The Handoff Nobody Negotiated

I wrote earlier this week about the front-door war: Amazon blocking Meta's Muse, the Perplexity precedent, and the fight over who owns the agent that stands between you and your money. This piece is about the other half of the story. Not the war over the door, but the transaction behind it: what you actually hand over when an agent starts acting for you, and why nobody can tell you what it did once it had it.

Two companies, one door

In less than two weeks, Meta's Muse unseated ChatGPT as the top free app on Apple's App Store. The pitch is seductive in its simplicity: stop clicking around apps yourself. Give the agent your accounts and let it do the booking, the buying, and the scheduling.

Then Amazon blocked it.

The stated reason is that an unauthorized AI agent violates Amazon's Conditions of Use. That explanation is technically true and emotionally empty. When an agent shops for you, the recommendations, the ads, and the impulse buys stop belonging to Amazon. The block is not a security decision. It is a revenue defense wearing a security costume.

Here is what should bother you: nobody asked you which side to take. Two of the largest companies on earth are fighting over who gets to stand in front of your money, and the user is the terrain, not the party.

Everyone here is guarding their own revenue

Amazon has already litigated this fight and lost. It sued Perplexity over the Comet browser agent, and the Ninth Circuit found that users choosing to access Amazon through the tool is not trespass. If a human decides to open a store through a piece of software, the store does not get to call that breaking and entering.

Meanwhile, Amazon's own shopping agent, Buy for Me, enrolls brands automatically and makes them opt out. Access for me, trespass for thee. The principle on display is not a principle at all. It is a perimeter drawn wherever the money is.

And the agent makers are not exactly disinterested parties either. Instinct, a rival built by a founder with a reputation for shipping fast, climbed to a multi-billion dollar valuation on the same promise: give us your email, your calendar, your accounts, everything. The venture math is simple. Whoever holds the agent holds the relationship with the user, and everyone else pays rent.

So be skeptical in both directions. The gatekeepers are not protecting you. The keyholders are not serving you. Both are racing to own the same door.

What you actually hand over

Let us be concrete about the trade, because it is not abstract.

To act for you, an agent needs standing access. Email. Calendar. Shopping accounts. Banking. I have spent two decades in enterprise security, and a good part of that career was spent dismantling exactly this pattern, because standing access is how breaches compound. The industry standard became time-boxed, scoped, logged credentials with automatic expiry.

The consumer agent market just inverted that principle, branded it convenience, and shipped it as a feature.

Meta says purchases run through one-time card numbers. That is a genuine control, and it deserves credit. But the payment leg is one leg. The agent still reads the inbox that contains every password reset, every bank alert, every medical appointment. A one-time card number does not stop the operator that can read the message that resets the password.

And the unintended consequences write themselves. An agent that shops autonomously is a target for prompt injection: a poisoned product page that tells your agent to buy the wrong thing, or worse. An agent that reads your inbox is a single point of failure for identity theft at a scale no human burglar could achieve. Convenience that concentrates access also concentrates blast radius.

The good is real. That is what makes it dangerous.

I am not in the business of pretending the technology is useless. It is not.

For a person with limited mobility, an agent that books appointments and manages inboxes is not a convenience. It is independence. For a small business owner drowning in administrative overhead, delegation to software is a genuine economic unlock. For anyone who has lost an afternoon to a cancellation policy buried in a settings menu, the idea of an agent that handles it is a relief, not a threat.

The problem is not that the utility is fake. The problem is that the utility is the payment. Every appointment the agent books is training data for a model that will outlive your subscription. Every purchase teaches a recommendation engine you did not choose to serve you. You are not just the customer of these systems. You are their raw material.

That is the unadvertised line item in the transaction: the convenience is free, and the access is the price.

The accountability vacuum

Here is the part nobody is building while everyone is racing.

There is no external audit of what these agents touch while they act on your behalf. No standard log you can pull to see what your agent did last Tuesday. No notification that tells you the scope you granted in September quietly expanded in November. No regulator with jurisdiction over an operator that reads your bank email in the morning and books your dentist in the afternoon.

Enterprise security solved the analog of this problem years ago, and the solution was not better intentions. It was privileged access management: time-limited credentials, scoped permissions, complete session logs, and someone accountable for reviewing them. None of that vocabulary has made it into the consumer pitch, because none of it helps the pitch.

The absence is not an oversight. Auditable access is buildable today. A company that wanted to prove its agent only touches what you approved could ship a session log in a release cycle. Choosing not to is a business decision about how much you are allowed to know.

A standard worth demanding

So demand it. Before you hand an agent the keys, ask three questions.

Can I see what it did? If the answer is no, you have not delegated a task. You have surrendered oversight.

Can I scope what it holds? If the agent cannot act with narrow, revocable, time-limited access, it is not an assistant. It is a roommate with your passwords.

Can I leave? If deleting the agent does not delete its access, you never owned the relationship to begin with.

The front-door war will produce winners, and the winners will tell you the fight was about protecting users. It was not. It was about who stands between you and your own money. The only question that matters is whether the agent at your front door answers to you, or merely to whoever paid for its keys.