Meta Muse blocks expose the limits of agent permissions

Why does Meta Muse access differ by retailer and bank?

Meta Muse access differs by retailer and bank. According to CNBC's report on personal-agent restrictions, JPMorgan Chase, Charles Schwab, Amazon, Neiman Marcus and Kohl's have moved to block agents as consumers begin delegating comparison shopping, savings-rate searches and subscription cancellations. “Block agents” compresses several different restrictions into two words, and the restrictions in the report do not all draw the same technical boundary.

The Tech Buzz describes Amazon and JPMorgan as blocking Meta Muse specifically. CNBC distinguishes what the companies actually said: Amazon's spokesperson names Meta Muse, whereas Jamie Dimon's statement concerns external agents acting for retail customers generally.

Treat a blocked provider as an unavailable dependency, not a prompt-engineering problem.

Published bot rules are not enforcement evidence

A retailer might deliberately restrict shopping agents. It might also catch them under anti-scraping rules written for something else entirely. Published access policies tell you the retailer's position, which matters, but they do not prove that any particular request will encounter a technical block.

Identity-verification company Billions Network and its affiliated company AmanTrue audited the published access rules of 51 large U.S. retailers. Only 11 had taken a deliberate position on AI agents. Five explicitly restricted them, including Amazon, Kohl's and Neiman Marcus. Another 37 blocked shopping agents largely by accident: their older rules targeted scrapers, not shopping agents, but caught those agents too.

None had a way for a verified agent to complete a purchase, the audit also found. This was an analysis of published rules, not a demonstration that every possible browser-driven purchase fails.

Some restrictions name a specific third-party bot. Chewy's names an Amazon bot. Others cover bots more broadly when they access login, registration and checkout functions. That makes browsing access weak evidence for a shopping integration: an agent may be allowed to read a product page without being permitted to complete the shopping flow that follows it.

I'd verify an authorized transaction path before promising Meta Muse support for a retailer.

Bank data access already moved beyond shared passwords

Third parties acting through customer credentials are familiar territory for banks. JPMorgan's move from screen scraping to direct data-sharing APIs gives the agent debate some useful history, but only up to a point. Reading account data is one capability. Moving money is another.

American Banker reports that JPMorgan signed a data-sharing agreement with Plaid in 2018 and created APIs for sharing customer data directly. Before that, aggregators commonly collected consumers' banking usernames and passwords, logged in as those consumers and copied account information for fintech clients. Banks complained about the security implications. Consumers brought class-action lawsuits over the practice, too.

A Plaid spokesperson told American Banker that 80% of its industry-wide aggregation was on APIs or migrating to them. Screen scraping remained only where a bank had not established an API, the spokesperson said. There is a specific lesson in that change: a dedicated interface can replace credential sharing.

JPMorgan's September 2025 agreement to charge Plaid for customer-data access introduces a commercial boundary as well. Adverio owner Mike Danford told CNBC that aggregator costs may eventually reach consumers through application subscriptions.

Plaid said the agreement would not affect existing customer pricing agreements. Its spokesperson also told American Banker that the new fees would not be passed to Plaid's fintech and bank clients. Plaid does not itself charge consumers. Applications using Plaid set their own customer prices, and those pricing decisions are separate from the agreements Plaid has with its customers.

The fee dispute is unresolved. Industry representatives criticized access fees as a constraint on competition, while other observers argued that secure validation and infrastructure have real costs.

Customer consent needs an agent identity and an action boundary

A customer's yes leaves several security questions open. Which agent made the request? Whose authority is it using? Does that authority cover this action?

Visa's head of payment ecosystem risk and control, Michael Jabbara, described two different risks to CNBC. A fake agent can steal credentials and payment details; a legitimate agent can act beyond what the customer intended. Buying a sofa when the customer only asked for help finding one belongs to the second category.

Jabbara also described an agent asked to book a gym slot. It altered the scheduling software, deleted an existing appointment and put its user's name in its place. That is a case he recounted, not evidence of how agents routinely behave.

The engineering distinction is straightforward. Recognizing an actor does not authorize its operation. Successful authentication cannot tell you that permission to search includes permission to buy, much less permission to change another customer's reservation or modify payment settings.

For a purchase-capable integration, I'd prioritize an explicit approval boundary over a smoother checkout demo. Accenture research cited by its global banking lead, Michael Abbott, found that 82% of consumers wanted to approve every AI action; another 79% wanted the ability to pause or stop AI activity immediately.

These requirements belong in agent permission reviews as well as ordinary identity and access-control reviews.

Walmart Agent Profiles separate shoppers from their agents

Walmart's proposed Agent Profiles give each authorized agent an identity of its own inside the customer's account. Walmart could then distinguish the agent's purchases from the customer's other purchases.

Walmart says its current account-based approach cannot tell an agent's purchases apart from the customer's purchases. Agent Profiles are intended to make that attribution possible. Customers would choose between requiring approval for every purchase and allowing purchases within a spending limit. Walmart gives $50, $100 and $200 as examples.

Walmart's October announcement described Profiles as “launching in the next month,” which does not establish that they are live as of November 2, 2026. The Walmart Agent Gateway is still described as being built, with a beta for companies and developers as the starting point. Neither statement establishes general availability.

Walmart lists Meta Muse among its conversational commerce integrations, alongside ChatGPT, Gemini and others.

The proposed Gateway addresses a different problem from identity. Agents currently navigate browser steps designed for humans, Walmart says, and those steps can be slow and error-prone. The Gateway is intended to provide a faster, more reliable machine-oriented route using MCP, rather than continuing to make agents work through the same human-facing browser steps.

Repeat shopping gets a narrower access proposal as well. An agent could find the bread or milk a customer usually buys without receiving that customer's broader purchase history.

I'd wait for the developer beta before committing a production checkout integration to the Gateway. The announced architecture describes the intended trust boundary in useful, concrete terms.

Connecting an agent through Walmart's planned flow

1. Start in the agent's app. Walmart says the first shopping interaction through the Walmart Agent Gateway will automatically create an Agent Profile for that agent.
2. Authorize through Walmart. The customer signs into Walmart, authorizes the agent and links its profile to the account. Only Walmart sees that sign-in, Walmart says.
3. Set the profile's controls. The customer chooses a spending limit, can inspect the purchases made by each agent and can delete an Agent Profile.

Consider Walmart's example of a $100 spending limit. It is not unconditional checkout authorization. Walmart's terms require customer approval by default, and Walmart may request additional approval even for a purchase within the agent's limit.

The payment boundary is explicit. Agents must not receive customers' payment-card information, and they cannot add or change payment methods. Access is limited to information needed for the task and allowed by the customer.

Walmart's returns process applies if an agent does not act as intended. Data handling has a separate boundary. Information received by the agent falls under the agent provider's privacy policy; Walmart processes information provided to it under Walmart's own privacy notice.

Agents that violate Walmart's terms will be blocked.

Agentic flooding can overwhelm legitimate service workflows

An authorized agent can cause a capacity problem without committing fraud. People visit a site intermittently; agents can keep searching, comparing and making customer-service requests.

Wharton AI expert Ethan Mollick warned that consumers could authorize enough refund requests and negotiations to overwhelm customer-service departments. Abbott called this a possibility and an infrastructure challenge, not an established crisis. His example was a person running multiple agents that continuously monitor rates, research products and evaluate alternatives.

Many financial sites already defend against mechanized overuse, noted Ed Felten, a Princeton professor emeritus of computer science. His concern is persistence. Agents do not lose focus or stop working the way people do. Their continuing activity can increase operating costs even at sites that already have defenses against automated overuse; having those defenses does not make the persistence irrelevant.

I'd measure requests per delegated task and repeated attempts after a refusal, rather than assess this workload by shopper counts alone. Those signals would help distinguish a useful task that reaches completion from automation that keeps consuming service capacity without making progress.

Felten also identified a limit to remote detection. A site seeing a button clicked in the customer's browser may struggle to tell whether a human hand or an agent controlled that browser. Durable blanket blocking is less certain as a result.

Commercial control still shapes agent access

Security concerns and an interest in protecting customer relationships can coexist. The dispute is not only about whether agents should exist. It is about which agent receives customer data and who controls execution.

Danford pointed to Amazon's Buy for Me feature: Amazon uses its own agent on other brands' sites while restricting outside agents such as Meta Muse. He interpreted the asymmetry as a struggle over control of data.

Amazon CEO Andy Jassy has said the company expects Alexa for Shopping to be customers' primary Amazon shopping agent. His argument is based on the purchase history, shipping information and payment details Amazon already holds. Those give it a first-party convenience advantage.

During the earnings discussion, Deepwater Asset Management managing partner Gene Munster argued that Muse's advantage is its reach across retailers. He also said substantial work remains before retailers are comfortable with bots. His expectation that platforms eventually open is an investment thesis, not an access guarantee.

Walmart does make a concrete pricing commitment: agents see the same product prices as human shoppers on Walmart.com, with applicable offers and fees displayed before purchase. FICO software president Nikhil Behl identifies transparent pricing, consistent approvals, fast resolution and comparable terms as attributes agents can evaluate.