Let’s talk about the gate that went up at the checkout this month.
Picture the morning it starts to matter. A woman in Randburg is late for a site meeting, one hand on the car door, and she tells her phone: order the nappies, the dog food, the coffee. Keep it under nine hundred rand. Nothing arrives after Thursday.
The agent goes to work.
Then it hits a door.
At Amazon it doesn’t get in at all. Amazon closed that door in the third week of September, when Meta’s new personal agent, Muse, started showing up on Amazon.com and Amazon blocked it outright. At Walmart it gets in — but only through a gate Walmart built, on terms Walmart wrote, and it can only spend what she authorised, at a limit she chose. At Google the cart fills up and Google holds it.
Three retailers. Three different doors. Five weeks.
And under all of it sits the thing worth your attention: the shelf just became an API call, and somebody is standing at every one of them.
Look at how fast this happened, because the speed is the story. Meta launched Muse on 8 September. Amazon blocked it within two weeks, and the reasons it gave were not subtle — Meta didn’t tell them, the agent doesn’t identify itself when it browses, and it appeared to capture and store customer credentials. On 29 September Shopify switched something called WebMCP on by default for every storefront on its platform. Not opt-in. On. Which means millions of shops quietly became machine-readable endpoints with zero configuration from the merchant. Meta and Sierra published an agent protocol on 6 October built on OAuth, where a shopper grants an agent permission levels running from read-only browsing all the way to full checkout. On 15 October Google launched Universal Cart across Search and Gemini — one cart that holds items from several retailers at once, tracks price drops, and lets you pay with Google Pay or hand the items back to the merchant. Then on 21 October Walmart did the thing everyone will copy.
Walmart opened the gate.
Not a metaphor. An actual server — an MCP gateway — that approved agents connect to. It has identity checks, permission controls, category restrictions, rate limits. Alongside it, Agent Profiles: each agent gets its own profile inside your account, starting next month, so its purchases sit separately from yours. You set the limit. Fifty, a hundred, two hundred dollars. You approve every purchase, or you don’t. You can switch it off at any time. Walmart’s own analogy is adding someone as a cardholder on your credit card. And then this line, which I want you to sit with:
“We price products, not people.”
That’s aimed at somebody. It’s a promise that the price the agent sees is the price the human sees. After two years of reading about engines that price each of us differently by the hour, a retailer standing up and saying the robot gets the same number as you do is a real position, and it costs them money to hold it.
So that’s the news. Now the two things almost nobody is saying.
The first is what Walmart’s gate doesn’t hand over.
Read the mechanism carefully. The gateway helps the agent find the customer’s usual items — the sourdough, that specific brand of milk — without sharing her broader shopping history. That sounds like privacy. It is. It’s also the most commercially intelligent sentence in the whole announcement.
Because the taste profile is the asset. If your agent knows what your household has bought for three years and can carry that memory to any store on earth, then Walmart is a warehouse with a website, competing on price and delivery. If the history stays inside Walmart, and the agent only gets enough context to complete one transaction, then the agent is a terminal — a card reader with a personality — and Walmart keeps the thing that makes it irreplaceable.
So “open” doesn’t mean open. It means: come spend, don’t learn. A counter with a shutter on it.
The second thing being missed is that Amazon isn’t wrong.
It’s inconvenient, and it’s self-interested, and the ad business underneath it would very much like agents to stay outside the store. All true. But the technical objection holds. The web has exactly one primitive for “this is a shopper”: a login. And an agent holding your login is you. There is no way for Amazon’s systems to distinguish your authorised agent from someone who bought your password in a Telegram group — because both look identical: a session that says it’s you, behaving slightly unlike you.
Which means the gate isn’t only a toll booth. It’s currently the only place in the entire stack where anyone can ask two questions: who is this, and what were they allowed to do?
That’s not a retail problem, it’s a missing layer. There is still no common way to hand a machine a mandate — a signed, specific, bounded permission. Nine hundred rand. Groceries and pet food. Until Thursday. Revocable at the source. And notice that everything shipping right now is an attempt to build exactly that: Google’s commerce protocol, OpenAI’s, Meta and Sierra’s, Visa’s agent protocol, Walmart’s gateway terms, the verification firms selling agent identity at checkout. Multiple standards, one contested primitive.
And here’s where standards wars actually get decided, because it isn’t in the press release. Whoever writes the spec decides what’s expressible. If the protocol has no field for “this buyer already owns one of these”, no agent can ever know it, no matter how smart it gets. If the spec has no field for “the human said no to this category”, then consent can’t travel — only permission as the gate chooses to phrase it.
Open standards get donated. The gates get kept. That’s not cynicism, that’s just the shape of the deal.
Now — the numbers, because they tell you how much runway is left. Adobe forecasts AI-referred traffic to US retail sites up 130% this holiday season, and in August AI-referred visitors converted 48% better than everyone else. So discovery through a machine is already mainstream. Execution isn’t. L.E.K. found 8% of AI users have bought something entirely through an agent, and only about a tenth of AI-assisted purchases actually close inside the chat. Ninety-four percent of people check the machine’s answer before they buy.
Read that gap properly. The decision is already being made inside a machine. The transaction is still being made by a human. That gap is where the next two years of competitive advantage live, and it is closing.
So if you run a business, five things, and they’re not abstract.
One. Your product page is a data sheet now, whether you like it or not. An agent doesn’t read your brand story, it matches attributes. Dimensions. Materials. Compatibility. What’s in the box. Stock level. Lead time. Returns window. Warranty. Landed cost to the city the buyer is actually in. The listing that answers the question wins over the listing that has better adjectives. If your data is vague, you don’t get marked down. You get invisible.
Two. Price the whole basket. The agent compares landed cost, which means shipping that appears at step four, bundles that hide the unit price, and “contact us for pricing” all quietly drop out of the shortlist. You won’t get an error message. You’ll just see fewer orders and assume the market got worse.
Three. Write your own agent terms this quarter. One page. Who may transact with you, at what limit, what you log, who can revoke, and what happens when an agent disputes an order. If a customer’s agent buys from you next month and something goes wrong, you want that page to already exist — because the alternative is discovering your policy in a support thread at 11pm.
Four. Segment AI referrals in your analytics today. If you can’t tell an agent-arrived customer from a Google-arrived one, you will misread your own conversion data for a year and blame the wrong channel for it.
And five. Keep one human channel alive. The gate can compress your entire offer into a single line. It can’t vouch for you. Which is why the customers who call because somebody told them to call — that’s the distribution no gate can meter, and it’s about to become the most valuable thing you own.
You’ve got this. Write the page.
Last thing, and it’s the reason this show exists.
The reasonable-sounding version of all this is: the gate verifies the agent, the agent carries your mandate, the retailer serves the request. Clean. Efficient. Everybody protected.
But notice where the memory lands. Her three years of groceries — the pattern of what her family eats, what she skips when money is tight, what she buys when someone’s sick — that record stays with the counter she happens to be standing at. She can revoke the permission. She can’t take the knowledge with her.
Consent that only controls access, and never ownership of what the access produced, isn’t really consent. It’s a lease.
So the thing to insist on, while the terms are still being written by people who will listen for another six months: a mandate you can read, that expires, that you can kill at the source, and that works at the next store without asking permission from the last one. Your purchase history should belong to you. Not to the counter.
She’ll get her nappies before Thursday either way. What she shouldn’t have to hand over for it is the right to be the one who knows what she bought.