Walmart's Agent Gateway admits an approved agent to searching and buying, and withholds exactly one thing: the card. Agents never receive payment card details and cannot add or change a payment method — and that line, not the MCP server sitting in front of it, is the settlement the whole agentic-commerce argument has been heading toward. Build a shopping agent that needs custody of the instrument and you are building for a permission no major retailer has granted anyone.
At a glance
Four positions, taken within about a month of each other, by companies running substantially the same technology.
| Platform | Date | Position on outside agents | Where the card sits |
|---|---|---|---|
| Walmart (and Sam's Club) | 21 Oct 2026 | Agent Gateway, an MCP server, in beta for approved companies and developers | With Walmart — never passed to the agent |
| Amazon, buyer side | Sept 2026 | Meta's Muse agent cut off; cites security, privacy and agents not identifying themselves | No grant to discuss |
| Amazon, seller side | 23 Sept 2026 | Seller Central APIs opened to outside agents | Not a buying path |
| Target | Reported Oct 2026 | Approved-provider list | With Target |
What the gateway actually grants
Two verbs, not three
Read the grant as a list of verbs and it is unusually clear. The agent may search inventory and it may buy — submit an order against a payment method the customer already has on file. It may not hold: no card details reach it, and the add-or-change-payment-method path is closed to it. A shopping agent built on this gateway is a very good selection engine with a submit button, and nothing about the customer's financial relationship passes through it.
The dispute path tells you the same thing from the other end. Walmart's ordinary returns process applies even when an agent does not act as intended, which is a quiet but consequential allocation: the retailer is absorbing the cost of agent error rather than pushing it onto the agent developer or the customer. That is a choice you can only make if you kept the transaction inside your own rails, and it is the reason the arrangement is stable enough to open in the first place.
Identification is the price of admission
Approval is a step, not a formality, and reporting on the launch says agents that do not comply with the terms will be blocked from the site. Customer-facing Agent Profiles were reported to follow in November 2026 — which, if it ships as described, means the customer sees which agent is acting and the retailer gets a per-agent handle to throttle, audit or revoke. Compare that with the stated reason Amazon gave for cutting off Muse: agents that do not properly identify themselves. Both companies are optimising for the same property. Only one of them currently believes an outside agent can be made to supply it.
Amazon drew the opposite line with the same technology
This is the part worth sitting with. Nothing technical separates the two cases. Both retailers run large catalogues behind APIs; both can see a request's provenance; both could register third-party agents if they wanted to. Amazon cut off Meta's Muse agent in September 2026 and in November 2025 sued Perplexity over its Comet browser agent making purchases on the marketplace, while opening Seller Central APIs to outside agents two days after the Muse block — which we covered in Amazon opened the back office and closed the storefront in the same week.
The variable is a commercial judgement about whether an intermediary standing between the retailer and the customer is a channel or a competitor. For a retailer whose economics run on search placement, advertising and own-brand merchandising, an agent that answers "buy me the cheapest equivalent" is a disintermediation threat. For a challenger, the same agent is traffic it did not have to pay for. That is the entire difference, and it is a judgement that gets revisited whenever the business reason moves.
A protocol can make an integration possible. It cannot make it permitted, and the permission is the part with a renewal date.
Which is why "we use the official MCP server, so we are supported" is the sentence that precedes the outage. An official endpoint tells you the platform built a door. It does not tell you your key still turns next quarter. We wrote the engineering response to that up as Platform Terms for Agent Access: a one-page dependency table, an authorisation-shaped failure metric that stops instead of retrying, and a degradation path that hands the user back a real cart.
What this changes if you are building a shopping agent
Design for selection, not for custody
The durable version of your product is the one that is excellent at the part the platforms are willing to delegate: understanding a vague request, resolving it against a real catalogue, reasoning about substitutions, and assembling a basket a human recognises. The fragile version is the one whose differentiator is holding the credential — autofilling a card, storing a wallet, acting as merchant of record on someone else's inventory. Every public blocking justification so far has been aimed squarely at that second shape.
Assume per-retailer approval, and price the concentration
An approved-agent model means your coverage map is a list of relationships, each with its own review, its own terms and its own unilateral exit. If one retailer carries a promise you make in your own marketing, that is a concentration risk engineering cannot fix. Either hold a second sanctioned route or say in the product what the dependency is.
Make the agent legible before anyone asks
Identify the agent in the request, keep the consent record that shows which human asked for this action, honour the published rate, and keep the verification signals a platform looks for. The platforms opening up are building approval processes; an agent that already behaves like an approved one gets a short review instead of a hard argument. The adjacent playbook is Shopping & Checkout Agents.
Treat a block as a policy event, not an error
Revocation arrives as a 403 on a route that worked yesterday, or a challenge page where JSON used to be. Generic retry logic reads that as transient and turns a policy decision into a retry storm against a platform that just told you to stop — which is how a recoverable misunderstanding becomes a permanent ban. Count authorisation-shaped failures per platform as their own metric and, on a sustained block, go quiet and page a human.
The part nobody has settled
Custody of the card is now reasonably clear. Three things are not. Attribution of intent: when an agent buys the wrong thing, "the customer asked for groceries" is not a record of consent to this basket at this price, and the industry has no shared format for one — the protocol work in AP2 and agent commerce is the attempt. Comparison and placement: a retailer that admits agents is admitting something that can be pointed at a competitor mid-session, and no published terms yet say what an agent may do with the prices it sees. Scale: a gateway sized for human shopping behaviour meets an agent that re-prices a basket every hour, and rate limits written for browsers are the first thing to break.
Each of those is a commercial argument wearing a technical costume, exactly like the card question was. Expect them to be resolved the same way — in terms documents, unevenly, by companies with different reasons.
FAQ
Is Walmart's Agent Gateway an MCP server?
Yes — the launch coverage describes it as an MCP server that approved agents call to search inventory and purchase at Walmart and Sam's Club, in beta for companies and developers as of its 21 October 2026 announcement.
Can an agent using the gateway see or store a customer's card?
No. Agents never receive payment card details and cannot add or change a payment method. The order is submitted against an instrument the retailer already holds, which is the boundary the whole arrangement is built around.
Why did Amazon block agents while Walmart admitted them?
Not for a technical reason. Amazon cited security, privacy and agents failing to identify themselves when it cut off Meta's Muse in September 2026, but the underlying variable is whether an intermediary between retailer and customer is treated as a channel or a competitor — a commercial judgement that differs by company and can change.
Who is responsible if an agent orders the wrong thing?
On Walmart's gateway, the retailer's ordinary returns process applies even when an agent does not act as intended. That is a deliberate allocation of agent-error cost to the retailer, and it is only available because the transaction never left its own rails.
What should I build differently today?
Build for selection rather than custody, assume per-retailer approval with unilateral exit, identify your agent in every request, and instrument authorisation-shaped failures separately so a block stops your traffic instead of amplifying it.
Further reading
On this wiki:
- Platform Terms for Agent Access — the dependency table, the 403 alert and the handoff.
- Shopping & Checkout Agents — building the selection side.
- AP2 and Agent Commerce — the attempt to standardise mandate and intent.
- Bot Verification & Agent Access — how platforms decide what is calling them.
- Third-Party Agents Logging In As Your Users — the same problem from the platform's side.
- Amazon opened the back office and closed the storefront in the same week — the seller/buyer asymmetry.
Sources:
- TechCrunch — While Amazon blocks AI agents, Walmart rolls out the welcome mat (21 October 2026)
- Amazon newsroom — for Amazon's own statements on outside agents
- Walmart corporate newsroom — for the Agent Gateway announcement and terms