Make Your Website Ready for AI Agents: Access, Data, Limits
Agentic commerce, the buying and booking that AI agents do on a person’s behalf, reached the front door of large retailers in the fall of 2026, and they started choosing which agents get in. This article explains how to make your website ready for AI agents in three parts: letting the right agents through your bot defenses, stating the facts an agent compares as readable text and data, and deciding what an agent may do before money moves.
The clearest case so far is Amazon. On September 20, 2026, twelve days after Meta released its Muse personal agent, Amazon said Muse could no longer place orders on Amazon.com for anyone. Shoppers who tried got a pop-up:
“Continued access by an unauthorized AI agent violates Amazon’s Conditions of Use, to which our customers have agreed.” - Amazon, as reported by PPC Land
PPC Land’s October 8 summary of GeekWire’s reporting lists Amazon’s complaints: Meta never asked, the agent does not identify itself while it browses, and it appears to keep customer login details. Meta has said Muse cannot see passwords or payment methods, and the two accounts have not been reconciled. The pop-up makes a contract argument, not a hacking one: in August 2026 the Ninth Circuit found, in Amazon’s suit against Perplexity’s shopping agent, that the user rather than the AI company was the one accessing Amazon’s systems under federal anti-hacking law.
Not every refusal is a strategy. TechCrunch asked several companies in early October. Delta said no third-party agent has a partnership to book its flights and that it acts against unauthorized automated activity. Yelp admits non-human traffic only through its paid data licensing program. Walmart, a Muse launch partner, said agent failures on its site were unintended: a button that asks visitors to prove they are human could interrupt the agent and throw it out. Zillow said it welcomes agents acting for consumers, though its anti-scraping tools sometimes block them anyway.
Greg Isenberg, who advises companies on AI, calls this a war on agents and sorts sites into those that block on purpose, those that block by accident and those that welcome agents. His shorthand for the new visitor is worth keeping:
“an agent is a customer with a credit card and no eyes” - Greg Isenberg
The phrase overstates today’s agents, most of which still drive a browser and do see the page, but it describes where things are heading.
Bot defenses block AI agents unless you decide otherwise
The accidental block is the easiest one to fix, because it is usually a setting. Bot protection was built to stop scrapers, and an agent working for a customer looks like one: an automated client requesting pages quickly. Unless the agent identifies itself, the defense has nothing to separate it from a competitor harvesting prices.
Cloudflare made the choice explicit in 2026. On July 1 it split AI traffic into three categories that every customer, Free plan included, can set separately: Search, for crawlers that index content; Training, for crawlers that collect it for models; and Agent, which its changelog defines as automated activity acting in real time for a person. Each category can be allowed, blocked on every page, or blocked only on pages that display ads. Since September 15, 2026, newly onboarded domains start with Training and Agent traffic blocked on ad-supported pages while Search stays open. Unverified bots, Cloudflare’s announcement adds, remain blocked by default.
Cloudflare’s AI traffic categories and the default applied to new domains since September 15, 2026. Source: Cloudflare changelog and blog, July 1, 2026.
The practical step takes a few minutes. If your site runs behind Cloudflare, open Security Settings, then Configure AI bot policies, and set the Agent category on purpose instead of inheriting a default. With another bot protection vendor, find its category for user-directed agents and make the same decision.
Then walk the path from product page to checkout and count the human checks. Walmart’s failure came from a verification button, not from a policy. Every CAPTCHA, cookie wall or interstitial on that path can stall a browser-driving agent, and the loss never shows in sales reports because the order never happens.
Signed requests let a site tell an assistant from a scraper
Identification is the step Amazon says Muse skipped, and the industry is standardizing it as Web Bot Auth. The agent’s operator publishes a public key at a well-known address and signs each HTTP request with the matching private key, following HTTP Message Signatures (RFC 9421). The site, or the network in front of it, checks the signature against that key. A user-agent string is easy to fake; a valid signature requires the operator’s private key.
Cloudflare opened a signed agents category on August 28, 2025, with ChatGPT agent among the first members. Its verified bots documentation, updated October 8, 2026, now folds signed agents into verified bots and labels each one Direct, when a single operator runs it, or Intermediary, when many end users operate it through a shared service. Web Bot Auth itself is still an IETF draft, not a finished standard.
The card networks build on the same layer. In October 2025 Visa introduced its Trusted Agent Protocol and Mastercard its Agent Pay, both relying on Web Bot Auth to authenticate agents registered with the network. The signed request carries one tag for browsing and another for paying, so a merchant can recognize the agent both when it checks product details and cost and when it buys.
A signature proves which operator sent the request, not that the person behind it wanted this particular purchase; that question belongs to payment limits, below. For access, my own reading of these protocols is that a reasonable policy lets signed agents browse and keeps treating unsigned automated traffic like any scraper. No vendor document I read prescribes that exact rule.
AI agents compare what your page states in text
Once inside, an agent compares offers on the facts it can extract. Isenberg’s list is short: product details, price, shipping cost and return terms. Two published specifications formalize that list.
OpenAI’s product feed specification for ChatGPT shopping requires nine fields for discovery: item ID, title, description, URL, brand, seller name, image URL, availability and price. Shipping, returns and product identifiers are optional, and the details are instructive. A missing shipping price means unknown, not free. A link to a return policy does not tell the agent that returns are accepted; that takes a separate yes-or-no field, with the return window given in days. GTIN and manufacturer part number are optional, and the spec tells merchants not to invent a part number to stand in for a missing GTIN.
Google’s merchant listing structured data, last updated September 8, 2026, asks for the same facts as schema.org markup on the product page. Price and currency are required. Shipping details and a return policy are recommended, and the shipping details carry a delivery time split into handling days and transit days. The return policy markup can be declared once for the whole organization or overridden for a single product.
The lesson is not to adopt a feed format but to make sure each fact that decides a purchase exists as text: the total price including shipping, the delivery date, what the product works with, and how returns work. A compatibility table locked in a PDF, or a delivery date that appears only on the last checkout step, is invisible to an agent weighing five suppliers. For replacement parts, the compatible model numbers belong in the page text, since a model number is exactly what a buyer hands the agent.
A faster delivery only wins if the agent can read it
Isenberg argues that agents will not turn every market into a race to the lowest price, because the person giving the instructions still cares about speed and reliability. His example pits a supplier that charges more but ships tomorrow against a cheaper one that needs three weeks. If the agent can see only the price, the faster supplier loses a sale it should have won.
Google’s delivery time fields exist so that a next-day promise can be read by a machine. OpenAI’s feed has no such field, and its spec warns that a shipping amount guarantees no delivery date, so for agents reading that feed the date must appear on the product page itself. Whatever your edge is, whether short lead times, local stock, a longer warranty or a part that fits older models, it needs a sentence or a field the agent can repeat to its user.
Different AI agent permissions to research, prepare and pay
Isenberg describes the agent climbing a ladder of trust: research first, then preparing an order, then paying. Businesses have little reason to fear the first rung, which is search under another name. The real risk sits on the last one, and blocking all three to avoid it throws away the first two for nothing.
The risk of an agent purchase concentrates on the payment rung, so the strictest control belongs there and nowhere else.
Google’s Agent Payments Protocol, announced on September 16, 2025 with more than 60 partner organizations, turns that ladder into signed records called mandates. When the person is present, their request is recorded, the agent proposes a cart, and the person’s approval signs the exact items and price. When the person is absent, they sign a detailed intent in advance, with a price ceiling and timing, and the agent may complete a cart only inside it. The chain of signed records is meant to show afterwards who authorized what. The current AP2 site has since renamed the records checkout and payment mandates and moved standardization to FIDO Alliance working groups, so the vocabulary is still moving.
You do not need AP2 to apply the idea. Let any identified agent research freely. Let it fill a cart or request a quote. Before money moves, require a step the agent cannot complete alone: the customer’s confirmation, a signed mandate where your payment provider supports one, or a manual review above an order value or quantity you set. It is the same principle as keeping AI agent permissions outside the model: the rule lives in your system, not in the agent’s good behavior.
Delta’s caution belongs here. An airline that cannot prove a traveler authorized a booking has a fraud problem, and when something goes wrong the customer calls the airline, not the company that built the agent. Google’s own announcement lists accountability for fraudulent or incorrect agent transactions as an open question. Keeping the payment rung closed until that question has an answer can be the responsible choice, provided the first two rungs stay open.
A website ready for AI agents starts with a test, not a project
The cheapest first step comes from Isenberg’s video and needs no code. Take ten real buying questions from your support inbox, such as whether a part fits an older model or whether twelve units can ship this week. Run them through a few different agents and write down where each one stalls: a refused request, a human check, a missing delivery date, an unreadable compatibility table. Then repeat the exercise on a competitor’s site.
The results tell you which of the three parts needs work. A refusal points to a setting, a wrong answer to missing text, and an agent that stops at checkout to a payment rule you have not decided yet. None of this depends on which protocol wins: Web Bot Auth is still a draft and AP2 keeps changing its vocabulary, while a readable offer and a deliberate access policy hold up under any of them.