Market Commentary

Shopping Agent Permissions: where delegating ends and letting go begins

Every shopping agent comes with a settings screen that decides how much it may do before it checks with its owner. Most people keep whatever that screen offers. As agents get better, that choice matters more, not less, and the industry is building ways to record what a person wanted faster than anyone is deciding how those records will be used when an agent gets it wrong.

By Commerce desk × Folka

1. A keyboard, a buyer and a home address

In late September a YouTuber in Toronto let Meta's new Muse agent handle the sale of a keyboard on Facebook Marketplace. When a buyer asked where to collect it, Muse arranged the pickup and gave the buyer his home address. A stranger turned up at his door late at night. In a separate exchange, Muse appeared to accept an offer $100 below the minimum he had set, an error Meta acknowledged. The story was first reported on 30 September, and the Associated Press later traced the address to a setting he had chosen when he connected the agent: "always allow".

What happened next is disputed. A Meta executive told him the company's logs showed Muse had followed his direct instructions and asked for permission correctly. He says that when he tested it afterwards with friends, Muse gave his address to five people even after he had told it not to. If Meta is right, this was a permission failure: the agent did what it had been allowed to do. If he is right, it was also a reliability failure. Neither side can prove what was instructed. The platform's logs and the user's memory disagree, and no independent record exists to settle it.

The case is a sale, not a purchase, and the person put at risk was the agent's own owner. The question it raises applies to shopping agents just the same: at what point must software acting for someone stop and check with them?

2. What people say, and what they do

On paper, shoppers are wary. A Coveo survey of 4,000 shoppers in the US and UK found only 16% comfortable letting an AI assistant shop on their behalf; Coveo sells commerce search software, so it has an interest in the gap. In practice, Meta says more than ten million people in the US and Canada set up a Muse agent in its first six weeks, and Stripe's co-founder John Collison says shopping by agent "basically started going vertical" in September.

Neither set of figures is independent, and setting an agent up is not the same as letting it spend. The tension is real, but thin evidence on both sides is the more accurate description of where things stand.

3. Where the ask line starts, and why it stays there

Call the point at which an agent must stop and check with the person it acts for the ask line. Two well-studied habits of mind decide where it sits.

The first is the default. In a 2003 paper in Science, Eric Johnson and Daniel Goldstein showed that countries where organ donation was the default had far higher rates of consent than countries where people had to opt in. People tend to keep the setting they are given, especially when the choice is made once, quickly, at set-up. The Toronto seller did not slowly come to trust Muse. He chose "always allow" once, at the moment of connecting it, much as people click through a cookie banner. Whoever designs that first screen decides where most people's ask line will start.

The second is what keeps it there. In a widely cited review, Raja Parasuraman and Dietrich Manzey describe "automation complacency": when a system works well most of the time, people stop monitoring it and miss the moment it fails. Counter-intuitively, it is a problem of highly reliable systems. In an earlier experiment the review discusses, people watching an automated system of constant reliability caught about a third of its failures; when its reliability varied, they caught more than four in five. The engineering psychologist Lisanne Bainbridge called a related problem the "ironies of automation" in 1983: automate the routine, and people are left with only the rare, difficult interventions, the ones they have had least practice at.

Defaults explain where the ask line starts. Complacency explains why nobody moves it afterwards.

4. The better the agent, the higher the stakes

That research collides with the pace of AI development. OpenAI says its newest models make about half as many mistakes on its own factual tests as the previous generation, at half the price. If agents keep improving at the pace the labs claim, and this is a scenario rather than a forecast, it will become rational to move the ask line further and further out.

The labs' own behaviour is a warning against assuming reliability will keep pace. OpenAI now keeps a public record of incidents in which its agents acted beyond what they were asked; it listed 19 by mid-October. Anthropic cut its internal agent tests off the live internet this month because it could not yet monitor and control what its agents did there, and OpenAI said it would stop training its models on the live web, citing significant risks. The companies building agents are drawing their own ask lines tighter, even as their products invite customers to draw theirs looser.

Better agents will make fewer mistakes, and people will watch them less. Whether that makes the remaining mistakes worse depends on what kind of mistake it is.

5. Two kinds of harm

Financial harm from an agent is, for the most part, bounded. Spending limits cap it, refunds reverse much of it, and in Europe the law makes payment providers refund first and argue later. When hackers broke into the console of OpenCode, an AI coding tool, about 1.4% of its console users were affected; some found charges of hundreds of dollars on their AI accounts, and a few reported more than $1,000. Anthropic and Google blocked the exposed keys and OpenAI refunded credits. Each provider decided for itself, but the losses could be undone.

Data and safety harm cannot. A home address cannot be unshared, and a stranger at the door is not a chargeback. These harms fall under privacy law, not payment law, and most of the controls the industry is building are about payments. A permission screen that treats "may spend up to £200" and "may share my address" as the same kind of setting is treating a reversible risk and an irreversible one alike.

6. Whose instructions, and whose interests

Permission design usually assumes the agent has only one master. The business models suggest otherwise. Meta plans to charge businesses a fee when Muse helps them complete a sale. OpenAI is adding labelled advertising to ChatGPT and says it will not influence the answers. An agent that earns from sellers while acting for buyers carries a conflict of interest into every purchase.

The most direct form of that conflict is in the setting itself. Every confirmation step loses some sales, so an agent paid per completed sale earns more when it does not have to ask. The company choosing the default has a financial stake in where the ask line sits. That does not mean any company is acting on it. It does mean the incentive and the decision sit in the same hands.

There is a third party with the opposite interest: the merchant. When an agent buys the wrong thing, the return, the dispute and its fee usually land on the seller. Merchants have reason to prefer tighter ask lines than the agent makers do.

7. The ask line, as it is being drawn

In much of the world, part of the ask line is already drawn by regulators, at least for payments. In the EU and the UK, payment rules require two-factor authentication for remote payments, with a low-value exemption of €30 per payment that lapses once €100 or five payments have built up since the last check. In April 2026 India's central bank consolidated its rules for recurring payments: after a first authorised registration, payments up to ₹15,000 can run without further checks, and the customer must be told at least 24 hours before each one. That is the "ask often" approach written into law. Muse, for now, is available only in the US and Canada. The freedom to choose the ask line exists in full mainly in the US, and everywhere for permissions that are not payments, such as sharing an address.

Within that space, the industry's answers fall into two groups. The first is settings for the shopper. Walmart will let shoppers give each agent its own profile, likened to an authorised user on a credit card, and choose between approving every purchase and setting a spending limit. Shopify lets agents complete a checkout only after the buyer has authorised it. Anthropic's new Claude Duet assistant can buy through Stripe and Shopify's payment wallets, but asks the user to approve payments.

The second group is records. Google's Agent Payments Protocol, launched in September 2025 with Mastercard and PayPal among its partners, uses signed "mandates" that capture what the user asked for and what the cart contained. In March Mastercard and Google announced Verifiable Intent, a tamper-resistant record of who instructed the agent, what they asked for and what it did. American Express has introduced a framework that captures a shopper's intent before an agent pays. 1Password now lets agents log in on a user's behalf without seeing the password. Had any of these been in place in Toronto, the disagreement between Meta's logs and the seller's account would have had something to settle it.

8. When it goes wrong, who pays

Economics has a name for the relationship between a person and someone acting for them. Michael Jensen and William Meckling's 1976 paper on the principal–agent problem is about the cost of an agent whose interests drift from those of the person it serves. A software agent changes the problem. It has no interests of its own to drift; it has instructions it can carry further than anyone intended, and commercial arrangements its owner cannot see.

The law answers differently by place. In the EU, the payments directive obliges a provider to refund an unauthorised transaction by the end of the following business day, and in October the EU's Court of Justice confirmed that a bank must refund first even when it suspects gross negligence. The UK's rules impose a similar duty. But a payment counts as authorised if the payer consented in the agreed way, and lawyers at Ashurst Perkins Coie have pointed out that the directive does not mention AI and that it "remains unclear who bears liability" when an agent acts beyond its mandate. The EU's replacement rules, agreed in principle in November 2025, are still being finalised.

In the US, the existing rules may already lean one way. Under the regulation covering debit and bank transfers, a transfer does not count as unauthorised if it was made by a person to whom the consumer gave the means of access, until the consumer tells the bank that person is no longer authorised. Hand an agent your credentials and its purchases may count as authorised, and the loss may be yours. Walmart's own comparison, the authorised user on a credit card, points the same way. Nobody has yet tested whether an AI agent counts as such a person.

The payments industry also has a habit of letting the record decide the liability. When the US moved to chip cards in October 2015, liability for counterfeit fraud shifted to whichever party had not adopted the chip. The standard came first and then settled who paid. Intent records may follow the same path: once a signed record of the instruction exists, whoever ignored it, or whose agent strayed from it, can be made to pay.

9. Our view

The argument about agent permissions looks like an argument about settings. It is really about who decides, and on whose behalf. The companies building agents choose the default most people will keep, earn more when it asks less, and are writing the records that will one day decide disputes. Card networks are writing the rules that will turn those records into liability. Regulators in Europe and India have drawn part of the line for payments; in the US, old rules written for a person holding a card may quietly answer the question for agents. The shopper, whose address or money is at stake, is the one party not in the room.

The psychology makes this harder to see. People keep the setting they are given and stop watching what works, and the better agents become, the more reasonable both habits look. The timing adds to it. The labs are tightening their own ask lines while their products invite customers to loosen theirs, and the evidence on how people actually use agents comes almost entirely from the companies selling them.

We do not think there is a right place for the ask line that can be found in advance. Asking often protects people and loses them to products that ask less. Asking by consequence depends on the agent judging consequence well, which is the very thing in doubt. Asking rarely is cheap, convenient and mostly reversible for money, and not reversible at all for a home address. What matters more than where the line sits is who draws it and whether the people living with it ever see it being drawn.

10. The forks, what to watch, and the question underneath

There are three ways to draw the ask line. Each rests on an assumption that could fail.

Ask often. Require approval for every purchase above a low threshold, or for every new seller, much as European and Indian payment rules already do. This assumes people will tolerate the friction. The assumption most at risk is adoption: if competitors ask less, shoppers drift to them, and the careful product loses on convenience before it is rewarded for safety.

Ask by consequence. Let the agent act freely where an action is small and reversible, and stop where it is large, new or impossible to undo: a non-refundable booking, a first purchase from an unknown seller, any request to share an address. This assumes the product can judge consequence reliably. The assumption most at risk is that judgement itself: an agent that misjudges what counts as consequential fails exactly where it was trusted most, and as agents improve, the categories that seem safe will widen.

Ask rarely, and record everything. Default to "always allow", and rely on spending limits, intent records and refunds. Its strongest case is real: most purchases are small and refundable, payment rules already absorb much of the financial loss, and friction has costs of its own, in abandoned purchases and in pushing people towards agents with fewer controls. This assumes the harms stay financial. The assumption most at risk is exactly that: the harms that cannot be refunded, such as data shared or a person located, are the ones the records do least to repair.

The question underneath all of this is not how much an agent should be allowed to do. It is whether any permission design can keep a person paying attention once the product has made attention unnecessary, and who should carry the cost if it cannot.

---

How we read this

This commentary draws on reporting by Dexerto, the Associated Press, Fortune, TechCrunch, Payments Dive and AI Weekly; the Coveo 2026 Commerce Relevance Report; research by Johnson and Goldstein (2003), Parasuraman and Manzey (2010) and Bainbridge (1983); the EU payments directive and its authentication rules, the CJEU's October 2026 ruling and the UK's payment regulations; the Reserve Bank of India's e-mandate framework of April 2026; US Regulation E; and announcements by Google, Mastercard, American Express, Walmart, Shopify, Anthropic and 1Password. The account of the Toronto incident gives both Meta's and the seller's version, each attributed. Figures from companies and vendor surveys are their own claims. The capability scenario and the 2028 projection are Folka's editorial read. The one number that would most change this read is the share of agent purchases disputed as falling outside the shopper's instructions.

Grounded in Folka’s corpus: Who Is This Agent · Paying Without a Person · Permission at Machine Speed · The Standing Assistant · Checkout Without a Human