Walmart announced on 21 October that it will let AI agents other people built shop on its site on their customers' behalf.
The coverage I have read mostly frames this as a retail arms race story. Walmart says yes, Amazon says no, place your bets.
I think that misses what is actually on the page. The headline is not that Walmart opened the door. It is the lock it fitted first.
Because what Walmart has published, in a fair amount of detail, is a working permission model for software that spends your customers' money. Almost nobody had one of those a week ago.
Everything below is from Walmart's own announcement and is quoted rather than paraphrased where the wording matters, because the wording is the point.
What was announced
Two things, and they do different jobs.
Agent Profiles. Each AI agent gets a dedicated profile inside the customer's account, so its purchases appear separately from the customer's own. Walmart creates the profile automatically the first time a customer shops through an agent. Described as launching in the next month.
The Walmart Agent Gateway. A way for agents to shop using MCP rather than by driving a browser. Walmart's post expands the initialism as "model text protocol", which looks like a slip for Model Context Protocol, the standard everyone else uses that name for. It starts as a beta for companies and developers, and its product page describes an early beta programme, available by invitation only, that may be suspended at any time.
So: an identity system and a data pipe. Neither is glamorous. Together they are the whole story.
The six controls, and why I would copy the list
Read the announcement as a specification rather than as news and you get a checklist. Here is what Walmart decided a third-party agent is allowed to be.
1. Identity per agent, not per customer. Each agent gets its own profile and its purchases appear separately. This is the decision everything else rests on. If three agents and a human all act inside one account, you cannot attribute anything, you cannot revoke anything selectively, and you cannot answer "which one did that" after a bad order.
2. Approval by default. Customers approve purchases by default. They can instead set a spending limit, with $50, $100 and $200 given as examples. The default is the conservative setting and the customer opts out of it, not into it.
3. A ceiling, not just a gate. The spending limit is a separate control from the approval requirement. Even with permission granted, there is a number above which the agent cannot go. Walmart adds that it may require extra approvals even within a spending limit, which means the cap is a floor on caution rather than a blanket authorisation.
4. Data minimisation. Agents may access only the information the task needs and the customer allows. For reordering usual items, Walmart says it helps agents find them without sharing the customer's broader shopping history. The agent gets the answer, not the archive.
5. Revocation. A customer can delete an Agent Profile at any time. Permission that cannot be withdrawn is not permission.
6. Enforcement. Agents must not take actions beyond what the shopper intends, cannot receive card details and cannot add or change payment methods. Agents that break the terms will be blocked from Walmart's site. There is a rule, and there is a consequence attached to it.
I have spent a lot of this year arguing that the hard part of agents is not capability but authority. This is the first time I have seen a retailer of that size publish its answer in a form you can read in five minutes.
The gateway choice is the technical tell
Walmart could have simply allowed agents to browse walmart.com. It did not. It built a gateway.
That is a judgement about reliability, and I think it is the correct one. A browser-driven agent is defeated by the things that defeat a confused human: a popup, a variant selector that needs two clicks, a layout change shipped on a Tuesday. Except the agent does not improvise around them, it just fails, and often fails while reporting success.
A gateway exchanges structured data over a defined protocol. The agent is not reading a page, so the page cannot break it.
There is a second motive, and it is probably the stronger one. Browsing is all-or-nothing: if an agent can see the page, it can see everything on the page. A gateway lets Walmart decide field by field what an agent receives. Control five and control four in the list above are only enforceable because of this architectural choice.
This is the split I wrote about in how to prepare your store for AI shopping agents: browser agents are defeated by your interface, protocol integrations are defeated by your data. Walmart has just put a very large bet on the second being the serious path.
The Amazon contrast is less interesting than it looks
The Verge reported on 21 October that Amazon has blocked Perplexity's shopping agent and Meta's Muse assistant, which makes for a tidy opposition: open Walmart, closed Amazon.
I would not read too much into it as a strategy lesson, because the two are protecting different things.
Amazon's position makes sense if you believe the discovery surface is the asset. Letting another company's agent mediate between a shopper and your catalogue hands away the merchandising, the advertising inventory and the relationship.
Walmart's position makes sense if you believe fulfilment is the asset and discovery is already leaking to assistants regardless. In that reading, being the easiest catalogue for an agent to transact against is a strength, not a surrender.
Both are coherent. What matters for everyone else is that two of the largest retailers in the world now disagree in public about this, which tells you the answer is genuinely unsettled rather than obvious.
What a smaller brand should take from it
You are not building a gateway. That is not the lesson.
The lesson is that Walmart answered six questions before it let a single agent in, and every one of those questions is answerable with policy long before it needs engineering.
So if you sell online, I would write down your answers now, while it is cheap and theoretical:
- If an agent places an order on a customer's behalf, can you tell it apart from the customer? Today, the honest answer for most stores is no.
- Would you want a purchase approval step, and at what value?
- What is the maximum you would let an unattended agent spend in one order?
- What does an agent need to see to complete a purchase, and what would you rather it never saw?
- If a customer wanted to revoke an agent's access tomorrow, is there a mechanism, or just an apology?
- If an agent behaved badly, what would you actually do about it?
A hypothetical example of why these are not academic: an agent reorders a customer's usual item, your price changed since their last order, and the agent completes anyway because nobody set a ceiling. The customer sees the charge, does not recognise the amount, and disputes it. Who was wrong? With Walmart's model you can answer that in one screen. Without it you are reading logs.
None of this needs a protocol to decide. It needs an afternoon.
The honest limits
Three caveats, because the gap between an announcement and a working system is where most of these stories end.
It has not shipped. Agent Profiles are described as launching in the next month. The Gateway is an early beta, by invitation, suspendable at any time. This is a published intention with a lot of detail, not a deployed system with results.
It is Walmart's own storefront. This is not a standard other merchants adopt, the way the Agentic Commerce Protocol or the Universal Commerce Protocol are. It is one very large retailer defining the rules of its own front door.
Nobody knows if customers want this. Every control in that list implies a customer who is willing to configure spending limits for software. That is a real behavioural assumption and it is untested at scale.
Why I think it still matters
Because it moves the conversation from whether agents will buy things to under what terms, and the second question is the one businesses can actually act on.
For about a year the discussion about agentic commerce has been a capability argument. Can it find the product, can it read the price, can it complete the checkout. Walmart has quietly reframed it as a governance argument, and governance is a thing you can design before the technology arrives.
The companies that will handle this well are not the ones with the best agent integration. They are the ones that decided, in advance and in writing, what a machine is allowed to do with a customer's money.
Walmart just published its answer. It is worth reading as a specification, not as a press release.
