Why AI agents need an identity layer to act safely on web built for humans

AI agents can shop, book travel and make payments, but disputes involving Meta, Amazon and NPCI expose gaps in how the web identifies agents, grants permissions and assigns responsibility

Artificial intelligence (AI) agents are moving from answering questions to performing tasks such as shopping, booking travel, sending emails and making payments. But many of the systems they need to use were designed around human users, creating problems around identity, access, authentication and accountability.

 

Meta's new Muse agent ran into this problem within weeks of its launch. Amazon blocked Muse from accessing its marketplace, saying the agent was unauthorised and raising concerns over how it identified itself and handled customer credentials. In India, the National Payments Corporation of India (NPCI) has also paused the rollout of its proposed Unified Agentic Protocol (UAP) for UPI, citing regulatory and safety concerns.

 

 

This suggests that while AI agents can operate autonomously, the internet does not yet have a common way to recognise what an agent is, who it represents, what it is allowed to do and who is responsible when something goes wrong.

Amazon blocks Meta's Muse

Meta introduced Muse on September 8 as a personal AI agent that can work across apps and the web. It can open a browser, fill out forms, book travel and act on a user's behalf. Meta says Muse can also complete purchases, with payments handled through Stripe's Link wallet and a one-time card designed to keep the user's actual card details hidden.

 

Amazon did not agree to let Muse operate on its marketplace.

 

Users trying to shop on Amazon through Muse began seeing a message saying continued access by an "unauthorised AI agent" violated Amazon's Conditions of Use. Amazon said Meta had not informed it that Muse would access the store, that Muse did not identify itself while browsing and that it appeared to capture and store customer credentials.

Meta has disputed the security concerns. The company says Muse cannot see passwords or payment information and that credentials provided by users are kept in secure storage.

 

The dispute is important because Muse was not trying to use a special Amazon interface built for AI. It was interacting with the existing web environment. That means Amazon's existing controls for human users and conventional automated traffic become part of the agent's operating environment.

 

Amazon has already had a similar dispute with Perplexity. In November 2025, it sent a cease-and-desist letter over Perplexity's Comet browser, arguing that the AI agent was accessing Amazon on behalf of customers without authorisation and could degrade the shopping experience. Amazon also raised concerns about credentials and the way Comet identified itself.

 

The issue is therefore not limited to Muse. It is about whether an AI agent can act as a customer on a third party's website without having a formal relationship with that website.

Websites are learning to distinguish agents from people

The technical infrastructure behind the web is also changing in response to AI agents.

 

Cloudflare, which provides infrastructure and security services to a large part of the web, now distinguishes between three types of AI traffic: search crawlers, training crawlers and agents. It defines agents as automated systems acting in real time on a person's behalf, including browser-based agents.

 

From September 15, Cloudflare's new default settings for new domains block agents and training bots on pages that display advertisements, while allowing search crawlers. Website owners can change these settings.

 

Cloudflare is also working on ways to establish whether an automated system is what it claims to be. Its definition of a verified bot includes deterministic identification through mechanisms such as cryptographic Web Bot Auth signatures, published IP addresses or reverse DNS, along with compliance with site instructions.

This creates a new requirement for agents. Being able to operate a browser is no longer enough. An agent may also need an identity that a website can verify and a mechanism through which the website can decide what that agent is permitted to do.

 

The scale of automated activity is already significant. Cloudflare said in July that automated traffic had reached about 57 per cent of all web requests. Cybersecurity platform DataDome's 2026 State of Bot and Agent Security report, based on an analysis of more than a trillion requests across over 75,000 customer sites between July 2025 and June 2026, found that AI traffic rose 82.3 per cent during the period.

 

DataDome also found that automated activity is reaching deeper into customer journeys, including login, account and transaction flows. That makes the distinction between a conventional crawler and an agent acting with a user's authority more important.

The missing layer is authorisation

The problem becomes more complicated when an agent needs to move between several services.

 

A human booking a flight can log into an airline website, authenticate, make a payment and accept the airline's terms. An agent doing the same task needs to establish that it is acting for a particular person, what that person authorised and whether that authority extends to every step of the transaction.

 

This is also being worked on at the internet standards level. The Internet Engineering Task Force (IETF), the international standards body that develops many of the protocols used to operate the internet, is examining how authentication and authorisation systems need to adapt to AI agents.

 

One such effort is a July 2026 Internet-Draft from the IETF's Workload Identity in Multi-System Environments (WIMSE) Working Group. The draft, titled Credential Delegation Protocol for AI Agents in Multi-System Environments, proposes a way for users to delegate limited and verifiable permissions to AI agents operating across different online services. It covers agent identity, restrictions on what an agent can access or do, protection of users' underlying credentials, consent, revocation and audit trails. The proposal is still a work in progress.

 

Another IETF draft, AI Agent Authentication and Authorization, looks at how existing standards such as OAuth and workload identity systems could be used to authenticate agents and determine what they are permitted to access.

India is building an authorisation layer for UPI

The same problem is appearing in financial transactions, where the consequences of an unauthorised action are more direct.

 

Earlier this month, Business Standard reported that NPCI had temporarily put its Unified Agentic Protocol on hold while it worked through regulatory clearance and safeguards. Five people aware of the development told the publication that the focus included user protection, potential liability when agents go wrong and governance standards for the technology.

 

UAP is essentially a framework that could allow AI agents to make small UPI payments without requiring the user to approve every individual transaction.

 

Reuters also reported that NPCI is working on a registry to verify and monitor AI agents making payments on UPI. The registry could initially cover UPI and later extend to cards, bill payments and other payment methods.

 

The proposed registry addresses a problem that Amazon encountered with Muse: identification.

 

An agent making a payment cannot be treated exactly like an unidentified browser session. The payment system needs to know which agent is acting, which user authorised it, what limits apply and where responsibility lies if the transaction is disputed.

Commerce is moving towards agent-specific infrastructure

Technology companies are already building systems designed around this problem.

 

Google has developed the Universal Commerce Protocol (UCP) for communication between agents and merchants, alongside its Agent Payments Protocol (AP2). Google says AP2 can attach spending limits and purchasing conditions to an agent's authority and create a verifiable record connecting the user, merchant and payment processor.

 

Meta is also moving in this direction. At Connect, it announced more connectors for Muse, including Walmart, Best Buy, Sephora and Wayfair, along with Shop Pay and PayPal for payments. The company is also adding Expedia and Instacart.

 

These integrations avoid some of the problems created when an agent has to behave like a person using a normal website. Instead of relying entirely on browser automation, an agent can use a defined interface through which the service decides what information and actions are available.