On 21 October Walmart opened walmart.com and Sam's Club to outside AI shopping agents. The announcement was about Agent Profiles and a new Agent Gateway. The document underneath it matters as much: the Walmart Agentic Access Terms, a contract that every AI agent, the customer who sends it, and the company that builds it accept when the agent shops on a Walmart site.
It is one of the first complete sets of agent terms from a major retailer, and it reads like a specification. It defines what an agent is, how it must identify itself, when a person has to approve a purchase, and what changes when an agent comes in through Walmart's own gateway. This post goes through it section by section and shows where it lines up with the two open protocols for agent commerce, the Universal Commerce Protocol (UCP) and the Personal Agent Protocol (PAP). It is a reading of a published document, not legal advice.
What are Walmart's Agentic Access Terms?
Walmart's Agentic Access Terms are the rules for any AI agent that accesses walmart.com or the Walmart apps on a customer's behalf. They are dated "October 21, 2026 Version" and sit in Walmart's help centre beside the Walmart.com Terms of Use. They have 14 sections that apply everywhere, plus Addendum 1, which applies only when an agent shops through the Walmart Agent Gateway.
The groundwork came a month earlier. The Walmart.com Terms of Use, last updated 21 September 2026, already have a Section 16.L, "Authorized Agents", which says agents "are subject to Walmart's Agentic Access Terms" and that purchases an agent makes within the permissions you gave it are treated as yours.
Two ways in: the website and the Agent Gateway
The terms describe two tiers.
| Any agent on the Walmart Sites | An agent in the Walmart Agent Gateway | |
|---|---|---|
| Covered by | Sections 1–14 | Sections 1–14 plus Addendum 1 |
| How it connects | The website or apps, as a person would | "An MCP or similar connection protocol", agent to agent with Walmart's assistant, Sparky |
| Checkout | A Human Consent Gate before every checkout | Autonomous checkout allowed inside limits the customer sets with Walmart |
| Identity | Identifies itself on request | Registers and receives an Agent Credential |
| Access | Open, under the terms | Early beta, "by invitation only" |
The second tier is the one the Agent Gateway page describes: "verified identities, controlled permissions & observable actions", with "category restrictions, rate limits & compliance guardrails".
Who the terms bind
Three parties, each defined in Section 2:
- Agent: "any software-based system, application, or service that autonomously or semi-autonomously accesses or interacts with the Walmart Sites" for a customer, including "AI assistants, browser-automation tools, and API-connected services". Assistive technology for people with disabilities is excluded.
- Authorizing Customer: the person who holds the Walmart account and sends the agent.
- Deployer: the company that offers, builds, configures, operates or monitors the agent.
The Deployer is the new part. It is bound in its own right when it deploys an agent commercially, knows (or should know) the terms, and benefits from the agent's access or handles what the agent collects. Section 9 lets Walmart hold it directly responsible for scraping, transactions beyond the customer's consent, inaccurate information, or ignoring a consent gate.
Rule 1: the agent must identify itself
Section 3 is an identification requirement. When the Walmart Sites ask, an agent must say it is an agent and send:
- the Deployer's registered legal name, address and website domain
- the agent's product name and version
- a contact for operational and abuse questions
- whatever is needed to connect the agent to the customer's Walmart account
It must not mask or forge its origin, defeat checks that tell people from software, or copy "the timing or rhythm of human actions". If asked directly whether it is a person, it must answer honestly.
Rule 2: consent, and the Human Consent Gate
Section 4 requires "explicit, informed, affirmative consent" from the customer before the agent acts. The agent has to tell the customer that they are authorising a named agent to transact with Walmart, that they stay responsible for payment, returns and disputes, and how to revoke it.
A Human Consent Gate is "a required point at which a human must personally review and take an affirmative action". Outside the gateway, Walmart requires one before every checkout, and agents "may not check out autonomously" unless they meet Addendum 1. Walmart can add gates, such as signing in, setting up Walmart Wallet or extra identity checks, and "No Agent instruction or Deployer configuration can waive a Human Consent Gate."
Rule 3: show Walmart's data as it is
Section 5 is about what the customer sees. An agent must not route or substitute products against the customer's stated preferences, must label substitutes and recommendations, and must honour limits like brand, price ceiling and category. When it shows Walmart's data, it must not misstate price, fees or discounts, misrepresent availability or delivery, call a substitute Walmart-endorsed when it isn't, or leave out a material term.
Rule 4: limits on Walmart's data
Section 6 gives the agent a limited licence to use Walmart's product, price and availability data to complete the shopping the customer asked for, and nothing else. An agent or Deployer must not bulk-scrape, keep the data longer than needed, or use it to train models, generate content, target ads, create synthetic data, or build "commercial analytics, reporting, or data-licensing products".
Enforcement: rate limits, blocking and audits
Section 7 requires agents to follow Walmart's published rate limits and technical guidelines. Section 8 lets Walmart throttle, suspend or permanently block an agent at its discretion. Section 10 keeps customers' statutory rights to returns, refunds and disputes intact, and Addendum 1 adds the right to audit an agent and its Deployer.
Inside the Agent Gateway: guardrails, mandates and scoped tokens
Addendum 1 is where autonomous checkout becomes possible. It adds four defined pieces:
- User-Defined Guardrail: standing instructions the customer sets with Walmart, such as a per-transaction spend limit, category or department restrictions, and how often the agent can buy.
- Agent Credential: "the verifiable cryptographic credential associated with a registered Agent".
- Agent Mandate: "a cryptographically signed record" of the customer's instructions, with both identities, the consent and a timestamp.
- Scoped Access Token: "a short-lived cryptographic credential bound to a specific merchant, cart, amount, and session". The agent needs one per session and a new one for each transaction, and it is used up at checkout.
The agent sends Walmart its mandate. If the request is within the guardrail, Walmart may let the agent check out without a separate gate. If it is unclear, Walmart "may (but is not required to) propose changes". If it goes beyond the guardrail, Walmart can ask for a gate for that one transaction "rather than rejecting the Agent outright". Only the customer chooses the payment method, the agent never sees card data, and the agent sends signed mandates and consent records that become part of Walmart's transaction record.
How the terms line up with UCP and PAP
Walmart has a hand in both protocols. Google says it developed UCP "in collaboration with industry leaders including Shopify, Etsy, Wayfair, Target, and Walmart", and Walmart's own announcement in January brought its checkout into Gemini "using the Universal Commerce Protocol". In October, Sierra named Walmart as one of the industry partners it is developing PAP with.
Neither the terms nor the gateway announcement mention either protocol. Walmart describes the gateway as "an MCP or similar connection protocol". The same ideas run through all three, though, and the two tiers map onto the protocols closely:
| Walmart's terms | UCP | PAP (draft 0.2) |
|---|---|---|
| The agent identifies itself | Platform profile sent in UCP-Agent, with signing keys |
client_id metadata document with keys (§4.1) |
| Registration, allowlists, blocking | Both allowed; signatures also allow "permissionless onboarding" | Companies "MAY require Personal Agents to register" and keep allowlists or blocklists (§4.1) |
| Human Consent Gate | requires_buyer_review, handed to the buyer via continue_url |
Sign-in at the company (§4.5); approval on the agent's own screen (operations extension §5.1) |
| Agent Mandate | AP2 Mandates extension: signed proof the user authorised this checkout | Operations extension: the user approves exact terms, then the agent confirms |
| Scoped Access Token | Payment credentials bound to the checkout | Short-lived Session Token, bound to a key the agent holds (§4.3) |
| No card data for agents | Payment handlers and tokens | Out of scope (payments is an open topic) |
| A separate Agent Profile per agent | Identity linking (OAuth) to the buyer's account | One session per user, company and agent; sign-in gives an Account Token for that agent |
| Walmart proposes changes | — | A company proposes an operation; the user approves |
Roughly, the website tier looks like UCP: a known agent, a checkout, and a buyer approval step before the order is placed. The gateway tier looks like PAP: an agent talking to the company's own agent, signed in to the customer's account, with the company proposing and the customer's limits deciding.
The store decides who gets in
The protocols and the terms agree on one point: admission is the business's decision. UCP says a valid profile "guarantees provenance, not trust", and that whether to trust it "is always the client's decision". PAP lets a company require registration, keep allowlists and revoke an agent. Walmart's terms are that decision written down: open to any agent under the rules, with more freedom for registered agents that come through the gateway.
That is the useful way to read a week in which some retailers block agents and others invite them in. Each is a business setting its own admission policy. What the protocols standardise is the door and the identity check, so an agent can prove who it is and what the customer approved the same way at every store, while each store keeps its own guest list.
What the protocols don't carry yet
Reading the terms against the specs shows a few things a retailer asks for that neither protocol has a standard field for today:
- Who stands behind the agent. Walmart asks for the Deployer's legal name, address and an abuse contact. UCP's platform profile and PAP's agent metadata identify an agent by domain and keys, not by legal entity. UCP's Business Identity RFC proposes this kind of information for businesses, not agents.
- Spending and category limits. Walmart's User-Defined Guardrail has per-transaction spend, category and frequency limits. PAP has read and write scopes, and a task-grants proposal is open, but neither spec has a spending limit.
- A machine-readable pointer to the terms. The terms are a web page. Neither a UCP profile nor
poppy.jsonhas a standard place to say "agents accessing this site accept these terms".
None of this is a criticism of the terms. It is a list of what a large retailer needed, which is useful input for both protocols.
What it means for stores
- You can set your own rules. Walmart's terms show a store can admit agents on its own conditions: identification, consent gates, data limits, and an invitation-only tier with more freedom.
- The protocols already carry much of it. If you publish a UCP profile, you already declare how agents check out, how payment works without card data, and when the buyer has to approve.
- Write down what agents may do with your data. Section 6 is a clear model for a licence that covers shopping and nothing more.
What it means for agent builders
- The company is a party. Under these terms the company that builds and runs the agent can be held responsible, not just the customer.
- Identify by default. An agent that already sends signed identity, through a UCP profile or a PAP
client_id, has a head start on Section 3. - Keep the consent record. Walmart wants consent events and signed mandates. An agent that records what the customer approved, and when, is ready for that.
What comes next
- New versions of the terms. The document is dated "October 21, 2026 Version", so changes will come as new dated versions.
- Agent Profiles, which Walmart says launch in the next month.
- A UCP profile or
poppy.jsonon walmart.com. Either would show up in UCP Checker or PAP Checker. - Agent terms from other retailers, and whether they follow the same shape: identification, consent gates, data limits.
- The protocols themselves. Whether UCP or PAP adds a field for who stands behind an agent, spending limits, or a pointer to a store's agent terms. Both are developed in public on GitHub.
FAQ
What are the Walmart Agentic Access Terms? The contract that governs AI agents shopping on walmart.com and the Walmart apps. It binds the agent, the customer who authorises it, and the company that deploys it. The current version is dated 21 October 2026.
Can AI agents check out on Walmart by themselves? Only through the Walmart Agent Gateway, and only within limits the customer sets with Walmart. Outside the gateway, the terms require a person to approve every checkout.
What is a Human Consent Gate? A point where a person must personally review and take an action before the agent can go on, such as approving a checkout. Walmart can add gates, and no agent setting can waive one.
What does an agent have to tell Walmart about itself? On request: that it is an agent, the deploying company's legal name, address and domain, the agent's name and version, an operations and abuse contact, and what is needed to link the customer's account.
Can AI agents use Walmart's data to train models? No. Section 6 limits the data to the shopping the customer asked for, and rules out training, content generation, ad targeting, synthetic data and analytics or data-licensing products.
Does the Walmart Agent Gateway use UCP or PAP?
Walmart describes it as "an MCP or similar connection protocol", and neither the terms nor the announcement mention UCP or PAP. Walmart helped develop UCP with Google, and its January announcement with Google brought its checkout into Gemini "using the Universal Commerce Protocol". It is also one of the industry partners Sierra is developing PAP with. As of 23 October, walmart.com does not publish a UCP profile at /.well-known/ucp.
Who is responsible if an agent makes a mistake? The Terms of Use treat an authorised agent's purchases, within the permissions given, as the customer's own. The Agentic Access Terms let Walmart also hold the Deployer responsible for breaches, and Walmart says its returns process applies when an agent doesn't act as intended.
About UCP Checker
UCP Checker is the independent validation and observability layer for the Universal Commerce Protocol. We crawl, validate and grade every public UCP manifest we can find, run the merchant directory, the UCP Score, live adoption stats, the vertical guides and the authority-bound vendor map, and track the spec as it evolves so you don't have to — measured from two vantages (what a business declares, and what actually happens when an agent transacts), the same way for everyone, without picking winners.
Sources
- Walmart Agentic Access Terms, Walmart, October 21, 2026 Version
- Walmart.com Terms of Use, Section 16.L Authorized Agents, Walmart, last updated 21 September 2026
- Walmart Makes It Possible for Agents to Shop on Behalf of Customers, While Keeping Customers in Control, Walmart, 21 October 2026
- Walmart Agent Gateway, Walmart, beta page
- Walmart and Google Turn AI Discovery Into Effortless Shopping Experiences, Walmart, 11 January 2026
- UCP specification: Identity & Authentication and Checkout, ucp.dev
- Personal Agent Protocol, draft 0.2, GitHub
- Google: Under the hood: Universal Commerce Protocol (UCP), Google, January 2026
- Sierra: Introducing the Personal Agent Protocol, Sierra, 6 October 2026
- TechCrunch: While Amazon blocks AI agents, Walmart rolls out the welcome mat, 21 October 2026
Related coverage: Personal Agent Protocol and UCP · How UCP's agent profile proves who the agent is · UCP's business directory and identity RFCs · How a real agent buys flowers over UCP