ContentsStart0%
In October 2026, restrictions on outside AI agents made a practical boundary visible: a user’s decision to delegate a task did not automatically give an agent permission to operate the destination platform. The original October 19 article followed The Verge’s October 17 roundup, combining financial-account restrictions with the earlier dispute between Amazon and Meta Muse.
This is an analysis of those reported cases, not a claim that every bank or website blocks all agents. Data sharing, credential-based login and transaction authority should be assessed separately.
Why the bank cases concern more than reading information
JPMorgan rejected agents using customers’ banking credentials while supporting customer-authorized open-banking data sharing, according to its spokesperson in Fortune’s October 15 report.
These access and authorization boundaries are part of Agent Experience (AX): the ability to operate an interface does not establish permission to perform a task.
The distinction matters. A customer can authorize a service to receive an account balance through a defined connection without authorizing it to log in with the customer’s password. Receiving data also does not automatically include initiating a transfer, paying a bill or changing an account setting.
The original article also cited The Verge’s report on Charles Schwab, which relayed chief executive Rick Wurster’s concerns about Muse using customer credentials and about control when an agent makes an error. That source could not be fetched in this adaptation; the case remains explicitly attributed to the original reporting rather than presented as a newly tested bank policy.
| Permission | Example | What still needs separate authority |
|---|---|---|
| Read shared data | Receive an authorized account balance through a defined provider. | Login credentials and account operations. |
| Access an account interface | Use an allowed authenticated session. | Each consequential operation and its limits. |
| Perform a transaction | Initiate an explicitly authorized payment. | Identity, amount, destination, execution controls and error handling. |
The table is an explanatory framework, not a description of a live integration LS-Labs tested. When money is involved, the operator must know which party authorized the action, what the system can do and who handles an erroneous result. Strong language-model performance does not answer those operational questions.
Amazon’s shopping dispute adds the customer-relationship question
In September, Amazon said outside shopping applications should operate openly and respect a provider’s choice to participate. It blocked Muse’s shopping access and said it had requested removal from the experience. The Muse launch analysis covers the original case.
The bank cases emphasize assets, identity and responsibility. Retail adds another incentive: who hosts the search, comparison and purchase journey? A marketplace’s relationship with a shopper includes product discovery, recommendations, reviews and advertising as well as checkout.
Imagine a buyer giving an agent a budget and several requirements. If the agent compares items across sites before sending the buyer to Amazon for the final order, the purchase can remain with Amazon while some comparison activity takes place elsewhere. The marketplace may lose some opportunities to display recommendations or ads during that earlier stage.
That is an economic hypothesis, not evidence of Amazon’s principal motive. Merchant participation, safety and compliance with service rules are real issues stated in the dispute. The original analysis does not establish how much advertising exposure or revenue actually moved to agents.
The counterpart is Amazon Ads’ integration with ChatGPT: a retailer can participate in a new advertising channel while restricting an outside shopping agent. Agreement to one commercial relationship does not grant permission for every other form of access.
Why distinctive data can retain bargaining power
If common interfaces and public-information summaries become easier to reproduce, a software product cannot rely solely on packaging the same accessible material. That does not make all underlying data interchangeable.
First-party transaction records, maintained stock information, specialized databases and user-authorized personal records can be difficult to replace. Their value can come from provenance, freshness and the process required to maintain them, not simply from being hidden.
Yelp’s 2025 annual report provides a concrete example. It describes Yelp AI API partners paying license fees to query and display Yelp content and context in consumer-facing conversational products. Public visibility of individual reviews therefore coexists with a licensed interface for a maintained body of local information.
A collection of scraped snippets and a supported, continuously maintained dataset are different products. The filing also identifies unauthorized copying as a risk to Yelp’s traffic and data-licensing business. It does not show that every review database can charge the same fee or that restricting access creates buyer demand by itself.
The inference is narrower: an owner of useful, difficult-to-substitute data may have a role in an AI ecosystem without operating the most capable general agent. Whether it can capture that value depends on the available alternatives, permitted uses and the reliability of the data service.
What crawler controls add to the negotiation
Cloudflare’s September discussion of accountable mixed-use crawlers separates uses such as search discovery, model training and agent access. That reflects the problem with treating every automated request as equivalent: a site may welcome discovery while having different expectations about reuse or operational access.
A published crawler preference, a license and an authenticated interface perform different functions. A preference expresses how a cooperating crawler should behave; a license sets agreed use conditions; access control decides whether a request can obtain a resource or perform an operation.
The crawler policy guide covers the technical distinctions. The Meta commercial-terms analysis shows why a website may also need to understand the terms attached to its other platform relationships.
Not every publisher gains bargaining power by putting up a barrier. If substantially equivalent information is available elsewhere, an agent provider may substitute another source. Restriction can also reduce legitimate discovery. The economic question is whether the protected resource supplies distinctive, ongoing value.
What the cases imply for agent builders and brands
For an agent builder, a demonstration that can click through a website is incomplete evidence of a workable service. It must also fit the destination’s participation rules, obtain appropriate permissions and report when a task cannot be completed. A blocked action should be a visible outcome, not quietly converted into a claim of success.
For a brand, making product information readable is useful, but does not establish that an outside agent can check out or handle a payment. The agentic-commerce readiness guide treats data quality, access and transaction support as separate checks.
The strongest objection to the idea that agents will make platforms irrelevant is these access disputes. Financial relationships, maintained datasets and permission to transact cannot be reproduced simply by generating a better interface. At the same time, invoking safety does not settle every commercial question about who controls the customer relationship.
The practical competition is therefore about the full task: which information the agent can obtain, which actions it is allowed to perform and whether it can demonstrate a reliable result. Model capability is one input to that outcome, alongside agreements and resources that exist outside the model.
