Maybe You Should Open the Side Door

Years before anyone was calling them "agents," I spent a few evenings teaching a browser to do my chores. Playwright, a headless Chromium, and a handful of scripts that logged in, clicked through a few pages and grabbed what I needed. Most sites didn't care. A few did, and each one had its own tell: one choked on a Linux user agent, another sniffed out headless mode, and a third refused to talk to Chromium at all. The fix was almost embarrassing. I moved the scripts onto a real Windows machine running real Chrome with a few ordinary extensions installed, set the screen to an oddball resolution, slowed the typing down to something human and let the mouse drift across the page at a believable pace. Roughly 98% of the bot detection I'd been fighting simply stopped noticing me. I hadn't beaten anything clever, I'd just spent a weekend teaching my robot to look bored.

I've been thinking about that weekend a lot this week. On November 11, United Airlines announced it is banning AI agents from booking flights on behalf of travellers and rewriting its ticketing policies to match, warning that sharing account credentials with third-party assistants can expose sensitive information and trigger unintended purchases or MileagePlus redemptions. Business Insider now has a running list of retailers and travel companies doing the same, with speculation that agents "could cause sites to lose traffic" if humans stop visiting directly. United has company. Amazon, JPMorgan Chase, Charles Schwab and Delta are all keeping agents out in one form or another, and Yelp will only let one in if it pays for a data licence. Amazon's robots.txt now names ChatGPT, Claude, Perplexity and Meta's agents individually, which is a bold move from a company that sells its own shopping assistant.

Does any of it actually work? Ask Amazon. When it put up a technical block against Perplexity's Comet browser in August 2025, Perplexity pushed an update that got around it within 24 hours. Amazon's lawsuit accused Comet of dressing its automated sessions up as ordinary Google Chrome traffic, which is my Windows-box trick with a much bigger engineering budget. A district judge granted Amazon an injunction in March. In August, the Ninth Circuit threw it out, finding it was Amazon's own customers, acting through the agent, who accessed the platform. Amazon is now mulling a Supreme Court appeal. That's more than a year of detection engineering, evasion engineering and legal fees on both sides, and the agent is still shopping. Every dollar spent on that fight bought nothing either company's customers wanted.

I don't want to wave away the concerns, because some of them are legitimate. United is right that handing a third-party tool your MileagePlus password is a bad idea, and it's a bad idea at enormous scale in Canadian banking (more on that shortly). There's also a less noble motive sitting underneath much of this. Amazon pulled in $68.6 billion in advertising revenue in 2025, and every sponsored listing between search and checkout vanishes when an agent goes straight to the buy button. Perplexity put it bluntly in court, arguing that agents "don't have eyeballs" for Amazon's ads. Protecting a business model is a fair thing for a company to want. Blocking the agent protects the ad revenue for a while, but it leaves the credential problem untouched, because the customer who wants automation goes and finds a tool that hides better.

So what can we do about this? Open the side door. Publish a proper, documented API that customers can point their own tools at, and let the front door stay optimized for humans. Take OpenTable. If I want the self-hosted assistant I've been building to grab me a table for Friday, I can't do it the sanctioned way. OpenTable's consumer terms restrict automated assistants outside expressly authorized access, and every API it offers sits behind a partner application and a signed contract. The workaround left to me is to hand my agent a phone line and have it call the restaurant over the PSTN, moving backwards through the tech stack in order to move forward. The best part is that OpenTable already publishes an API it literally calls the Voice AI API, built for restaurant-side voice partners. There's a decent chance my robot phones the restaurant, a different robot answers, and that robot books my table through the API I'm not allowed to touch. Somewhere a codec engineer is weeping.

Banking is where this stops being funny. For those not familiar, Canada's version of open banking is formally called the Consumer-Driven Banking framework, legislated in Bill C-69 in 2024 and completed in Bill C-15 this year. Finance Canada published the draft regulations on June 27, consultation closed in August, and the Bank of Canada still won't commit to a launch date. The same regulatory filing contains the most damning number in this whole debate: about nine million Canadians currently share their confidential banking credentials with third-party apps through screen scraping. Aggregators like Plaid and Flinks use bank APIs where they've managed to negotiate them and fall back on credentials where they haven't. It works, and I'd argue it's the worst possible security model, since a company you've never met now holds the keys to your entire financial life when all you needed was a pipe between you and your bank. The ban on screen scraping won't kick in until the framework is fully operational, so for now the insecure option stays legal and the secure one doesn't exist yet.

As a consumer, connecting my own agent directly to my bank is exactly what I want. Read-only would be plenty to start. "How am I tracking against my budget this month?" and "What's coming out of my chequing account this week?" are boring questions, and boring questions are precisely the kind I'd love never to answer by hand again. Here's what I'm watching for as the regulations get finalized: the framework is built around accredited third parties, and I haven't seen anything yet that contemplates an individual pointing their own self-hosted assistant at their own account. If the only legitimate path to my data still runs through a company in the middle, we'll have rebuilt the aggregator model with better paperwork.

Where should the effort go instead? Into identity. The detection I beat years ago keyed on IP addresses, user agent strings, screen sizes and how fast I typed, all of which describe the machine and none of which describe the customer. Flip it around. Let a customer sign in normally, with whatever MFA you already require, and then issue a token for their agent with a defined scope: read-only, booking-only, a spending cap, an expiry date, revocable with one click from the account page. Issue one per agent so the audit log shows which one did what, and rate-limit against the verified human rather than the network they happen to be on. None of this is exotic. It's OAuth, and every bank and airline already runs it for its business partners. Target is partway there already, requiring customers to explicitly grant agents permission on their accounts and treating agent purchases as "transactions authorized by you." Once the human behind the key is verified, agent fraud looks a lot like the account takeover problem these companies already staff for.

Back in 2017, Forbes ran a piece by Sam Page titled Adapt Or Die urging businesses to find ways to get more eyes on their products and to test and adapt as technology shifts faster, summed up as "If you're not learning, you're losing." Agents are the newest set of eyes, and they come attached to wallets. Walmart, Target, Best Buy, Home Depot and Etsy have already chosen integration with AI shopping platforms over exclusion. When my assistant goes looking for a flight, it will book with whichever airline lets it finish the job, and it won't feel any loyalty to the one that slammed the door.

The ladder is already leaning against the back window, and plenty of people know how to climb it. Put a side door in that wall, give it a lock you control, and hand out keys with your verified customer's name stamped on each one. The bottom line is that you'll be serving agents either way, so you might as well know who sent them.