The retailers in this story are not split between smart and foolish. They are split between companies that made a decision and companies that let one get made for them.
QVC decided to be open. Agents can buy, and QVC sends its catalog to OpenAI and Google so it shows up. Gap decided case by case which agents can browse and which can check out. Tapestry decided agents can browse its brands but not buy, and it is building checkout anyway so it is ready to flip. Amazon and Kohl's decided to keep agents out.
You can argue with any of those. But each one has a reason, an owner and a position someone can defend in a meeting.
Most companies have none of that. Their policy is whatever their CDN, firewall or website platform turned on. Parts one through three of this series covered why that is the risky place to be. This post is what to do about it.
The four positions
| Position | Agents can | Good fit when | Watch for |
|---|---|---|---|
| Open | Find you, browse, buy | You want reach and your checkout is ready | Fraud, cart hoarding, data you share |
| Case by case | Depends on the agent | You have the people to review each one | It quietly becomes "closed" if nobody owns the reviews |
| Ready | Browse now, buy later | You are not sure of demand yet | "Later" never coming |
| Closed | Nothing | The risk is real and the demand is not | The gray market in parts two and three |
Isabel Perry, chief strategy officer at the digital firm Dept, called getting ready a "no-regret investment" in the Journal's reporting, even for retailers that do not welcome agents today. That matches our own experience. Two of our sites, orgtp.com and ijoin.ai, went from 51 and 41 to 90 and 92 on our Agent Ready scan with ordinary website changes. Being able to let agents in costs little. Discovering you need to, with nothing built, costs a lot.
A one-page policy
Here is the version I would put in front of a leadership team. It fits on one page, and every line has a name next to it.
- Owner. One person owns the company's AI agent policy. Not "IT and marketing." One name.
- Position. Open, case by case, ready or closed, for each of: being found, browsing, booking or buying, and logging in to accounts.
- Conditions. What an agent must do to get in. For example: identify itself, act only with the customer's permission, use a limited or one-time payment, respect spending limits.
- The number. One measure the owner reports every week. Agent visits, agent-started carts or bookings, agent-completed orders. If you cannot measure any of them yet, the first number is "can we see agent traffic: yes or no."
- The default check. The owner confirms what your security settings and robots.txt actually do today, and that they match the position above.
- The review date. A date in the next quarter when the team looks at the number and decides whether to move one step: closed to ready, ready to open, or back.
That is it. The point is not to get the position right on the first try. It is to make it a decision that a person owns and revisits with evidence, instead of a setting nobody remembers turning on.
This applies past retail
A gym will get agents asking to book a trial class. A contractor will get agents asking for quotes. An agency will get agents comparing it to three others. A franchise system will get agents trying to find the nearest location and its hours. The questions are the same: can agents find us, read us, book with us, and who decided.
The answer also changes over time. Ride sharing at the Orlando airport went from restricted to required by state law. Bank data went from blocked to federally regulated. You want a policy that gets looked at every week, not one that gets written once and forgotten.
Where OTP fits
This is the kind of decision that slips. It is not urgent on any given Monday, it crosses marketing, technology and finance, and nobody wakes up owning it.
In OTP, it goes on the chart and in the weekly meeting like any other piece of work that matters:
- A seat with an owner. The agent policy belongs to a named seat on your chart, held by a person or an agent.
- A number on the scorecard. Agent traffic or agent orders sits next to your other weekly numbers, so the team sees it move.
- An issue on the agenda. "Should we let agents check out?" is raised, discussed and resolved in the Delta Meeting with an owner and a due date.
- A commitment that carries forward. If someone says "I will check our firewall settings by Friday," it is on the record and comes back next week until it is done.
What to do this week
- Name the owner of your company's AI agent policy.
- Run a free scan at agentready.sneeze.it to see what agents can reach today.
- Put one question on your next leadership meeting agenda: "What is our position on AI agents, and who decided it?"
Frequently asked questions
What is an AI agent policy?
An AI agent policy states whether AI agents may find, browse, book or buy from a company's website and accounts, on what conditions, who owns the decision, how it is measured and when it is reviewed.
Should a small business let AI agents book or buy?
It depends on whether the business can handle the fraud and data risks and whether customers want it. A common middle path is to let agents find and browse now, build the ability to book or buy, and review the decision quarterly with real traffic numbers.
What is a no-regret investment in agentic commerce?
Work that pays off whether or not agent shopping takes off quickly, such as structured product or service data, agent-readable pages, a checkout that can accept identified agents, and the ability to measure agent traffic.
Sources
- The Wall Street Journal, CMO Today, on retailers and agentic commerce (October 2026)
- Amazon kicks out Meta's Muse in split over AI shopping, Yahoo Finance
- Orlando airport authority lifts restrictions on Uber, Lyft drivers, Bay News 9
- Required Rulemaking on Personal Financial Data Rights, Federal Register
- Agent Ready, Sneeze It
Put the decision on your agenda
OTP is readable from any MCP client. In Claude Desktop, Cursor or any MCP client, add this block:
"otp": {
"command": "npx",
"args": ["-y", "@orgtp/mcp-server"]
}
Restart the client. Then ask: "Use OTP to show me Sneeze It's chart. Who owns each seat, and what number is each one measured on?"
Start free at orgtp.com. Every seat is free, for people and agents. You pay only for the AI you use.
The series
- Amazon blocked the AI shopping agents. History says the block is the risky part.
- Orlando's airport kept Uber out for years. The riders got picked up anyway.
- Block the agent that says who it is, and you are left with the ones that don't.
- Open, closed or ready: decide your company's AI agent policy on purpose.
All four on one page: When brands block the AI shopping agents.
Series: When brands block the AI shopping agents. Part 4 of 4. Read this post as markdown: /blog/decide-your-ai-agent-policy-on-purpose.md.