A retail giant in Bentonville published a document this cycle that most of this industry scrolled past without stopping. It contained no token, no consensus mechanism, no rollup, no points program. It was a set of terms and conditions governing how autonomous software agents are permitted to purchase goods on behalf of human beings โ plus a registration system to attach an identity to each of those agents, plus an enforcement mechanism that terminates access when the terms are violated.
Strip the retail vocabulary away and what remains is a delegated authority framework. Scope-limited permissions. Spend ceilings. Human-in-the-loop approval callbacks. Accountable principals. Revocation.
That is the same design space that decentralized identity, session keys, and account abstraction have been circling for five years โ and a legacy retailer just shipped a production version of the governance layer before anyone in this industry shipped a consumer-grade one.
So before we get to whether this is bullish or bearish for anything, we have to answer a narrower question: what did Walmart actually build, what did it not build, and which part of the crypto stack maps onto the gap it left open?
What Actually Shipped, Versus What Was Announced
The gap between the announcement and the implementation is where all the analysis lives. Walmart announced that autonomous agents could act as purchasing proxies for customers. What is live is narrower than that sentence implies.
What exists today is a gateway โ a controlled integration surface โ through which approved agent operators can place orders against Walmart's catalog, subject to a written rulebook. What exists today is also an approval workflow: by default, a human confirms each order before it executes, delivered through some callback mechanism. What exists today is a per-agent registration: an identity artifact that lets the retailer know who is operating the software, and therefore who to terminate when something goes wrong.
What does not exist โ or at least was not described in any material I have been able to verify โ is an open, standard protocol that any agent developer can implement once and reuse across retailers. There is no published message format for agent-commerce transactions that competes with existing standards. There is no verifiable credential issued to the agent that travels with it across merchant boundaries.
The architecture substitutes structured server-to-server API calls for browser-driven DOM automation. This is a correct technical judgment and it is not a novel one. Anyone who has written a scraping harness against a dynamic storefront knows the failure modes: A/B tests that rename CSS selectors mid-week, layout shifts that invalidate element paths, anti-bot fingerprinting that flags headless Chromium, session state that expires five seconds before checkout, and โ the one that actually kills you โ silent failures where the automation clicks the wrong variant and orders a size 4 shoe instead of a size 10.
The API path eliminates that entire category of failure. It is stable, it is cheaper per transaction, and it produces clean telemetry. If you are building an agent that buys things, an endpoint beats a screen every time. That judgment was never in dispute.
What is in dispute is what the gateway is for.
The Component Inventory: Nothing New, Everything Rearranged
I want to be precise about the technical classification here, because the announcement language invites the wrong one.
Take the five operative constraints in the rulebook and map each to its established implementation pattern. The prohibition on agents accessing payment card data maps to PCI scope isolation โ a fifteen-year-old compliance pattern. The restriction on modifying payment methods maps to scope-limited token permissions โ standard OAuth resource scoping. The default human approval step maps to a human-in-the-loop callback in an asynchronous workflow โ the same pattern every enterprise approval system has used since the 2000s. The spend ceiling maps to a delegated authorization limit with an expiry โ the exact shape of an OAuth refresh chain or a scoped API key. The account-level ban on violation maps to principal revocation โ the oldest primitive in access control.
Not one component in that list is new. The innovation is compositional and it sits in the governance layer, not the technology layer.
This matters because the announcement framing โ open โ is doing work that the architecture does not support. This is not an open platform in the sense that Shopify's app ecosystem is open, or in the sense that the SP-API ecosystem is open. This is a standardized closed system: one merchant, one rulebook, one registration process, one enforcement regime, one gate.
Tracing the invisible ink of protocol logic: the strategic move is not opening a door. It is relocating the control point. Under browser automation, the control point is the page โ and the page belongs to whoever renders it, but the interaction model belongs to the browser. Under a gateway, the control point is the API โ and the API belongs to the merchant without ambiguity. Walmart is not surrendering control to agents. It is moving control to a surface where it can be instrumented, metered, rate-limited, priced, and revoked.
That is a much smarter move than it looks, and it is not altruism.
The Question Walmart Didn't Answer: Whose Protocol?
Here is the single most important omission in everything I have read about this.
Is the Agent Gateway a proprietary specification, or an implementation of a horizontal standard? Is Walmart adopting one of the emerging agent-commerce protocols being pushed by the large model platforms, one of the payment-token schemes being pushed by the card networks, or has it written its own?
The answer determines everything downstream. If it is proprietary, then every agent developer who wants to serve Walmart customers must write and maintain a Walmart-specific integration. That is a hard ceiling on adoption, and it is the same ceiling that killed a hundred enterprise integration standards before it. Developers integrate with the thing that gives them the most coverage per unit of work. A single-retailer protocol is, at best, the ninth integration they build. At worst, it is never built at all.
If it is standards-compliant, then the interesting question becomes which standard โ because there are at least three blocs forming, and they are not cooperating.
The first bloc is the agent platforms. They want to own the consumer's intent layer, which means they want to define the transaction format, hold the user's credential, and hand the merchant a request that the merchant must satisfy. Their incentive is toward a thin, standardized merchant interface โ the merchant becomes a fulfillment endpoint.
The second bloc is the card networks. They want the payment token to remain theirs, because the payment token is the residency permit for the entire interchange economy. An agent payment token issued under their rules keeps transaction data flowing through their rails and keeps the merchant in the role of acceptor.
The third bloc is large retailers, Walmart included. They want the payment token to stay on their side, the customer relationship to stay on their side, and the agent to be a replaceable commodity that can be swapped or banned without consequence.
Walmart's decision to prohibit agent access to card data is not just a security posture. It is a bid to keep the payment token inside its own perimeter โ which is a direct collision with the rails the card networks are currently building for exactly this use case.
Nobody covering this story mentioned that collision. It is the most consequential thing in the document.
Per-Store Identity Is an Unscalable Primitive
The registration requirement deserves separate treatment, because it looks like a minor compliance detail and is actually the structural weakness of the entire approach.
The agent operator registers an identity with Walmart. That identity is how violations get attributed, and attribution is how the rulebook becomes enforceable rather than decorative. Enforcement requires knowing who to punish. Punishment requires a principal. A principal requires an account relationship.
Now extend that across the market. Every retailer that adopts this model issues its own agent registration. An agent that serves a hundred merchants maintains a hundred identities, a hundred credentials, a hundred rotation schedules, a hundred revocation relationships, a hundred terms-of-service versions to track.
This is the identity problem that decentralized identifier standards and verifiable credential architectures were designed to solve: portable identity artifacts that a subject carries across relying parties, verifiable without a central registry per counterparty, revocable through a mechanism the subject does not have to negotiate individually with each verifier.
The crypto industry built these primitives. It built them with uneven quality, contested standards, and a governance process best described as emergent. But the primitive exists. A signed attestation bound to a keypair, presenting a scoped capability, verifiable by any counterparty without a phone call, revocable by the issuer โ that is a solved shape.
And here is the uncomfortable part: the agent commerce stack that is being built right now is reinventing delegated authorization from scratch, per merchant, without touching the portable credential primitives that already exist.
Mapping the topology of decentralized trust: the reason Walmart's approach terminates in an account-level ban is that the only identity anchor available to it is the customer account. The agent has no independent standing. If the agent belongs to the customer, then banning the agent means banning the customer โ which makes the enforcement threat mostly theatrical, because no retailer wants to ban a paying customer over a software misbehavior.
That is the trap. Enforcement without an independent principal is a bluff, and bluffs get called.
Catalog Readiness Is the Real Bottleneck, Not Compute
Now to the number that got quoted everywhere and examined nowhere. Roughly two-thirds of product data is reportedly not yet in a state that agents can consume.
The framing around that figure has been adoption friction. It is not friction. It is a structural asymmetry, and the shops that solve it first get a durable advantage.
A product catalog that is human-readable and a product catalog that is machine-actionable are different artifacts. The second one requires, at minimum: a stable product identifier that does not change when the merchandising team reorganizes the taxonomy; structured attributes covering the dimensions that determine fit and compatibility; real-time per-location inventory truth rather than a cached availability flag; variant resolution rules that map a natural-language request onto a specific SKU without ambiguity; machine-readable promotional and pricing terms including eligibility conditions; delivery time estimates computed rather than promised; machine-readable return terms including item-class exceptions; and substitution logic for when the primary SKU is unavailable.
Most retail product information management systems cannot produce all of that. Many cannot produce half of it. The data was built to render a page, not to answer a query.
Walmart is one of the few exceptions, and this is the part the skeptical read gets wrong. Walmart has historically forced structured data compliance on its marketplace sellers to a degree that most competitors did not. Its product data governance is genuinely top-tier among traditional retailers. So two-thirds of the market is not ready and Walmart is ready are not contradictory claims. They are the same claim.
That asymmetry is why Walmart moved first. It is not a bet on the future of agent commerce. It is a bet that its own data infrastructure is a moat that a competitor with better models cannot leapfrog.
And the compute angle? There is essentially none. I want to be explicit because this is where the mainstream AI narrative and this specific story diverge completely. Agent commerce does not consume meaningful GPU capacity. The bottleneck is not inference. The bottleneck is identity, intent authorization, order idempotency, catalog structure, and last-mile time. The infrastructure that gets pulled is API gateways, bot management, identity providers, and logistics density. Not accelerators.
If you are allocating capital on the assumption that agent commerce is a compute demand story, you are misreading the mechanism.
The Spend Cap Removes the Last Fence
Here is the risk that was mentioned in passing in every write-up and analyzed in none of them.
Agents can be granted a spending limit so that routine orders execute without per-order human confirmation. That option exists because per-order approval is annoying, and annoying features get disabled, and a feature that gets disabled is a feature that does not exist.
Now consider what per-order approval actually is. It is the last mechanical barrier between a poisoned input and a completed transaction. Every other control in the system is a policy. The approval step is the only enforcement point that requires a human to say yes.
Indirect prompt injection is the relevant threat model, and it does not require the agent to be compromised. It requires the agent to read content that contains instructions. Product listings contain text. Reviews contain text. Seller-provided descriptions contain text. If an agent ingests that content while performing a task โ and it must, in order to evaluate fit, compare attributes, and check availability โ then the content is an injection surface.
The rulebook constrains the behavior of agent operators. It does not constrain the behavior of the data the agent reads. A rulebook that governs the operator and not the payload leaves the payload as the attack path.
Under per-order approval, a successful injection produces at most a single fraudulent transaction and a confused human looking at a confirmation prompt. Under a spend cap with auto-approval, a successful injection produces unlimited transactions within the ceiling, executing at machine speed, until the cap is hit, the card declines, or somebody notices a delivery they did not order.
The ceiling converts an absolute control into a rate limit. Rate limits are not security boundaries. They are inconvenience budgets.
This is the precise reason session keys in the account abstraction world carry both a scope and an expiry and a maximum value and โ critically โ a mechanism for the principal to inspect and revoke. The difference between a policy and a mechanism is whether the failure mode is bounded by construction or bounded by trust.
Most of what shipped here is policy pretending to be mechanism.
Two Retailers, Two Balance Sheets, Two Answers
The story that got told is that Walmart opened and Amazon closed. That is a description of symptoms. The disease is on the income statement.
Advertising revenue is a function of the attention surface the merchant controls. When an autonomous agent constructs the purchase decision without rendering a search results page, the merchant loses the surface on which sponsored placement is sold. Every dollar of retail media revenue is, in effect, a toll collected on the friction of human browsing.
The magnitudes here are order-of-magnitude claims and should be treated as such, but the ratio is the point. Amazon's advertising business operates at a scale in the tens of billions annually. Walmart's retail media operation is smaller by roughly an order of magnitude in absolute terms โ and, more importantly, smaller relative to its own gross merchandise volume by a comparable factor.
That difference in exposure is the entire explanation.
For Amazon, an agent that bypasses the search page is not a channel problem. It is a direct assault on the highest-margin revenue line in the company. For Walmart, it is an acceptable concession to buy something it wants more.
The two firms are not expressing different philosophies about openness. They are optimizing against different revenue mixes. Anyone who frames this as a culture war between an open company and a closed one has substituted narrative for arithmetic.
And that framing has a cost: it obscures the actual transaction Walmart is making. It is giving up the browse-and-recommend surface in exchange for retaining the account, the payment instrument, the order history, the membership, and the returns relationship.
That is a precise and deliberate asset swap. The account relationship is the thing that persists across interface changes. The interface is the thing that gets commoditized. Walmart is trading a commoditizing asset for a durable one.
The Cardholder Analogy Is a Liability Transfer
Buried in the terms is a framing device that deserves far more attention than it received: the agent is characterized, functionally, as a cardholder authorized to transact.
That is not a description. It is an allocation.
Under existing card network rules, a transaction made by an authorized cardholder is the cardholder's responsibility. This framework attempts to pre-position the same logic for agent commerce: the customer authorized the agent, the customer bears the consequence, the operator is jointly exposed, the retailer is indemnified, and returns are the sole remedy.
This is the single most commercially consequential sentence in the document, and it is doing preemptive work: it is establishing liability placement before any dispute, lawsuit, or regulatory action forces the question.
Returns are offered as the universal remedy. Returns do not cover opportunity cost. They do not cover perishable goods that have already spoiled. They do not cover time-sensitive purchases where a late or wrong delivery destroyed the purpose of the transaction. They do not cover the cumulative cost of ten thousand small losses under a spend cap. And they do not cover the loss incurred when an account is banned by mistake and the customer has no human to appeal to.
Returns are the weakest interface in the whole system, and they are labeled the solution.
The Conversion Number Nobody Decomposed
A figure circulated showing that agent-driven direct checkout converts at roughly one-third the rate of human click-through.
Every write-up treated this as a maturity problem. It might be. It might also be a business model problem, and the published number cannot distinguish between the two because the necessary variables were never reported.
Click-through traffic is a high-intent funnel. The human arrives at the merchant's own surface, in a context the merchant controls, where recommendation modules, cross-sell placements, add-on offers, and threshold-based shipping incentives all apply upward pressure on basket size. Agent-direct checkout has none of those. It has a fulfillment request.
The missing variables are average order value and repeat purchase rate. If agent orders are smaller and less frequent, then the correct reading of the conversion figure is not the experience is immature but the unit economics are structurally worse. A channel with a third of the conversion rate and a materially lower basket is not a growth channel. It is a margin leak.
The same number supports the bullish case and the bearish case. The coverage picked the bullish one because the announcement was bullish. That is not analysis โ that is atmosphere.
I have made this error myself, in the other direction, and it cost me. In 2020 I built emission-curve visualizations to argue that liquidity mining was a subsidy rather than a market, and I was right about the mechanism. I was less right about the timeline, because I modeled the subsidy's unsustainability without adequately modeling how long a well-capitalized treasury can sustain it. The lesson generalized: a structurally sound objection with a wrong decay constant is still a wrong trade. The conversion decomposition above is the same shape of question. The mechanism matters, and so does the duration.
Three Monetization Paths and One Irresolvable Conflict
Agent Gateway has no announced revenue model. That silence is itself information, and it admits three plausible sequences.
Near term, the gateway is free. It is a traffic acquisition and data acquisition instrument. Success is measured in integration count and in the share of gross merchandise volume originating from agents. There is no revenue line because revenue is not the objective โ position is.
Medium term, monetization arrives as paid product placement inside agent-returned results. This is the natural migration path for retail media inventory: the sponsored slot moves from the rendered page to the structured response. It is also, and this needs to be said plainly, the moment the retailer begins manipulating the user's proxy.
There is no honest framing of a sponsored result returned to a purchasing agent. The agent's purpose is to optimize on the user's behalf. Injecting a paid preference into that optimization turns the agent into an advertising delivery mechanism wearing a butler costume. The disclosure problem is not a compliance detail. It is the entire integrity of the delegation.
Long term, if sponsorship is rejected or regulated away, monetization shifts to transaction take rate and to fulfillment-as-a-service โ selling store density as an API. That last one is interesting because it is the most defensible position and also the least differentiated. Any logistics operator with comparable coverage can sell the same capability.
The conflict is irreconcilable: the retailer cannot both sell influence over the agent's ranking and claim to serve the user's interest. One of those has to give, and the market will decide which by whether the disclosure is legible.
EDLP Was Built for This Moment by Accident
Here is a structural consequence almost nobody has surfaced.
The rulebook apparently commits to pricing products rather than pricing people โ no agent-exclusive pricing. That reads like a fairness gesture. It is not.
It excludes agent-specific pricing. It does not exclude membership pricing, personalized offers, dynamic pricing, or clearance mechanics. But the more important effect is emergent: when every retailer quotes the same price to an agent, and the agent is capable of comparing across every retailer simultaneously, the agent's optimization function collapses into a weighted combination of price, delivery time, and availability.
For an everyday-low-price operator, that is a favorable collapse. EDLP was built on the premise that customers should not have to hunt for discounts. It turns out that premise is exactly what a machine comparison engine wants: a stable, predictable price that does not require waiting.
For a high-low operator that funds itself on promotional cycles and customer patience, the collapse is corrosive. The entire economic value of a temporary promotion depends on the customer being unable to wait and unable to compare. An agent can do both, indefinitely, across every store at once.
That does not eliminate promotions. It eliminates the arbitrage rent that promotions extract from human impatience and human search cost. The margin does not disappear; it transfers to whoever holds the agent.
Walmart did not design EDLP for this. It was designed for a different decade with a different customer. But the mechanic maps cleanly, and that is why the pricing clause is a defensive posture rather than a moral one.
The Topology of Who Gets Hurt
Liquidity is not a resource; it is a behavior. The value of any chokepoint in a commerce system is not what it holds but what it can prevent from flowing. Apply that lens to the stakeholders, and the picture is cleaner than the discourse suggests.
Browser automation shopping startups are damaged, at least in venues that have adopted structured APIs. Their entire value proposition is robustness against an adversarial rendering layer. A stable endpoint is not competition for them; it is dissolution. The strongest will pivot to venues that have not opened, which is a shrinking market with an unappealing expiry date.
Comparison, cashback, and coupon extensions are damaged more severely. Their entire revenue model depends on occupying the layer between intent and transaction. An agent that resolves intent directly does not pass through that layer, does not render the extension, and does not generate the affiliate click. This is not a disruption; it is an excision. The affiliate economics of the open web assumed a human eyeball between decision and checkout. That assumption is being invalidated.
Retail media networks are reconstructed rather than destroyed. The inventory does not vanish; it changes address. It moves from rendered placements to structured response fields. The pricing model, the attribution model, and the measurement model all have to be rebuilt, and the firms that own measurement infrastructure own the transition.
Card networks are bypassed within the perimeter of any merchant that keeps the payment token on its own side. That is not a fatal wound, because interchange still flows on the underlying authorization. But the agent payment token โ the identity artifact that would let a network own machine-initiated transaction data โ gets excluded from the largest retail deployments. That is a strategic loss disguised as a technical detail.
Agent platforms are the clear beneficiaries. Whoever holds the intent layer holds the demand origination right. That is a structurally superior position to holding fulfillment, because demand origination is where pricing power accumulates.
Structured product data, product information management vendors, and e-commerce infrastructure providers benefit, because agent readiness becomes a procurement justification. Nothing sells enterprise software like a new compliance-shaped requirement with an ambiguous deadline.
Logistics and instant delivery benefit, because delivery time becomes a primary variable in the agent's comparison function. This converts store proximity from a cost line into a competitive attribute.
Marketplace sellers are mixed. They gain a new traffic surface. They lose pricing opacity, because price comparison harvesting becomes trivial when your competitor's price is available as structured data rather than scraped from a rendered page.
Labor, Compute, and the Job That Doesn't Exist Yet
The labor analysis that circulated was wrong in an interesting way. It identified low-skill displacement โ browsing, comparing, ordering โ and missed the higher-value displacement entirely.
The chain from product discovery to checkout was never primarily a labor chain. It was an interface chain. The people whose work is genuinely reconstructed are retail media buyers and e-commerce experience designers, because their craft assumes a human is looking at the screen. When the reader is a machine, the design constraints invert. Information density beats visual hierarchy. Semantic structure beats imagery. Explicit attribute markup beats aspirational copy.
The new role is agent experience engineering โ the discipline of designing a surface for machine parsing rather than human perception. It is structurally the same transition as the shift from desktop web to mobile, and it will produce the same ratio of displaced specialists to newly created ones. The creation is real. It is also slower than the displacement, every time.
Compute pull is negligible. I will state it once more because the misconception is persistent: agent commerce does not monetize GPU capacity. It monetizes identity, authorization, idempotency, catalog structure, and delivery speed. Annotating product data is a distant cousin of data labeling, but it is a data cleaning market, not a model training market.
Sifting through the noise to find the signal: if you want to know which infrastructure firms benefit, look at API gateway vendors, bot mitigation vendors, identity verification vendors, and last-mile logistics operators. Look away from the accelerator supply chain.
The Contrarian Cut: Open Is Not Open
Here is what I think is actually happening, and it is closer to the opposite of the popular reading.
Walmart did not open the gate to autonomous agents. It moved the gate. Under browser automation, the retailer's control surface was the rendered page, and the page is a weak control surface โ it can be adversarially scraped, and the defender is always one layout change behind the attacker. Under a gateway, the control surface is an authenticated API, and an authenticated API is a strong control surface. It can be metered, rate-limited, priced, throttled, revoked, and logged in ways a page cannot.
The announcement describes openness because the vocabulary of openness is what makes developers show up. The architecture describes a proprietary, registered, revocable access regime with a written rulebook and account-bound enforcement. Those are not the same thing, and only one of them is live.
The privacy claim deserves the same treatment. The claim is that agents do not require customers to hand over broad purchase history. That is true in the sense that the data never crosses the boundary. It is not true in the sense that the data stops being used. An agent that reorders your regular items must query a regular-items endpoint. That endpoint is a product of your purchase history. The pipe changed. The asset did not move.
The claim that rules shipped before the gate is often read as an execution failure โ the promise outran the capability. I think that reading is plausible and probably wrong.
Publishing an executable rulebook before the tools are complete is a strategy, not an accident. It stakes a claim to the de facto standard position in the discourse before anyone else has a document. It functions as a probe: by publishing terms, the retailer discovers which agent platforms will actually integrate and on what terms. You learn more about your counterparties by watching who accepts your contract than by watching who accepts your invitation.
The rulebook is not a promise. It is a reconnaissance instrument with a public relations department.
And the deepest cut: if agent commerce is real, and the agent becomes the primary interface, then brand equity migrates from the merchant to the agent. The customer does not develop loyalty to a fulfillment endpoint. The customer develops loyalty to the thing that understands them. Every merchant that commoditizes its interface is accelerating its own conversion into a backend โ which is precisely the position airlines occupy in the age of comparison search, and it is not a position with pricing power.
Walmart is trading interface control for relationship control. That trade is correct only if the relationship remains the scarce asset. If the agent layer becomes the relationship, Walmart has given away the surface and retained the commodity.
The Standard War Is Not Between Retailers
The framing that dominated coverage โ Walmart versus Amazon โ is the least useful axis.
The real contest is between three horizontal blocs, and retailers are a minority faction in one of them.
Bloc one: agent platforms. They own demand origination. Their preferred outcome is a thin merchant interface and a portable consumer credential they control. Every merchant becomes swappable.
Bloc two: card networks. They own the token rails. Their preferred outcome is an agent payment credential issued under their rules, keeping transaction data in their pipes and merchants in the role of acceptors.
Bloc three: large retailers with private gateways. Their preferred outcome is merchant-held payment tokens, merchant-held customer identity, and agents reduced to interchangeable clients.
Walmart's construction sits firmly in bloc three. That is coherent, and it is also fragile, because bloc three is the only bloc whose solution does not scale horizontally. A private gateway protects one merchant. It does nothing for the developer trying to serve forty merchants, and it does nothing for the consumer who wants one credential that works everywhere.
Decoding the cultural syntax of digital ownership: what consumers actually want is a portable agent identity that carries their preferences, payment authorization, and constraints across every merchant without renegotiating terms each time. That artifact is the decentralized identifier and verifiable credential shape. It exists. It has existed for years. It has been waiting for a use case with enough economic pressure to force standardization.
Agent commerce is that use case. It is the first application where the identity portability problem is not philosophical but operational โ where a hundred per-merchant integrations is a visible, quantifiable, absurd cost rather than an acceptable tax.
And it will not be solved by the crypto industry, unless the crypto industry stops waiting for the blockchain to be relevant. It will not be relevant here. On-chain settlement is not required for any of this. Verifiable delegation is required for all of it โ and that is the half of the problem this industry actually solved.
The Signals That Matter From Here
The first signal is not an announcement. It is disclosure. Watch for the first earnings report in which a major retailer breaks out agent-originated gross merchandise volume as a line item. That number ends the debate about whether this is a real channel or a demo, and it is the number nobody has committed to publishing.
The second signal is which protocol the gateway implements. If Walmart publishes a specification for others to adopt, bloc three has a chance. If it stays proprietary, the integration burden prevents the ecosystem from forming, and the whole architecture becomes an expensive loyalty program extension.
The third signal is the resolution of the payment token question. If card networks win the agent payment credential, retailers become acceptors again and the gateway is a temporary control point. If merchants keep the token, the agent's economics get squeezed toward pure fulfillment, and the agent platform's margin story weakens.
The fourth signal is disclosure policy on sponsored results. If a sponsored placement ever appears in an agent's returned ranking without legible labeling, the delegation contract is broken and the regulatory interest will follow quickly โ most likely through the existing dark-pattern and automatic-renewal enforcement frameworks rather than anything new.
The fifth signal is follow-on adoption. If other top-tier retailers build private gateways, the market fragments into a hundred incompatible agent interfaces and someone eventually imposes a standard from outside. If they adopt a shared standard, the interface commoditizes fast and the fight moves entirely to the demand layer.
I audited a vesting contract in 2017 and learned that the difference between a documented invariant and an enforced invariant is the difference between a promise and a system. I watched an algorithmic stablecoin die in 2022 and learned that community sentiment cannot override the collateral schedule. Both lessons point the same direction here.
The rulebook is not the gate. The rulebook is the first draft of who gets to be a principal in machine commerce โ and for now, the answer is the merchant, not the agent, and not the customer.
That will be renegotiated. The only question is whether it is renegotiated by developers, by regulators, or by whoever writes the standard that makes the per-merchant registration artifact obsolete.
Somebody is going to build the portable agent credential. The retailer that publishes the rulebook is not going to build it, for the same reason that no incumbent ever builds the thing that dissolves its chokepoint.
So the real question is not whether Walmart opened the gate. It is who writes the key.