JTSTech Services
← All articles

E-commerce · November 13, 2026 · 10 min read

On Tuesday United wrote "no AI agents" into the contract every passenger accepts. From 24 November Wells Fargo will treat whatever your agent does as something you did. Two answers to the same question, and your store has a third one that neither of them has.

On 11 November United Airlines became the first large consumer brand we have seen put an AI-agent ban in the customer contract rather than at the firewall. A new prohibited practice covers any assistant, agent or AI-enabled browser that books, changes or buys on a passenger's behalf, whether or not a human is watching, and it reaches agents that arrive through travel agencies too. Thirteen days later Wells Fargo's updated online agreement takes effect and goes the other way: an agent with your password is you, the bank does not watch what it does, and if you ever cut it off you must keep the proof. Both are answers to a question most stores have never written down. The difference is that an airline and a bank only have two options, and a store on Shopify or WooCommerce has a third.

Written by Jeremy Souffir Founder, JTS Tech Services

The direct answer first. On 11 November United Airlines published a short release titled United Restricts Access for Third-Party AI Agents and updated its contract of carriage, the document every passenger accepts by buying a ticket. The new text adds a prohibited practice: the use of AI agents to make, modify or service a ticket, or to purchase any product or service, with a definition wide enough to include an AI-enabled browser and software that acts while a human supervises and approves. United's stated reasons are that sharing account credentials with personal AI assistants can expose sensitive information, that these tools may result in unintended purchases, account changes or use of MileagePlus miles, and that automated actions could breach FAA and DOT rules, because check-in requires a human to confirm that a bag holds nothing banned. Thirteen days later, on 24 November, Wells Fargo's updated Online Access Agreement takes effect with a new section on AI agents that takes the opposite route: anything an agent does with your sign-in is deemed to have been initiated and authorised by you, the bank does not monitor agent activity, your use of an agent is at your own risk, in capitals, and if you revoke an agent's access you must keep evidence of having done so and produce it on request. Two of the largest consumer businesses in North America have written an agent policy into their customer terms within a fortnight of each other, one a ban and one a transfer of liability. The reason this matters to a store is that neither is the policy a store should copy, and the reason for that is the thing United and Wells Fargo do not have: a channel built for agents that never touches the customer's password.

What did United actually change?

The release is four paragraphs and names no executive. The substance is in the contract of carriage, which One Mile at a Time reproduced on 11 November; United's own contract page refused our automated read, so the wording below is as reproduced there. Read together with the release and TechCrunch's report on 12 November:

  • The prohibited practice. The contract's list of prohibited practices gains a new entry: the use of AI agents to make, modify or service a ticket, and/or to purchase any service or product. Prohibited practices are the section whose breach lets an airline cancel a ticket, and several outlets reported that bookings handled by an agent can be cancelled without notice. The release itself does not describe enforcement.
  • The definition. An AI agent is any software or service, including an AI assistant, AI agent or AI-enabled browser, that takes autonomous or semi-autonomous action, whether or not the passenger or another individual supervises or approves its actions, to discover, search for, book, purchase, ticket, service or manage any product offered by or through United. Two words in that sentence do most of the work. Supervises means a person watching the agent click does not make it legal. Discover means a tool that only searches is, on the text, caught too.
  • The reach. The definition includes any third-party AI assistant that reaches United through a tool, application or connection provided by a travel agency or other intermediary, and the release says the restriction applies directly within United's digital platforms and indirectly via travel agencies and aggregators, with updates to its booking, ticketing and distribution policies. An agent that avoids united.com and books through an agency feed is still in breach.
  • The reasons. Three, in United's words: credentials shared with personal AI assistants can expose sensitive information; actions taken by these tools may result in unintended purchases, account changes or use of MileagePlus miles; and automated actions have the potential to violate FAA and DOT regulations, with flight check-in given as the example, since it requires human acknowledgment that bags do not contain banned substances like explosives.
  • The invitation. The release says corporate leaders in banking and retail have taken similar actions and encourages others to consider measures of their own. It also promises an update to United's Digital Trust Center explaining what the restrictions mean for customers and where to get help if an agent takes an unintended action, which is an airline conceding that the ban will not stop every agent.
  • What is not said. How United will tell an agent from a person, how many bookings have come from agents so far, whether price-tracking and award-search tools will be pursued under the word discover, and whether United intends to offer an official route for agents later. The release says only that United will continue to evaluate how these tools interact with its services.
Three doors, three policies. On the left, the airline's door: closed to agents outright, with the ticket in the passenger's own hand. In the middle, the bank's door: open to an agent carrying the customer's own key, with the weight of anything that goes wrong sitting on the customer. On the right, the store's third door: a separate agent gate beside the customer entrance, where the agent arrives with a key of its own and the customer presses the confirm button.
Three doors, three policies. On the left, the airline's door: closed to agents outright, with the ticket in the passenger's own hand. In the middle, the bank's door: open to an agent carrying the customer's own key, with the weight of anything that goes wrong sitting on the customer. On the right, the store's third door: a separate agent gate beside the customer entrance, where the agent arrives with a key of its own and the customer presses the confirm button.

What did the banks do, and why does it belong in the same story?

United's release points at banking for a reason. The sequence there ran a month ahead. On 22 October, Axios reported that JPMorgan Chase, Bank of America, Citi and Morgan Stanley had restricted third-party AI agents from customer accounts. On 27 October Bank of America emailed customers under the heading Protecting your finances in the AI World, telling them not to share banking usernames or passwords with AI assistants or agents, including tools that offer to act on their behalf, and warning that a customer who did so could be held responsible for the result, subject to applicable consumer protections. Then on 2 November American Banker reported the Wells Fargo change, and the agreement itself is public. Its Section 15, titled Third-Party Artificial Intelligence Agents or Agentic AI, is the clearest statement yet of the second answer to the agent question, so it is worth quoting exactly:

  • The definition, 15(a): an AI Agent is any software, application, program, or other technology that takes autonomous, semi-autonomous, or non-autonomous action on behalf of any person or entity. Non-autonomous is in there. A tool that does only what you tell it, step by step, is still an agent.
  • Deemed authorised, 15(d): any instructions, actions, or transactions initiated by the AI Agent are deemed to have been initiated and authorized directly by you, without further verification, and the bank may rely on them as valid and binding and as evidence of your authorization.
  • No monitoring, 15(e): you acknowledge that we do not monitor, screen, or review AI Agent activities, including any transactions initiated by an AI Agent. Your use of any AI Agent is AT YOUR OWN RISK. The capitals are the agreement's.
  • The revocation receipt, 15(f): if you withdraw an agent's access, you must retain evidence of such revocation and must provide such evidence to us, at our request. Until the bank is told, the customer remains responsible. Elaine Duffus of Wolters Kluwer put the obvious question to American Banker: what happens to a customer who did everything the bank asked, has a pile of evidence of telling the agent to stop, and the agent went rogue anyway.
  • The reserved powers, 15(g): the bank may change its security procedures, including requiring that you register your AI Agents with us, and may limit, prohibit, prevent, suspend, or terminate access by any AI Agent to the service or any account. The ban United chose today is a switch Wells Fargo has kept in the drawer.
  • The qualifiers. Each of these is prefaced with unless otherwise provided by law or regulation, or to the extent permitted by law or regulation. In the United States, Regulation E still governs unauthorised electronic transfers, and no court or regulator has yet said how it applies to an agent a customer invited in. The clause is the bank's opening position, not the last word.

Put the two documents side by side and the shape of the choice is plain. United says: you may not. Wells Fargo says: you may, we will not watch, and it is on you. Both are rational for a business whose only way to let an agent in is to let it borrow the customer's password, because that is the one thing both documents are really about. United names credential sharing as its first reason. Wells Fargo's section 17(c) says that permitting an AI agent access may adversely impact the commercially reasonable security procedures the whole agreement rests on. Neither company has a door for agents that is not the customer's own door, so each has to decide what happens when the customer hands over the key. One took the key away. The other made the customer own whatever the key does.

Why is a store not an airline?

Because a store has a third door, and it has had one for months. The shopping agents that matter to a Shopify or WooCommerce merchant do not need the customer's password to buy. ChatGPT's checkout and Google's checkout in AI Mode and Gemini run on protocols, Agentic Commerce Protocol and Universal Commerce Protocol, in which the agent talks to the store's own endpoint, the store stays the merchant of record, payment travels as a token scoped to that one order, and the customer confirms the purchase inside the assistant. We walked through both in July, and in September we showed that a Shopify store has been exposing a toolkit built for agents since August. On the sign-in side, the Personal Agent Protocol that Sierra and Meta published on 6 October, with Shopify, Stripe and Walmart among the founding partners, exists precisely to replace the habit United and Wells Fargo are legislating against: instead of the agent signing in as the customer, the customer signs in on the store's side and grants the agent a read-only or write scope the store controls. None of this is available to an airline booking through a global distribution system or a bank under Regulation E. All of it is available to a store today, mostly as settings it already has.

That changes what a store's terms should say. United had to ban agents because the only agent it can imagine is one holding a MileagePlus password. A store can write the narrower rule, the one both companies are actually worried about: no automated tool may sign in with a customer's credentials or act inside a customer account except through the channels we provide, and here is what those channels are allowed to do. That bans the dangerous thing, an agent logging in as your customer and pressing buttons the customer did not see, while leaving the door open for the agents that recommend you, buy from you through a protocol you joined, and show up in your analytics as the fastest-growing new channel of the year. It also gives you something United's clause does not: a place to put the approval. The Visa test we covered last week found agents failing 43 percent of the kind of requests a customer makes and buying anyway in half those failures. The protocols put a human confirmation step in front of the payment. Your terms can require it.

Borrowed key versus own key. On the left, the agent walks in through the customer's front door carrying a copy of the customer's key, and everything behind that door, orders, addresses, saved cards, is now in its reach, with the customer standing outside. On the right, the agent arrives at a dedicated gate with its own scoped key, sees only what the gate exposes, and the customer stands at the counter with a hand on the confirm button before anything is paid for.
Borrowed key versus own key. On the left, the agent walks in through the customer's front door carrying a copy of the customer's key, and everything behind that door, orders, addresses, saved cards, is now in its reach, with the customer standing outside. On the right, the agent arrives at a dedicated gate with its own scoped key, sees only what the gate exposes, and the customer stands at the counter with a hand on the confirm button before anything is paid for.

Whose words these are, and what we could not check

Four cautions. The United contract wording is as reproduced by One Mile at a Time, whose author also speculates that the real motive is to stop automated repricing and voucher claims; that is the author's view, not United's, and we have not repeated it as fact. United's own release contains no enforcement detail, no numbers and no spokesperson, and the reports that agent-made bookings can be cancelled are coverage of the contract's existing prohibited-practices mechanism rather than a United statement. The Wells Fargo quotations are from the agreement page itself, version effective 24 November 2026, and we read Section 15 in full but not every other section. The 22 October list of banks is Axios's reporting as relayed by a trade publication; we did not reach the Axios piece directly. And the whole argument above rests on a store choosing to use the protocol channels; a store that has not joined any of them is, for agent purposes, in exactly the position United is in.

The two conclusions that both get this wrong

United banned them, so we should too

United's clause is written for a business with no agent channel of its own, a loyalty currency that can be spent by anyone holding the password, and a federal rule that requires a human at check-in. A store has an agent channel, no miles, and no FAA. Copying the ban means writing your terms to exclude the ChatGPT or Google shopper who would have bought from you through a protocol you are already part of, in order to stop a problem the protocol already solved. It also puts you on the wrong side of the one in seven agent visits that now sign in, buy or manage an account, which we covered yesterday. Ban the password-borrowing. Keep the door.

Wells Fargo put it on the customer, so our terms can do the same and we are covered

A bank can write deemed authorised into an agreement because it holds the customer's money and the customer has nowhere else to put a dispute first. A store does not. When an agent buys the wrong size with a customer's saved card, the customer does not read your Section 15; they call their card issuer, and the chargeback lands on you with the fee attached. United's reason number two, unintended purchases, is a merchant cost before it is a customer cost. Liability clauses in a store's terms are worth having, but they are a backstop, and the thing that actually prevents the loss is a confirmation step before payment and a scope that stops an agent changing where refunds go.

The encouraging part

You get to write this on a Tuesday rather than in a press release. Two of the biggest consumer businesses on the continent have just shown you the two policies that exist when there is no agent channel, and both of them conceded in their own documents that agents will get in anyway: United promised a help page for when an agent takes an unintended action, Wells Fargo wrote a revocation procedure. A store with a protocol channel can take the sensible half of each: forbid credential-borrowing like United, make customers responsible for what their own agents do like Wells Fargo, and then add the clause neither of them could, which says where agents are welcome and what they may do there. That is three paragraphs in a terms page and a handful of settings you mostly already have.

What to do this week

  • Read your own terms for the word agent. Most store terms were written for people and bots that scrape. If there is no sentence about automated tools acting inside a customer account, you have no policy, and the default is Wells Fargo's without the paperwork: whatever happens, happens.
  • Write the narrow prohibition. Forbid any automated tool from signing in with a customer's credentials or acting inside a customer account except through channels you provide. Name the channels. This is United's clause with the airline-specific parts removed and the door left open.
  • Decide what the channels may do. For each protocol or agent integration you are part of, write down the scope: read catalogue, build a cart, pay with a confirmed one-time token, view orders, start a return. Decide now whether an agent may ever change an address or a saved card. The Personal Agent Protocol proposal frames this as read versus write; use that split even before the specification lands.
  • Put the confirmation where United cannot. Require a human confirmation before payment in every agent channel you accept, and say so in the terms. The agents got it wrong 43 percent of the time in Visa's test and bought anyway in half of those; a confirmation step is the difference between a cancelled cart and a chargeback.
  • Add the liability sentence, and know its limits. Customers are responsible for the actions of agents they authorise, to the extent the law allows. In Canada that sits under provincial consumer protection law, and for card payments the chargeback rules will decide before your terms do. Write it anyway; it sets expectations and it is what your card processor will ask for.
  • Watch for the borrowed key in your logs. Yesterday's post described what credential-borrowing agents look like at the sign-in page. Any sign-in that passes two-factor and then behaves like a script is an agent holding a customer's password, which your new clause forbids. Decide in advance whether you cancel the order, flag the account, or let it stand under monitoring.
  • Tell customers in plain words. United is updating its Digital Trust Center. Your version is a short help-centre page: which assistants can shop here, how to buy through them, and never give an assistant your password to our store. The customers who will read it are the ones about to do exactly that.

Why this is worth getting help with

The reason to have someone own this rather than paste a clause is that it is not a legal task or a technical one; it is both at once, and the two halves have to agree. The terms you write are only true if the settings behind them match: a clause that says agents may buy only through confirmed channels is a lie if your checkout still accepts an agent holding a saved card through the ordinary customer sign-in, and a clause that bans agents outright is a self-inflicted wound if your Shopify store is already serving the agent toolkit by default. United had the luxury of one answer because it has one kind of door. A store has three doors and has to decide, in writing, what each one is for, then keep the decision current as the protocols change under it, which they will. That is what our Fractional Head of AI and Digital does. We read your terms, your checkout settings and your agent integrations together, write the agent policy as three short paragraphs your lawyer can review and your developer can implement, set the scopes and the confirmation step to match, and then hold the policy as the channels move, so that the next time a bank or an airline rewrites its contract you already know whether it changes anything for you. Retaining us for this is worth it for a simple reason: the two largest consumer businesses to answer this question so far each had to pick the only answer available to them, and your store is one of the few kinds of business that gets a better one, if someone takes the time to write it down.

Sources

← Back to all articles

Keep reading

Security

One marketplace took 414,000 visits in a week from something calling itself a popular AI assistant. Every one went to the sign-in page and every one failed. The agent names you let through so AI shoppers could reach you are now a disguise.

AI Visibility

On Tuesday OpenAI switched on the business hub we saw leaked last week. A Canadian store can claim its listing today. The salesperson that answers in the chat is US-only for now, and the rulebook it will work under is already published. Read the rulebook first.

Strategy

In June an OpenAI agent took figures from a government website that had refused it. This week Australia wrote the first rule for reporting that kind of thing. The rule says the lab tells the government. Nothing in it says anyone tells the site.

Fractional Head of AI & Digital

Write the agent policy your terms are missing, and keep it true.

We read your terms, your checkout settings and your agent integrations together, write the policy as three short paragraphs your lawyer can review and your developer can implement, set the scopes and the confirmation step to match, and hold it current as the protocols move.

Talk about the role