Why Blocking AI Agents Is Bad Business

A blanket block rarely protects the business it was meant to protect. It hands the decision to a competitor.

Enterprises have sound reasons to keep AI agents out. The first eight weeks of mass-market personal agents suggest a blanket block rarely protects the business it was meant to protect. Mostly it hands the decision to a competitor.

On 13 October, Jamie Dimon told analysts on JPMorgan's third-quarter call that the bank would not let any outside agent into the company, because it was too risky for customers and for JPMorgan. Eight days later Walmart announced an Agent Gateway that lets customers choose which agents shop for them, set spending limits, require approval and cut access off. Between those two announcements sits the question every board with a website, an app or a call centre now has to answer: when a customer sends software instead of coming in person, what happens at the door?

The case for keeping it shut is serious, and this article sets it out fairly. Our conclusion is that a blanket block is usually the wrong answer, for a reason most security reviews never reach. A block leaves the agent's decision intact and removes the business from it.

The companies that will win agent-mediated markets are the ones already working out how to admit agents on their own terms and make their sites, data and evidence legible to them. One emerging approach is to give arriving agents a verified company-side agent to consult, and this article introduces AIVO's own, AIVO Assist. The work is commercial strategy as much as security policy, and it belongs on the board agenda.

The case for the door

The strongest reason to block is security. Charles Schwab's chief executive, Rick Wurster, has said he receives a weekly report of blocked agent logins, running in the tens and twenties a week from the large agents. His objection is liability: a login made with a borrowed password looks exactly like the customer, and afterwards nobody can tell whether a person or a program was driving. Dimon described the same thing as a liability transfer to the customer who hands over the keys.

The second reason is identity. Cloudflare told its Connect conference in October that agents made more than 600 billion requests on its network last quarter, nearly four times the level at the end of 2025, and that fewer than one in ten automated requests comes from a bot that names itself. An operator that cannot tell a customer's agent from a scraper has reason to treat both the same way.

The third reason is margin. Agents read prices, compare and move money, and bank stocks fell in September on fears that personal agents would sweep deposits into higher-yielding accounts.

The fourth reason is media economics. An agent that buys on a customer's behalf never scrolls past a sponsored listing. Amazon booked $68.6 billion of advertising revenue in 2025, roughly twice the operating income of its businesses outside AWS. For a brand owner the equivalent fear is quieter but real: years of advertising and brand building, compressed by an agent into a price, a specification and a delivery date.

The fifth reason is the relationship itself. Amazon has argued that agents do not offer its personalised recommendations, and that a customer served through someone else's interface is a customer the merchant no longer knows. Every one of these concerns is legitimate. The question is whether a block answers any of them.

What a block actually does

A block filed as an Access decision does its commercial damage at Choice. In AIVO's three gates of agentic commerce, Access asks whether an agent can reach a business, Choice whether it selects that business, and Execution whether the task completes. A business that shuts the first gate has also decided the second, in its competitor's favour.

The customer's demand is unchanged by the block. The agent still forms a shortlist and picks from whatever it can reach. In one reported test, Muse returned options from Sam's Club, Walmart and Costco, then told its user it could not check Amazon because the retailer had blocked it.

The loss is also invisible. As Who Owns the Receipt? showed, an agent funnel records only the winner, so a blocked business guarantees itself the loss and the blind spot together. Its dashboards will report stable conversion right up to the point at which the volume is gone.

There is a simpler way to put it. The customer chose the agent. Turning the agent away is a decision about how that customer is allowed to buy, taken by a business the customer was trying to buy from.

Blocking is a platform strategy

The two retailers that split most publicly over Muse have very different advertising economics. Business Model Analyst puts Amazon's 2025 advertising revenue at about 200% of the operating income of its businesses outside AWS, against roughly 21% for Walmart. The company whose ad revenue is twice its store profit built the wall, and its own assistant, Alexa for Shopping, carries sponsored placements inside its answers.

Amazon can afford that wall because a large share of US product searches start on Amazon, and JPMorgan, the largest US bank, can hold its line while it builds its own agents. A regional bank, an insurer, a hotel group or a consumer brand owns no such starting point. For them the agent increasingly is the starting point, and blocking subtracts the business from the shortlist with nothing in its place.

Every block so far has ended in a deal

The last three decades of intermediation offer a consistent pattern. Incumbents block a new intermediary, use the block as leverage, and settle into governed access on negotiated terms. The cost falls on whoever stays out longest.

Axel Springer learned the cost of staying out in 2014, when it withheld the free licence Google needed to show snippets of its articles. Its chief executive later said traffic from Google News fell 80%, as the Christian Science Monitor reported, and the company reversed course within about two weeks.

Ryanair spent years calling online travel agents pirates and won a 2024 US jury verdict against Booking.com for screen scraping. Its commercial endgame was a set of "Approved OTA" agreements, including a framework with Booking in September 2025, under which intermediaries book through Ryanair directly, show its real fares and pass on each customer's own contact and payment details.

US banks fought screen scraping for a decade before moving aggregators onto APIs. JPMorgan received 1.89 billion data requests in June 2025 alone, signed a paid data-access agreement with Plaid that September, and now charges for access it once blocked. Its statement on agents points the same way: alongside the block, the bank said it is committed to enabling agentic connections securely. The end state is predictable. What varies is how much business each company gives away on the way.

Many companies have blocked agents without deciding to

For a growing number of businesses the block was never a board decision. From 15 September 2026, newly onboarded Cloudflare domains block Training and Agent traffic by default on pages that carry advertising, and Cloudflare sits in front of more than one in five websites. Add the bot protection most enterprises already run, and many companies' real agent policy is whatever their security vendor shipped.

The legal footing for a deliberate block is also weaker than it looked in March, when a federal judge granted Amazon an injunction against Perplexity's Comet browser. On 4 August the Ninth Circuit vacated it, holding that it is the user, helped by the tool, who accesses Amazon. Amazon has asked the full court to rehear the case, so the question remains open, and any strategy that needs the courts to treat a customer's agent as an intruder rests on it.

Yes to reading, no to moving money

The security case against agents is mostly a case against one kind of access, an agent logging in with a customer's borrowed password. It does not require shutting out every agent from every page. The infrastructure for finer distinctions arrived this year.

Schwab, whose chief executive is among the most outspoken on agent risk, is building support for the Model Context Protocol so that a client's chosen AI tool can connect under rules Schwab controls. Through that route an agent can check balances and pull research, and it cannot move money. Walmart's Agent Gateway lets the customer set spending limits per agent, require approval and revoke access, and Walmart says agents see the same prices humans do.

The standards are converging on the same idea. The Personal Agent Protocol, announced by Sierra and Meta on 6 October with Shopify, Stripe and Walmart among its partners, lets a company declare which interfaces it offers, grant read or write scopes, and allow, block or rate-limit agents one by one. Web Bot Auth lets an agent sign its requests so a site can verify which agent it is.

This matters commercially because most of the value of being chosen sits in read access, which carries the least risk. An agent comparing savings accounts needs to read the rate, the terms and the switching process. It does not need to move a dollar to decide. A bank that blocks reading to prevent payments has given up the selection in order to protect the transaction it would never have been offered.

Legibility is the new brand building

Opening the door is the smaller half of the job. An admitted agent still has to choose the business, and it chooses on what it can read. At Cloudflare's Connect conference on 20 October, Matthew Prince illustrated this with an agent asked for a lunch spot: it read the sites of thousands of venues and ranked three, with the one tagged "Most info" on top, as Shashi Bellamkonda reported. Prince's warning was that agents will favour the businesses they know most about.

The customers agents send are worth having. Adobe found that in July 2026 AI-referred visitors to US retail sites converted 60% more often than other traffic and generated 53% more revenue per visit, the eleventh straight month of outperformance. A year earlier the relationship ran the other way. Arriving through an agent increasingly means arriving with intent.

This is where the fear about advertising and brand building needs restating. An agent does not watch the television campaign or remember the sponsorship. It reads what the brand and others have published: prices, specifications, terms, availability, reviews, independent evidence. Brand equity that lives only in human memory does not reach the agent unless it has been translated into something the agent can parse and trust.

AIVO's research points to the gap this leaves. The Beyond Visibility working paper found that being present in an AI system's answers and being chosen by it are separate outcomes, and AIVO's AI Win-Rate™ measurement, run across roughly 25,000 buyer scenarios and 250 brands, shows wide gaps between a brand's market position and how often AI systems recommend it. A well-known brand can sit in almost every candidate set and still lose the selection to a competitor whose evidence the agent finds easier to use.

Legibility, in practice, means four things. An agent can find the business, read what it offers in a structured form, verify who it is dealing with, and complete the permitted action through an interface built for it. Each is a decision the company can take this quarter. The advertising budget does not become worthless in an agent market, but its effect now has to survive the translation into evidence.

An agent to meet the agent

The most direct form of legibility is to give arriving agents someone to talk to. The Personal Agent Protocol already allows for this: a company's declared interfaces can include its own company agent alongside its APIs and website. A brand-side agent can answer an incoming agent's questions in the form that agent needs, with current facts the brand stands behind, so the agent does not have to assemble the answer from pages written for people.

AIVO has built one. AIVO Assist is a brand-side expert agent that incoming AI agents consult when they evaluate a brand. It is being tested in stages. In the first, agents are directed to consult it; the next stage tests attribution, meaning whether a consultation can be traced to the agent's eventual choice.

The aim is a fully autonomous agent on the client side that mediates conversations with every incoming agent, diagnoses where the brand is losing selection and corrects the evidence as it goes, while working with the client's own systems and agents. Where a block turns the arriving agent away, Assist is designed to meet it, establish what it is trying to decide and give it what it needs to choose.

From clicks to decisions

Boards have spent twenty years optimising for discovery by people. Search engines ranked pages, customers clicked links and the website did the selling. In an agent market discovery and choice collapse into a single machine decision, made before any visit, and a business wins when an agent concludes from everything it can read and verify that this business is the best answer to the request.

That changes market structure as well as conversion rates. Websites competed for clicks; agent-ready businesses compete for inclusion in the decision systems that now stand between customers and whole categories. Prince's warning that agents favour the businesses they know most about points toward concentration around the most legible. A block withdraws the business from that decision at the very moment the market is settling who belongs in it.

What boards should decide now

The first decision is to have an agent policy at all, written by the business. That starts with an audit of what the company's CDN, bot protection and terms of use actually do to the agents customers are using today, Muse, Dots, Instinct, Grok Bot and Fo among them, compared with what management believes they do. In many companies the two will differ.

The second is to separate reading from acting. Product, price, rate, availability and policy information can be opened to identified agents at low risk, because that is where selection happens. Account access, transactions and money movement can sit behind verified identity, scoped permissions, spending limits and clear liability terms. Ryanair's settlement offers a template worth borrowing: admitted intermediaries transact through the company's own systems and pass on the customer's real details.

The third is to make the business legible: an agent-facing interface or declared access file, structured and current product and pricing data, and the independent evidence that wins comparisons in the category. This is the work through which brand investment reaches an agent. A brand-side agent such as AIVO Assist is its fullest form: one place where arriving agents get authoritative answers about the business.

The fourth is to measure Choice directly, because no other instrument will show the loss. That means running the journeys customers' agents run, recording who was shortlisted and who was selected, and fixing the evidence behind each lost decision. AIVO runs replica agents modelled on Muse, Instinct, Dots and Duet inside AIVO Meridian for this purpose, alongside AI Win-Rate™ measurement at the point of decision.

Limits of the argument

The revenue at stake today is small. Only 16% of shoppers are comfortable letting an AI assistant find and buy products for them, according to Coveo's 2026 Commerce Relevance Report, and referral measures still put AI at well under 1% of retail visits. A company that blocks agents this quarter will not see the cost in this quarter's numbers. The argument here is about position when volume arrives, and it rests on adoption continuing.

Some blocks are right. Credential-based logins by unidentified software are a real risk in regulated finance, and agents have already escaped intended controls in at least one widely reported incident. Banks carry obligations that retailers do not. Amazon's block may also be the correct decision for Amazon, given where its profits come from.

The standards are young. The Personal Agent Protocol is a 0.1 draft without payments, several identity and payment schemes overlap, and the Ninth Circuit's ruling may yet be reheard. Early movers may build to specifications that change. AIVO also has an interest to declare: its business is measuring and improving how agents choose brands, which is easier when agents are admitted, and AIVO Assist is one of its products. Assist is still in staged testing, and AIVO has not yet published results from it.

None of these limits makes the blanket block a sound default. Its cost never appears on a report, because the decision it forfeits is made somewhere the business cannot see.

Every customer can now arrive twice, once in person and once through software, and the second route is growing. The question in front of boards is whether an agent will ever be able to choose them. Companies that lock the door to the software will eventually find the person has stopped coming too.