Can External AI Agents Shop From Ecommerce Stores?

Foundation · 7 min

What you will learn

Why discovery and purchase are two separate decisions
The four ways external agents find products, and what you control in each
What has to be true before you let an agent transact
Why your policies travel with your products, and what that costs when they are wrong

Discovery and purchase are different decisions

Discovery is already happening. Agents read public product pages the same way any visitor does. You do not opt into this, and the practical question is whether what they find is accurate, not whether they find it.

Purchase is a door you open. An agent that can describe your product has no standing to buy from you. Transacting requires an interface you have exposed, credentials you have issued, and limits you have set. Treat anything arriving without those as an unauthenticated request, whatever it claims about itself.

Visibility, data supply, and purchase authority are three separate calls. A store can reasonably want to be found, decline to maintain a feed, and refuse agent checkout entirely. These are not stages of one decision, and they do not have to move together.

How external agents actually find products

Four routes, with very different control levers. Knowing which one a shopper reached you through tells you what you can actually change.

Your public pages. An agent reads the product page the way any visitor would, and takes whatever is written there as fact. You control this by writing complete, accurate pages. You do not control when it reads them or what it takes away.

Structured data on those pages. Markup that states price, availability, identifiers and variants in a standard format, so the page does not have to be interpreted from its layout. It does not make a wrong specification right. It makes a correct one unambiguous.

A feed you supply to a platform. You send a governed catalog file on a schedule. This is the route where you have the most control and the most responsibility, because a stale feed misrepresents your store with your own data.

An interface you expose deliberately. A documented, authenticated path that lets an approved agent check facts or place an order. This is the only route that involves granting authority, and it is the only one you can revoke.

The first two happen without your involvement, so the only lever is accuracy. The second two are things you choose, maintain, and can withdraw. Most stores should get the first two right before considering the others.

Your product data is now an interface

When a person reads a thin product page, they can tell if something is missing. An agent reporting the same page to a shopper fills the gap or states the wrong thing confidently, and the shopper never sees your page at all.

So titles, identifiers, variants, price, availability, images, seller details and fulfillment information need to be current and unambiguous, and the public page must agree with anything you supply by feed. Two versions of your catalog that disagree is worse than one version that is merely incomplete.

Transaction access is granted, never inferred

Do not assume an agent may call private interfaces, reuse a human session, or bypass checkout controls. If you support an external commerce path, constrain which endpoints it reaches, how it authenticates, what scopes it holds, and which actions it may take. Keep final validation on your side and keep the ability to reject an order that does not check out.

The standards here are moving. Keep protocol specifics in build documentation that can be updated quickly, and keep this decision stable: separate the data, the authority, the validation and the accountability, whatever the protocol of the month turns out to be.

Policies travel with your products

Shipping, returns, cancellations, warranties, restrictions and who the seller actually is all need clear, current, accessible versions. An agent asked about returns will answer from whatever it can find, including an outdated copy on a page nobody has looked at in two years.

When it answers wrongly, the customer brings the problem to you. Keep one canonical source for each policy and remove the contradictory copies, because you cannot correct the conversation, only the inputs to it.

What to do, by what you want

What you want	What to do	What it costs you
To be found and described accurately	Fix product facts and make them machine-readable	Work you needed to do anyway
To appear inside a specific platform	Supply a governed feed and keep it refreshed	An ongoing feed to own and monitor
To accept orders placed through an agent	Use a documented path with bounded, authenticated actions	Real engineering and new failure modes
An unknown agent asking for privileged access	Refuse. Authority is granted, never assumed	Nothing. This is the easy one

The first row is where almost every store should start, and it is the row that pays for itself whether or not agentic shopping grows.

Key takeaways

Discovery happens without your permission. Purchase should never happen without it.
Four discovery routes, two of which you cannot opt out of and two you must maintain.
Treat product data as an interface. A disagreement between your feed and your page is worse than a gap.
Expose only documented, authenticated actions, and keep validation on your side.
An agent misstating your policy is still your problem, so keep one current source for each.