Walmart Opens Agent Gateway While Amazon Slams the Door

On October 21, Walmart did something no major retailer had done before: it published the terms under which autonomous software is allowed to spend a customer's money on its store. Alongside those terms it announced an MCP-based Agent Gateway, per-agent Agent Profiles, and a beta for companies and developers, with the profiles going live "in the next month" for Walmart and Sam's Club.

The timing is not subtle. Days after Amazon blocked Meta's Muse agent from its catalog and months into its litigation against Perplexity's Comet, Walmart chose the opposite posture: agents are welcome, provided they identify themselves, stay inside a budget, and never touch payment credentials.

For anyone building agents that transact, this is the most concrete deployment of agent identity in production commerce so far. Not a whitepaper. A gateway, a profile, and an enforcement clause.

What Walmart Actually Shipped

Three components, each solving a different failure of today's browser-driving agents.

The Agent Gateway is Walmart's MCP server. Instead of an agent loading Walmart.com and clicking through pages designed for humans, it connects over the Model Context Protocol, the standard Anthropic introduced and that has since become the default wiring for tool-using agents. Walmart's own framing of the problem is honest: browser-based shopping "can be slow and error-prone, and agents may get stuck along the way." An MCP endpoint trades pixel-guessing for typed calls against inventory search and cart operations.

Agent Profiles solve the identity problem. Today an agent logs in as the customer, so its purchases are indistinguishable from the customer's own. Under the new model, each agent is authorized with a dedicated profile inside the Walmart account, with its own purchase history and its own controls. Customers either approve every transaction or grant a spending envelope, the example figures being $50, $100 or $200. Walmart compares it to adding an authorized user to a credit card, which is exactly the right mental model: delegated, bounded, revocable authority.

Terms for AI Agents are the enforcement layer. Agents must not act beyond the shopper's intent, cannot receive payment-card details, cannot add or change payment methods, and may access only the information needed for the task. Non-compliant agents get blocked. Walmart also extends its normal returns process to agent purchases, including when the agent misbehaves, which quietly removes the biggest consumer objection to letting a bot buy things.

There is one more design decision worth flagging: the gateway is built to serve a customer's "usuals" without handing the agent their shopping history. If you buy the same sourdough and the same brand of milk every week, Walmart resolves that on its side and returns the items. The agent gets an answer, not a profile. That is data minimization as a product feature, and it is the part most agent builders will underestimate.

The Split: Permission vs Exclusion

Amazon's approach is the mirror image. It has blocked Meta's Muse from its store, restricted Perplexity's Comet, and litigated the question of whether an agent acting on a user's instruction is "unauthorized access" under the Computer Fraud and Abuse Act.

That litigation has not gone Amazon's way. In August 2026 the Ninth Circuit vacated a preliminary injunction against Perplexity, holding that "it is the user who 'accesses' Amazon's computers, with the help of the Assistant," and that the assistant is "a tool, not a person for statutory purposes." Amazon's September amended complaint pivoted to contract theory: tortious interference with the Conditions of Use, including AI-specific Agent Terms requiring agents to identify themselves. A hearing on Perplexity's motion to dismiss is set for November 20.

Read the two strategies together and the strategic logic is clear. Litigation is slow, uncertain, and produces no usable integration surface. Walmart's gateway produces a standard, a compliance regime, and a first-mover position in the only thing that matters long term: being the storefront that agents can actually complete a purchase on. Amazon can win every motion and still lose the default.

That does not make Walmart altruistic. A gateway is a toll booth with an API. Whoever defines the interface defines what an agent can see: which products surface, which offers apply, whether sponsored placement exists in the agent's view. Walmart is pre-empting that fight by writing the rules before regulators or a competitor's protocol do it for them.

Why Agent Identity Is the Real Product

Strip away the retail framing and Agent Profiles are an authorization primitive: a named non-human principal, scoped permissions, a spend ceiling, an audit trail, and instant revocation. That is the same shape as an OAuth client with a budget, or a service account with a quota. Commerce just made it consumer-visible first.

The protocol landscape around this is already crowded and fragmented. OpenAI and Stripe shipped the Agentic Commerce Protocol with Instant Checkout. Google shipped the Agent Payments Protocol, then the Universal Commerce Protocol with Shopify, Etsy, Wayfair, Target and Walmart itself. In October, Sierra and Meta announced the Personal Agent Protocol with Stripe, Shopify, Walmart and others, focused precisely on how a personal agent authenticates to a business. MCP, meanwhile, became the transport everyone converged on.

That means a builder shipping an agent that buys things today faces a genuine N-times-M integration problem, and no single standard has won. Walmart's gateway is one more endpoint in that matrix, but it is the first one where a retailer defined the permission semantics rather than just the catalog semantics.

The uncomfortable implication for agent developers: the hard part of agentic commerce is no longer reasoning quality. It is the plumbing of delegated authority, idempotent transactions, dispute handling, and proving to a merchant that your agent is who it says it is.

What Builders Should Do Now

Three practical takeaways.

First, design for per-agent identity from day one. If your agent authenticates as the user, you inherit the user's full blast radius and every merchant's anti-bot stack treats you as an intruder. A delegated profile with an explicit spend cap is both a security control and a sales argument.

Second, treat spend limits as a first-class field, not a prompt instruction. "Do not spend more than $100" in a system prompt is not a control. A gateway-enforced ceiling is. Expect merchants to reject agents that only offer the former.

Third, build the audit trail before you need it. Walmart's terms make the agent provider responsible for behavior, and extend returns to agent mistakes. When something goes wrong, the merchant will ask what your agent intended and what it was authorized to do. If you cannot answer with structured logs, you lose access.

The agentic web will not be settled by who has the best model. It will be settled by which merchants publish terms agents can comply with, and which agents can prove compliance at machine speed. Walmart just published its side of that contract. The rest of retail now has a template, and a deadline.