Let’s talk about the one box on the booking form a machine is not allowed to tick.
On Wednesday, United Airlines became the first US carrier to say it out loud: third-party personal AI agents are not allowed to book, buy, or manage travel on its platforms. Not on united.com, not in the app, and not quietly through the travel agencies and aggregators that feed it. Bookings an agent already made before the eleventh are safe. Nothing gets cancelled. But from now on, the assistant does the research and the human does the transaction.
American already had a version of this rule — no unauthorised third-party AI tools without written permission. Delta built its own assistant inside its own app. Southwest went the other way in October and put flight search into ChatGPT. So this isn’t an industry lining up. It’s four airlines making four different bets on the same question, and United is the one that wrote its reasons down in public.
Read the reasons. There are four.
Two are obvious. Sharing your login with an agent exposes your account. And an agent with your account can buy things you didn’t ask for, change things you didn’t want changed, and spend miles you were saving for something else.
The third is timing. United says it wants “standardized, secure technology integrations” with authorisation and accountability built in, and that it hasn’t approved a single third-party agent yet. Fair. Nobody has built the plumbing.
And then the fourth, buried in a FAQ answer most people will scroll past.
Automated check-in, United says, could violate FAA and DOT rules — because check-in requires human acknowledgment that your bags do not contain banned substances. Explosives.
Sit with that for a second.
That checkbox has been clicked a billion times without a thought. You tick it at 05:40 in an airport queue with a child asleep on your shoulder and a coffee you’re about to spill, and you don’t read it, because you already know what it says, and because you are not, in fact, carrying a bomb.
But it is not a formality. It is the one line in the whole transaction where a named person tells the airline something that carries legal weight. The airline is not asking for information. It’s asking for a signature.
A model can fill that box. It cannot give that signature. Not because it isn’t clever enough. Because the entire value of the act is that a person did it and can be held to it. A machine ticking “my bag is clean” is worth exactly nothing, and everyone in the room knows it — including, apparently, the lawyers at United.
So everyone reading this as an airline being anti-AI, or protecting its margin, has the story upside down. United didn’t stop at the hazmat rule. That rule stopped United. The agent got all the way through the funnel and hit the first place where the system needs somebody to be answerable — and the whole delegation collapsed there.
Here’s the part underneath, and it’s bigger than aviation.
The only way your personal agent logs in today is by being you. Your password. Your session. Your one-time code, read off your phone and typed into a chatbot. We spent twenty years building identity systems to answer one question — is this really the human? — and then we handed the answer to a language model and asked it to be careful.
Which means, from United’s side of the counter, an agent you authorised and a stranger who stole your account look exactly the same. Same credentials. Same session. Same request. There is no field on the wire that says “this is Phillip’s agent, it may book, it may not touch miles, it expires Sunday.”
Same for your bank. Same for your medical aid. Same for the insurer you’re arguing with. The difference between delegation and theft is currently invisible to every system that matters.
And United wrote the sentence of the year for this whole mess, in a help-centre FAQ, presumably without meaning to:
“Just because you’ve given access to AI assistants doesn’t mean United will permit an AI assistant to transact with United.”
Read that twice. Your permission is only half of it.
That’s not a corporate quirk. That’s the actual shape of the problem. Consent has two parties — the person granting authority, and the institution being asked to honour it — and we have spent two years building the first half and almost nothing on the second. You can authorise anything you like. The other side still has to be able to see the authorisation, check it, scope it, and refuse it.
Now, be honest about United’s motive. It isn’t pure. CEO Scott Kirby said at a Chicago event, according to the Wall Street Journal, “I don’t want to create another middleman.” That’s the direct-channel argument every airline has made since 1995, and it has nothing to do with your safety. The FTC has also just ordered United, Delta and JetBlue to hand over information about how they use personal data in pricing. So a carrier that wants to keep you in its own app, weeks after a regulator started looking at its pricing, is not your defence attorney.
Both things are true. The ban protects you and it protects their channel. That’s how most good rules arrive — someone’s commercial interest and your actual interest happen to point the same way for one afternoon.
So what do you do with this, as an operator? Three things.
First, find the signature line in whatever you’re automating. Every regulated process has one: the attestation, the declaration, the “I confirm”, the professional who signs. Not the data entry — the part where someone becomes liable. Map it before you build, because that’s your real boundary, and no amount of model quality moves it. Design for a human standing at that line, with everything boring in front of it removed.
Second, stop building on password sharing. If your product asks a customer for their login to somebody else’s system, you are not integrated. You’re impersonating, with permission, and the moment that system gets serious about agents your product stops existing. Ask for scoped credentials instead, and if the other side can’t issue them yet, write that gap down as a risk with a date on it.
Third, make your agent leave a record the other side can check. Not a transcript you generate about yourself. Something outside the agent: the confirmation number in the counterparty’s system, the payment on the bank statement, the email in the recipient’s inbox. If you can’t reconstruct last week’s actions without asking the agent what it did, you don’t have a record. You have a story.
And if you’re just a person with an assistant and a holiday to book, the practical version is smaller. Use the agent to think. Compare the fares, find the odd routing, argue with the calendar. Then be the one who books and the one who ticks the box. It takes four minutes and it keeps the liability where the law already put it.
Here’s the thing I actually take from this week. Somewhere in United’s digital trust centre there is a place where a machine is not allowed to stand. Not because it’s incapable. Because the act means nothing if it does it.
That’s not a failure of the technology. That’s the technology meeting the edge of what can be delegated, and stopping. Most of the AI conversation right now is about how fast the machine can take the next thing. This is a data point in the other direction, and it came from an airline’s lawyers rather than a philosopher, which is why I trust it.
The machine can plan the trip, find the fare, hold the seat, and read you the boarding time. Somebody still has to stand at the counter and swear the bag is clean.
Keep that part. It is the only part of the journey that was ever really yours.