The Agent Access Layer: Why the Open Web Is Splitting in Two

Meta's Muse jumped to the top of the App Store in September and turned the personal AI agent into a mainstream consumer product. A month later, the same class of agents is being turned away at the door of some of the biggest sites on the internet. Amazon started blocking Muse from its retail catalog. Airlines, marketplaces and retailers pushed back on automated shoppers. In response, Meta, Walmart, Stripe and the startup Sierra published a draft standard for letting agents in the front door instead of the window.

That collision is the clearest signal yet that the web is growing a new layer of infrastructure: an access layer that decides which agents may act, on whose authority, and with what proof. It is being built from two directions at once - walls on one side, rails on the other.

What actually happened

Two developments landed in the same week, and they are two halves of one problem.

The first is friction. According to TechCrunch, Amazon began blocking Meta's Muse agent from its retail site, citing scraping concerns, and Amazon has already sued Perplexity over agent access. Delta told the outlet it has no integration that lets a third-party agent shop or book on a customer's behalf; United pointed to terms of use that forbid automated access without written permission. Users reported blocks at Yelp, eBay, Zillow, Adidas and Pizza Hut. Not all of it is hostile: a Walmart spokesperson said its failures were accidental, caused by a human-verification step an agent cannot complete. Either way the result is the same - the agent stalls mid-task with no explanation.

The second development is the standard. On October 6, Meta, Walmart, Stripe and Sierra published the Personal Agent Protocol with partners including Genesys, Rocket, NiCE and Decagon. It is an open standard for how personal agents authenticate with a business, hold a session, and prove what they are authorized to do. Sierra co-founder and OpenAI chairman Bret Taylor framed it in infrastructure terms: businesses will know when they are dealing with a personal agent rather than a person, and get visibility into what that agent is doing. "It is kind of chaos until such a standard exists," Taylor told CNBC.

The enterprise side moved the same week. Apollo GraphQL introduced GraphOS Agent Services on October 7 - a governance layer between agents and internal systems handling search, identity, policy and audit - because agent programs stall in security review, not on capability. A day later Snowflake announced Cortex AI Gateway, a control plane for model and MCP traffic with tracing, tool governance and budgets. Google, Visa and Mastercard are shipping pieces of the same idea from their own corners.

The second gateway: identity, sessions and money

The industry is converging on a two-gateway model. The first gateway handles model traffic: routing, prompt safety, token budgets. The second handles protocol traffic - MCP tool calls, agent-to-agent messages and, increasingly, the credentials that say an agent is allowed to be there at all.

The execution layer has quietly standardized already. MCP's 2026-07-28 revision went stateless, removing sessions and the initialize handshake so any request can land on any instance behind a load balancer. What did not exist was an identity layer. That gap is what the protocol groups, Apollo and the payment networks are racing to fill.

On the money side the stack is crowded. OpenAI and Stripe co-maintain the Agentic Commerce Protocol for programmatic checkout; Visa has Intelligent Commerce and a Trusted Agent Protocol; Mastercard shipped Agent Pay with a "Verifiable Intent" record co-developed with Google; Google maintains the Agent Payment Protocol. Each answers the same question: was this agent really acting for this person, and only for what that person approved?

That is why the block stories and the protocol stories are one story. A site blocks agents because it cannot tell a legitimate delegate from a scraper. The protocols exist to make that distinction machine-checkable.

Why the walls went up

For nearly thirty years the deal between crawlers and sites was simple: you crawl me, I get traffic back. Agents break it. An agent fetches a page with no human to see the ads, completes the task, and moves on. Cloudflare's September 15 policy change made that explicit, splitting traffic into three independent controls - Search, Training and Agent - and setting ad-supported sites to block agents by default on pages that carry ads. The block is not malice. It is a thirty-year-old trust model with no room for delegation.

This matters to builders because the failure mode is silent. An agent that cannot get through does not return "access denied"; it hits a broken button, a bot check, or a suspended account. eBay reportedly suspended users for agentic activity. Builders inherit the blame for friction they did not cause.

What it means for builders

Five practical takeaways:

1. Identity is becoming a feature, not a hack. Agents that present a verifiable identity - a signed request, an OAuth session, a registered bot identity - will be let in. Agents that impersonate humans will keep getting caught by anti-bot defenses. Design for disclosure, not stealth.

2. Your second gateway is the new control point. Apollo and Snowflake are selling the same insight: once you run ten agents, you cannot answer "what did this agent see and do" without a gateway logging identity, tool calls and authorization in one trace. Build that layer early, or security review will stall your agents later.

3. Plan for fragmentation, not a winner. ACP, AP2, PAP, Visa TAP and UCP all overlap and all have heavyweight backers. The gateways that matter will be protocol multiplexers. Multi-home your integrations and keep commerce logic behind an abstraction instead of hard-wiring one protocol.

4. Session and scope semantics are the real work. PAP's model - guest, read-only, write - maps directly to OAuth scopes, and the payment networks want scoped, spend-limited credentials per agent. The hard engineering is not the call; it is the authorization model, credential brokering and revocation behind it.

5. Keep a human in the loop where it counts. ACP's spec carries explicit intervention-required and 3D-Secure paths precisely because fully autonomous checkout is not always allowed. Design the handoff for approval instead of bolting it on.

The bigger point: the agentic web is being wired with the same primitives the human web already runs on - identity, sessions, scopes and audit. Agents are not getting a separate internet. They are getting a governed seat at the existing one.

What to watch next

• PAP v0.1 lands in late October. The spec, and whether OpenAI and Anthropic join, decides if the agent web has one identity layer or two competing stacks.
• Agent directives mature. Cloudflare is waiting on standards such as ai-prefs before shipping a Disallow control for agents.
• Regulators enter the room. Recurring MCP security disclosures and enterprise agent gateways are precisely what financial and EU regulators are already circling.