Delegating to machines - AgenticAI fine print

As AI agents start acting on behalf of users, familiar legal assumptions about consent, authorization, and accountability get blurry. A machine can click, buy, browse, and return items, but the law still has to decide whether those actions count as the user’s actions. We are moving from systems that generate outputs on demand to systems that pursue goals, take actions, and make decisions with minimal human intervention.

A user’s AI agent orders a T-shirt, the retailer fulfills the order, the shirt arrives, and then the user initiates a return. Now the retailer’s AI agent processes this return. There are now two automated actors in the transaction, each making decisions that used to be performed by humans. That makes the ordinary e-commerce flow look very different from a legal perspective. Convenience is easy; responsibility is harder.

Can an AI agent accept terms and conditions, agree to cookies, consent to texts and pixels, or authorize processing of sensitive data. “Yes, the agent clicked” is not the same as “Yes, the user knowingly consented”. That distinction matters because many privacy and consumer protection regimes depend on informed, intentional choice. A legal system may need to treat agent actions as delegated acts only in some contexts, not all contexts.

Concrete controls for platforms:

• define non-delegable tasks,

• create separate AI-agent terms,

• require identity signals through user-agent strings, use robots.txt,

• set rules for ad metrics, and

• reserve the right to block agents.

A practical strategy is needed for companies that want to manage AI traffic without pretending it does not exist. The main point is that platforms will increasingly need policy language specifically for machine actors, not just for human users.

The Amazon v. Perplexity dispute gives the abstract issues real shape. Amazon alleged that Perplexity’s Comet browser engaged in persistent, covert, unauthorized access to logged-in areas of Amazon’s site and evaded technical barriers after Amazon objected.

On March 9, 2026, the district court granted Amazon preliminary injunctive relief and found Amazon likely to prevail under the CFAA and CDAFA. The order enjoined Perplexity from using AI agents to access Amazon’s protected systems and required deletion of Amazon customer data collected from password-protected areas.

Perplexity’s defense was equally revealing. It argued that Comet ran locally on users’ devices, that consumers should be free to choose their shopping experience, and that Amazon was really reacting to the fact that AI agents do not notice advertising the way humans do. It also pointed out that Amazon itself offers “Buy for Me,” which uses agentic AI to purchase from third-party websites.

The practical takeaway for platforms is blunt: identification alone may not be enough. If a platform wants to block agents, it should add AI-agent terms, require identification signals, use robots.txt and CAPTCHA where appropriate, and reserve the right to block agents outright.

A strong operating principle emerges from this guidance: design for evidence. If a dispute later arises, you want logs, decision records, and UX flows that show who authorized what, when, and under what conditions. The companies that build human confirmation gates, define authority cleanly, and document their choices now will help shape the doctrine that later applies to everyone else.