An AI agent can hold a valid password, a session cookie, or an OAuth token. None of those prove that the organization on the other end agreed to let it in, or that anyone decided what it may do once inside. In September, that gap became a public standoff.
On September 21, Amazon blocked Meta's new Muse personal agent from shopping on Amazon.com. According to GeekWire, Amazon said Meta did not tell it Muse would access its store, that the agent does not identify itself when it browses, and that it appears to capture and store customer credentials. Meta has said Muse "has no visibility into people's passwords or payment methods." Amazon's statement put the principle plainly: third-party applications that buy on a customer's behalf "should operate openly and respect service provider decisions about whether or not to participate."
The contrast sharpened weeks later. On October 21, Axios reported that Walmart had taken the opposite path, opening an Agent Gateway that lets approved agents, Muse among them, search and check out, with per-agent profiles (arriving the following month) that carry spending caps, per-transaction approval, and revocation rights. Two of the country’s largest retailers now sit on opposite sides of the same question. Tellingly, the one opening its doors is doing it by giving each agent an identity, limits, and a way to be switched off. That is the enterprise answer, showing up in retail first.
This is a consumer story. The question at its center is the one every enterprise deploying AI agents now has to answer.
Access is not authority
Muse could reach Amazon accounts because users gave it a way in. Amazon's objection is that having a way in is not the same as being authorized: the business on the receiving end never agreed, could not see which requests came from an agent, and had no say in what the agent could do.
Swap the shopping site for your CRM, your code repositories, or your finance system, and the agent for one your employees connected last month. The pattern is the same:
- The agent holds a credential. Often a user's token, or a standing secret for the tool it calls.
- Nobody decided its limits. It can do whatever that credential allows.
- Nobody is on record for it. When something goes wrong, the team reconstructs who did what by hand.
Buyers are not ready to hand agents the keys either. Axios, covering the standoff, cited Coveo's 2026 Commerce Relevance Report: only 16% of shoppers are comfortable letting an AI assistant find and purchase products on their behalf. People will let AI help. Fewer will let it act without limits they understand.
What authority looks like for an agent
Inside the enterprise, the organization is both the customer and the service provider. That makes the answer an identity and access problem, and it breaks down into three questions:
- 1.Where are your agents? Every agent should have an identity and an owner of record.
- 2.What can they access? Each agent's reach should be visible and kept small, with short-lived, scoped access instead of standing secrets.
- 3.How do you control what they do? Policy should apply when the agent acts, not only when it signs in, with a person stepping in where the organization decides.
Notice that none of this depends on the agent behaving well. It depends on the organization deciding, in advance and in policy, what each agent may do.
How NewCore approaches it
NewCore is unified identity and access management for humans and AI agents. It gives each AI agent an identity, an owner and limits, and applies your policy on every call through its gateway, not just at login.
In practice:
- Agents never hold your tools' credentials. Because an agent reaches your tools only through the NewCore gateway, which brokers the credentials, it never holds your tools’ secrets itself. What it holds is short-lived, scoped access, and it can never do more than its owner can.
- Allow, ask or deny, tool by tool. Each tool in an agent’s profile is allowed outright, routed for human approval where policy requires it, or denied, and anything outside the profile is denied by default. Routine work runs; flagged actions wait for a person.
- One place to revoke. Revocation is in one step: cut the agent off in a single place, and it loses access on its next request.
- On the record. Nothing an agent does is off the books. It answers to policy on every action, and each escalation is logged against its owner.
The gateway governs the traffic routed through it. NewCore governs agents acting on someone's behalf.
Takeaway
The Amazon and Muse dispute will be settled between two companies. Inside your organization, nobody else will settle it for you. Before agents act on your systems, decide who owns each one, what it can reach, and what happens when it tries to do more. Put AI to work, and keep humans in charge.