Agentic Commerce Hits Checkout: Who Controls the AI Wallet

Meta's Muse agent can now find a product, walk a store's checkout, and hand you a one-tap approval card. Shopify has opened its checkout to browser-based agents. Amazon, meanwhile, refuses to let them in. The shopping demo is the easy part. The hard part, and the part that will decide which agents get to spend real money, is the protocol layer underneath.

From browsing to buying

According to CNBC, shopping has quickly become one of the biggest usage drivers for Meta's personal agent Muse. Asked for an item, Muse browses retail sites, surfaces listings inside the app, and pre-fills a checkout. Before anything is bought, it shows an "approval card" with the order details, and the buyer confirms. Payment runs through partners such as Link by Stripe and Shopify's Shop Pay, which generate a one-time-use card so the shopper's real card details never enter the agent's context. Meta has lined up connectors with Walmart, Gap, Sephora, Expedia, Wayfair and Best Buy.

Amazon has gone the other way. It has blocked Muse from purchasing on its site, saying the agent stores customer credentials and scrapes account data in violation of its terms. Two of the largest commerce platforms now run opposite strategies: one opens its storefront to agents, the other keeps the door shut.

The permission layer is being standardized

The more consequential story is that the rails for agentic purchasing are being written right now, and they look nothing like the screenshot-driven automation that agents used a year ago.

On September 28, Shopify extended WebMCP support to checkout, exposing three structured tools - get_checkout, update_checkout and complete_checkout - so a browser agent can read a checkout, change a delivery option or address, and place the order without screenshotting or clicking through HTML built for humans. The tools sit on top of the Universal Commerce Protocol (UCP), an open standard Shopify developed with Google that already exposed the same checkout through a server-to-server MCP route.

What makes this a permission layer rather than just a shopping feature are the rules wrapped around it. The agent has to show the buyer the order and total and get explicit permission before complete_checkout fires; if the total changes, it must ask again. Payment challenges such as 3D Secure are handed back to the human in the same tab. Browser agents are expected to sign their requests with Web Bot Auth, so the store knows which agent is calling - and unregistered agents can be deprioritized or blocked outright.

Those constraints are the product. One-time cards, Shop Pay approvals, signed agent identities and mandatory buyer checkpoints all attempt to answer a single question: how does a merchant trust a non-human actor with a wallet? Amazon's answer is "it doesn't." Shopify's is "identify yourself, and we'll hand you the tools." Both are bets on how the next two years of agent traffic will look, and both are already shipping.

The same fork is visible elsewhere. Google is pushing personal agents that can complete tasks across its own apps, but keeps the most powerful ones behind limited access, while Meta has made Muse free to drive adoption. Distribution, not raw model quality, is what decides which agent gets to sit between a shopper and a merchant.

What it means for builders

For anyone wiring up agents, agentic commerce is a preview of how every high-stakes integration is about to work.

Structure beats scraping. The winning pattern is a registered tool with a schema and a name, not a vision model guessing where the "Buy" button is. If your agent drives a web UI to complete a task, expect that surface to be replaced by WebMCP-style tools, and expect to be blocked when you work around them.

Identity is now a first-class primitive. Web Bot Auth signing keys, scoped agent identities and per-agent authorization are becoming table stakes. The agent that cannot say who it is, on whose behalf it acts, and what it is allowed to spend will be treated as a bot, not a buyer.

Authorization must be built in, not bolted on. Every serious flow now has a human checkpoint before money moves. Design the approval step into the agent loop from the start; retrofitting consent onto an autonomous purchasing path is how you get chargebacks and headlines.

Treat store and tool text as data, not instructions. Merchant descriptions, reviews and tool outputs are exactly the injection surface attackers have been waiting for. An agent reading "ignore previous instructions" in a product review is the prompt-injection story of the next quarter.

Your data is now an API contract. Search terms, variant names, stock answers and return policies get read by machines, not browsed by people. Sloppy product data fails silently and identically across every agent that touches it.

None of this is exotic. It is the standard tool-calling stack - schemas, signed identities, scoped permissions, human-in-the-loop - applied to the one domain where mistakes cost real money. That is precisely why the patterns settling here will leak into every other agentic workflow. If you can ship a safe checkout agent, you can ship a safe anything agent.