AI Agents Face a Website Access Problem That Better Models Cannot Solve Alone

Restrictions on outside agents expose a practical weakness in automated workflows: understanding a task does not establish permission to complete it.

AI agents face a deployment question that sits outside the model itself: will the service at the other end accept the action?

JPMorgan Chase’s third-quarter earnings transcript makes the boundary explicit. Jamie Dimon said the bank uses agents internally, while warning against unrestricted outside-agent access because of risks to customers and the bank. This is a distinction between approved use and uncontrolled access, rather than opposition to every form of AI automation.

The practical implication for buyers is significant. Before asking how intelligently an agent handles a workflow, ask which parts of that workflow it is permitted to perform.

What the latest reporting establishes

The Verge’s October 17 report describes restrictions across several services, including Yelp’s paid licensing requirement and Delta’s limitations on agent bookings. It brings together developments from different dates; it does not establish a coordinated new ban.

TechCrunch reported on October 6 that Walmart described agent checkout problems as unintentional.

Separate coverage adds detail to the banking story. The Next Web, citing Rick Wurster’s Bloomberg Television interview, reported that Schwab blocks unauthorized outside agents seeking to move money, while planning controlled access for functions such as viewing balances. The access proposal should not be described as an already universal capability.

Taken together, the evidence calls for a more precise vocabulary than “agents work” or “agents are blocked.”

Three different access questions

For a team evaluating automation, three questions deserve separate answers.

Can the agent identify itself? A website needs a way to distinguish a known automated client from unidentified traffic. Identification alone does not establish what the client may do.

Has the customer authorized the action? Permission to inspect information should be distinguished from permission to place an order, change an account or submit a transaction.

Does the service support that action through that route? A customer’s request and the service’s accepted integration path must line up. A successful sign-in is an intermediate step, not proof that every subsequent operation is supported.

Our analysis of agent permissions and system access explores why task instructions and technical controls need to be evaluated separately.

This is an analytical framework for evaluating a workflow. It avoids treating every failure as a weakness in reasoning, or every successful page load as permission to proceed.

The industry is working on controlled access

Sierra announced on October 6 that it and Meta were developing Personal Agent Protocol with industry partners. The proposed approach combines customer-granted access with business-defined limits, using OAuth-based sessions and routes through websites, APIs or company agents. The announcement said a v0.1 specification was planned for later that month. It establishes a development effort, not universal deployment.

An earlier initiative addresses recognition of automated traffic. Cloudflare introduced its signed-agents classification in August 2025, using cryptographic request signatures to help identify agents and give site operators more control over their traffic.

These approaches address related but distinct needs. Identifying the software making a request and defining the actions a customer delegates are different decisions. Neither announcement, by itself, proves that a particular booking or checkout will succeed.

What businesses should ask before buying an agent

A useful evaluation starts with one real workflow rather than a broad promise to automate work.

Consider a hypothetical procurement assistant asked to find an item, compare approved suppliers and prepare a purchase. Define success before the demonstration: the correct item, an approved supplier, a verified total and a clearly recorded approval before the order.

Then ask the vendor to document each step.

• Access route: The supported connector, API or permitted browser route for each service
• Allowed actions: A clear separation between reading, preparing changes and committing them
• Completion: A confirmation from the destination system, not just the agent’s summary
• Interruption: What happens when a login expires, a challenge appears or permission is denied
• Recovery: Who takes over and how a duplicate submission is prevented

This turns a polished demonstration into an assessable operating process. It also gives the buyer a way to compare products without assuming that an API connection is automatically secure or that browser automation is automatically unsuitable.

A narrow integration that supports the required action may be more useful for a particular job than broad browsing access with uncertain permissions. The reverse can also be true when an authorized browser workflow covers work for which no suitable integration exists. The deciding factor is the actual task and the service’s supported route.

Measure finished work and human effort

For a pilot, record the total number of attempted tasks and classify the outcome of every attempt: completed correctly, completed with intervention, blocked or failed.

Keep permission failures separate from incorrect reasoning and interface errors. Otherwise a single completion percentage can hide the reason the product succeeds or fails.

Record human time as well. An assistant that repeatedly needs someone to recover a session or verify an uncertain submission may offer less operational value than its demonstration suggests.

For consequential actions, define a stop condition. A denied request should trigger a documented handoff or an approved alternative. It should not become an invitation to search for ways around the service’s controls.

This is a proposed evaluation method, not a benchmark result. AgentsCalling has not run a comparative test of the services discussed here.

What to watch next

The meaningful milestones are specific: published specifications, working integrations, documented permissions and repeatable completion of supported tasks.

For now, the buying question is concrete: can this agent complete our workflow through an accepted route, and what happens when it cannot?

A convincing answer should include the destination service, the permitted action and evidence of the final result.

Featured photograph: Ales Nesetril / Unsplash. Illustrative photograph, not a screenshot of an agent or access restriction.

Prepared with AI-assisted research and drafting. Sources and verification boundaries are identified in the article.