them through as humans, or can it actually distinguish between the two? Many businesses assume their security is "handling it," but they rarely know the specific logic being applied.

Second, define your own policy. Decide whether you want to block, risk shift, or profile. Writing this down now prevents a situation where your platform or security vendor makes a default choice that contradicts your business goals. If you want to encourage AI driven commerce, a default "block all bots" setting is a liability.

Third, instruct your technical team to monitor for agents that sign their requests. By watching for signatures like those in the Personal Agent Protocol or Web Bot Auth, you can identify which companies are sending agents to your site. This gives you a real time map of who is attempting to interact with your business via AI, allowing you to move from a reactive posture to a proactive one.

If you cannot tell the difference between an agent and a customer, you lose the ability to control the experience, the risk, and the data. The goal is not necessarily to stop the agents, but to ensure that when they arrive, they do so on your terms.