PegasusIdentity is not permission. Two checks at the door, not one.
29% of AI shoppers now say an AI chat or search tool shaped their latest purchase more than anything else. The shoppers are moving. This fortnight Shopify, Visa and Walmart drew the same line at the door: knowing who an agent is doesn't tell you what it may do. Here's where that leaves the four questions, and one move to make at your own door.
01 · The lead
The signature is not the yes
Shopify's agent checkout identifies browser agents by signed requests. But an agent can't enter a new card number, and it must show the buyer the order and the total and get a yes before placing it, and ask again if the total changes. (Shopify developer docs. The platform's own documentation.)
Visa described its agent token as a credential scoped to a time window, a merchant category, a dollar cap and the shopper's stated intent, while agent volume stays very small. (Visa earnings call. The company's own description.)
Walmart opened an invitation-only gateway for shopping agents with written terms: verified identity, purchases approved by the shopper or held under a cap they set, no access to card data, and a block for agents that act beyond what the buyer intended. (ActuIA)
What it changes for a merchant
Three of the biggest names in commerce drew the same line: knowing who an agent is does not tell you what it may do. Identity is one check. Permission is another. The record of what happened ties the two together. Most merchants have neither check written down yet, and nothing in a bot setting does it for them. How Walmart wrote its house rules →
02 · The four questions
Still three converging, one open
Q1Who is the agent?converging
Akamai's advice to merchants: grant checkout exceptions only to agents that prove who they are with a registered key, not a name in a header. And the gate swings both ways: OpenAI's own safety check can keep ChatGPT's browsing off a store it flags, often leaving nothing in the store's logs. (Akamai; Search Engine Journal)
Q2Who authorized it?converging
Shopify's confirmation step and Walmart's approval-or-cap rule land in the same place: the authorization is the person's yes, recorded, not the agent's credential. (Sources in the lead.)
Q3What is it allowed to do?converging
Limits are moving into the credential itself. Visa's agent token carries a time window, a merchant category, a dollar cap and the shopper's intent. Natural lets a business's agents pay by ACH, wire or instant rails, each agent holding its own keys and spending limits. (Natural, company announcement.)
Q4How far does authority travel?open
When an agent's purchase goes wrong, who pays? Bank, network and payments executives say liability still rests on company-by-company policies, with no industry rules and no case law. Until that settles, your own record is your defense. (Payments Dive)
The four questions are laid out in the Know Your Agent library.
03 · By the numbers
90%+
of AI bot activity on commerce sites is only watched. Commerce draws nearly half of all AI bot traffic, and sites leave most of it in monitor-only mode. (Akamai, its own network data.)
29%
of AI shoppers say AI chat or search shaped their latest purchase most, three times the share who name traditional search engines. (McKinsey, about 21,000 consumers in 11 markets.)
5% → 9%
of US adults have bought something through AI, nearly doubling since last December.
9 in 10
of the roughly 19,000 stores UCP Checker tracks in depth run on Shopify or Wix. Agent checkout is arriving platform first; if you sell elsewhere, check your own door. (UCP Checker)
04 · One move
Write your house rules
On one page, write down what an agent may do at your door: browse, fill a cart, place an order. Let verified agents prepare an order, but require the buyer's fresh confirmation, or a spending cap they set, before one is placed. Give agent sessions their own cart-hold limits: The RealReal's 20-minute cart hold let reporters' agents keep items on hold for hours, and it is now tightening agent sign-in, carts and checkout (Gizmodo). Decide now what happens to an agent that oversteps. Then keep the agent, the confirmation and the result in one record.
05 · See it at a real door
House rules, already written.
At Alder & Pine Home, the demonstration store in our Silver Lake proof, your agent searches and builds the cart, and you approve it. It never sees your card, it can't accept financing terms, and you set its limit.
See how agent checkout works →No sign-in needed. Or try it with your own agent at the Pegasus Source Shop → Alder & Pine Home is a fictitious demonstration store; the cart shown is an illustration.
Check what an agent sees at your own store, free, with PegasusKYA, or write your rules in your free Pegasus workspace. Every take since the last issue is on The Door.
Get The Door.
One email every two weeks: the takes that mattered, which question moved, and what to do at your own door. Three minutes to read.
Each item states its source and how much weight it can bear. Question status is our reading of the field, not a claim made by the sources. Pegasus Source is independent of the companies covered here.