You're about to connect an AI agent to a shopping account, a company card, or your team's expense system, and you stop for a second because you realize you don't actually know how much freedom to give it. An agent that buys the wrong thing, at the wrong price, without asking, is exactly the risk you're trying to avoid.
Here's what you get: four questions that tell you how much spending authority to give an AI agent, based on the rules Walmart just wrote for outside shopping agents, and what happened when Meta tested this at scale.
Start with the basics. A "shopping agent" isn't just the thing placing orders on Walmart or Amazon. It's any AI tool you've connected to a credit card, an expense account, or a purchasing system at work, so it can order something for you without you clicking every button. This is the first year big companies are writing down, in plain terms, what an agent like that is allowed to do, and they don't all agree. JPMorgan and Bank of America said no, over the risk to customers' money. Amazon said no for a different reason, competitive. Walmart said yes, but with written rules.
Four questions before an agent touches money
Each question checks a different risk. If one fails, don't rely on the default setting, narrow what the agent can do instead.
- Can it change payment methods or account settings, or only spend from what's already approved?Walmart spelled this out directly in its terms: an agent can't swap a payment method or touch account settings. That's the first boundary, before anything else.
- Is there a hard cap on how much it can spend without you approving each action separately?Walmart lets customers set a cap like $50, $100 or $200 per agent profile. Without a cap like that, one mistake has no floor.
- Does every purchase need your approval by default, or does it act alone?Walmart made approval the default for every purchase, even with a cap in place. That's the step that stops a mistake before it happens, not after.
- If it gets something wrong, can you undo it, a return, a refund, without a fight?Walmart promised return coverage even when a compliant agent makes the mistake. Without that promise, the agent's mistake stays on your account.
Walmart isn't doing this out of generosity. Its own shopping agent, Sparky, already drives order values 40% higher than non-agentic shoppers, according to what the company said earlier this month. Once Sparky itself proves the money is real, it's easier to see why Walmart opened the door to outside agents too, on clear terms.
Meta showed how big this already is. On its third quarter earnings call, the company said more than a quarter of Muse's weekly active users shop through the agent, with an average purchase above $200. Zuckerberg said Plaid, the fintech that connects payment apps to bank accounts, told him it hadn't seen activity like its connector is seeing on any other service. Stripe had to raise its credit limit in the first week because volume exceeded what it expected.
Wait, before you connect a real card. JPMorgan and Bank of America saying no doesn't mean every agent is dangerous, it means they haven't finished building their own guardrails. If your agent passes the four questions above, that isn't the same risk at all. Don't use one bank's caution as a reason to skip checking for yourself.
That phrasing matters, because it asks for a short policy people can actually read and enforce, not a long document that sits in a folder.
Next ten minutes: pick one AI agent you already use, or plan to connect to money soon, and run it through the four questions above before it touches a card.