Day 10/100: The Tollbooth of the Internet Is Slowly Taking Shape for Agents

Agents can now be charged at the door. Who sets the price, and who sets the policy on what agents can do: allowed, or not?

Written by

Karan Balaji

Day 10/100: The Tollbooth of the Internet Is Slowly Taking Shape for Agents

Imagine Karan sends his personal agent out to buy a birthday gift. The agent knocks on three doors. Amazon says no. Walmart says yes, but with a spending cap and a human approving each purchase. Yelp says sure, but only if the agent pays for access first.

Same agent, same shopper, same afternoon. Three completely different answers. That is the story of the last five weeks on the web. Day 8 of this series was about making your site readable by agents. Day 10 is about what happened next: agents now need permission, identity, and a price tag, and the rules are being written right now. The news is only half of it. The other half is what Karan thinks it means.

The flip: blocked by default

For most of the web's history, the default was simple. A bot could visit unless a site actively stopped it. In September, that default flipped for a large part of the web.

On September 15, Cloudflare began offering new sites a choice of presets, per Cloudflare's own September post on accountable crawlers. For ad-supported sites, the preset is: search crawlers allowed, training set to "Disallow AI Training," which is a preference rather than a hard block, and agent crawlers blocked on pages that show ads. Existing customers were migrated to the same pattern. The logic is easy to follow: an ad on a page is a signal that a person was meant to land there. If an agent reads the page and answers the user without ever visiting, the publisher earns nothing and the advertiser reaches nobody.

Around the same time, the biggest platforms started making individual decisions, door by door. Amazon blocked Meta's Muse agent from browsing and buying on Amazon in the week of September 20. TechCrunch's October 6 investigation reported that the agent did not identify itself, appeared to capture and store customer credentials, and that Meta had not notified Amazon. Yelp went further than a block, TechCrunch reported: only agents that pay through its data licensing program are permitted, and the rest fail at quotes, waitlists, and table bookings. That is not a wall. That is a toll booth.

The banks were blunter, according to PYMNTS reporting from that week. JPMorgan's Jamie Dimon warned about "rogue agents" operating inside customer accounts on the bank's mid-October earnings call. Charles Schwab said it was actively blocking unauthorised agents from moving client money, stopping the largest ones in the tens and twenties each week, and asked the question that matters most: who is liable when an agent moves money badly? Delta said it has no partnership that lets a third-party agent shop or book its flights. United, notably, did not confirm an agent-specific block at all, pointing instead to its general terms against automated access. Not every closed door is a deliberate agent policy. Some are old anti-bot systems tripping over new technology, and users often cannot tell the difference.

Why the big companies say no

Karan's take: the resistance is straightforward, and it is about the business model, not the technology. Every company right now is trying to figure out some way an agent can act on its side, whether that is a toll or an open way for agents to navigate and execute things. But the web they are protecting was built around a human navigating and doing things, and that is how the money worked. Advertisers paid for the homepage. Ads were placed along the journey. If an agent skips straight to buying, bypassing the homepage and all the placed ads, all of that value is missed and scraped out.

That is why the big companies say no while they figure it out. And it is why, in the end, consumers are the ones getting locked out of what should be easy access. Karan's take on the future: within a year, every big company will have either a toll or an open way of allowing agents to shop or navigate on their behalf. The only question is which one each company picks.

The opposite move: one neutral home for the plumbing

In the same week the doors were closing, the plumbing got a neutral home. On October 22, Anthropic donated its Agent Skills standard to the Linux Foundation's Agentic AI Foundation, handing over the name, the logo, the GitHub organisation, and the agentskills.io domain. The same day, the foundation announced three more additions: OpenAI's Open Responses, Hugging Face's OpenEnv, and Alibaba's OpenSandbox, growing from three launch projects to ten.

A skill, in this world, is a folder with a SKILL.md file that teaches an agent how to do a task or work in a domain, plus scripts and reference material. Anthropic says more than 70 agent platforms have integrated skills, with a million skills published and nearly 280 million installed. Those are the company's own numbers, not independently verified, but the direction is what matters: rivals are donating competing pieces to the same neutral home.

For readers who do not follow protocol politics, here is the plain version. MCP is how an agent connects to tools and data. Agent Skills are what the agent knows how to do. AGENTS.md is the instructions a project gives to any agent that walks in. A2A is how agents talk to each other. Open Responses is the new layer: one API shape for language models across providers. This is the second time Anthropic has handed a standard to this foundation. It donated MCP there first. Interoperability is becoming infrastructure, not a competitive moat, at exactly the moment access is becoming a negotiated deal.

The trust fix in the middle

Between the open plumbing and the closed doors sits the hardest problem: how does an agent prove it is acting for you, and how do you stop it from running off with your passwords?

On October 22, 1Password launched 1Password for Agents. The model is simple. An agent reaches a sign-in form and proves its identity to 1Password with a unique digital key. The person sees which credential the agent wants and why, approves on their own device, and 1Password fills the form directly instead of handing the password or one-time code to the agent. The agent continues its task. The password stays in the vault. Launch partners include Meta's Muse, Anthropic's Claude, OpenAI's ChatGPT Work and dots, Grok Bot, and Townie.

It is a real improvement, and it has an honest limit. After sign-in, the agent can still see and do things inside that account. Approval gets the agent through the door. It does not supervise what the agent does in the room.

The payments world is building the same idea for money. Visa's Intelligent Commerce Connect, launched in April 2026, lets agents pay through a single integration with tokenisation and spend controls. Mastercard's Agent Pay binds identity, instructions, and outcome into a verifiable record for disputes. Google's Universal Cart, launched in the United States on October 15, lets shoppers build one cart across retailers and check out with Google Pay or transfer to the merchant's own cart, with the merchant remaining the seller of record. The pattern is identical everywhere: a scoped token, a spending limit, and a human confirmation, instead of handing over the keys.

The toll booth, now for sale

Until recently, charging agents was something only a Yelp could do. Cloudflare's Monetization Gateway changes that. Karan's POV: this points at the future, where traffic itself gets monetized. The idea is simple. If agents come to your site in volume, to read your blog or for any other purpose, they pay a very small fee per visit, and that becomes revenue for the site owner. For people who write content, turning it on means making a small buck for every agent that visits.

The honest version matters here. The Gateway is real but in closed beta, invite-only, limited to US-based sellers and buyers who apply, with no general-availability date in Cloudflare's own posts. Sellers set their own price, from $0.001 to $100 per request, and the agent pays directly in USDC on Base through the x402 protocol after receiving a 402 payment-required response. Cloudflare publishes no fee it takes and no publisher payout figures yet, so nobody can honestly say site owners are already earning meaningful money from it. And "every agent pays" overstates it: only traffic to Cloudflare-proxied zones with matching rules, from buyers willing and able to pay this way, actually pays.

Karan's take: the invite-only part is the signal, and the audience should know about it. A tollbooth internet is not a distant idea anymore. It exists, it just has a guest list for now. That is what makes this moment worth paying attention to: the future where parts of the web charge agents at the door is already being built, behind an invite wall. When the guest list opens, the question for every site owner will be the same one Yelp already answered: what do you charge, and who do you let through free?

So is it "identify, license, price"?

That is the emerging model, not the settled rule, and the distinction matters. The evidence for it is strong: Yelp charges, Cloudflare charges, and access is increasingly a commercial negotiation, as Meta's retail partnerships with Walmart, Best Buy, Gap, Sephora, and others show. The evidence against it is just as real. A federal appeals court vacated Amazon's injunction against Perplexity's Comet browser in August 2026, as reported at the time, holding that the customer, not the tool, "accessed" Amazon, which means a platform's terms are not yet the final word. Much blocking is accidental anti-bot collateral. And Shopify and Walmart chose the opposite path, opening governed checkout rails with per-purchase approval and spending caps rather than walls.

There is one more honest gap. AI-referred traffic to retail is surging from a small base. Adobe reports AI-referred traffic to US retail sites up 393 percent year over year in the first quarter of 2026, while AI sessions remain under 0.2 percent of all e-commerce sessions. Salesforce puts about 20 percent of global online holiday sales as AI-influenced, which is not the same as agent-completed. Nobody has published a credible figure for what share of checkout agents actually complete today. Referral is surging. Completed agent checkout is still undisclosed. Any article that gives you a precise number for it is inventing one.

What Karan already does on his own site

Karan's own site already runs the playbook this article describes. On karanbalaji.com, Cloudflare rules block bots that come only to train, while allowing bots that genuinely come to source or reference the content. The site is agent-optimized, with rules on what agents can do there, rather than a single open or closed door.

Karan's POV: that is where the whole industry is headed. Companies will start setting policies for what agents can do on their own sites, and people will start creating policy frameworks for agent behavior on different business sites. Every big site will have agent rules, stating what agents can do and what they cannot. The per-site agent policy is about to become as normal as a privacy policy.

Karan's take: this is where agent policies get interesting. A business could allow agents to shop on a human's behalf, but write into its policy that the agent must also bring back two or three more recommended products, and those are the ad products. That balances both sides: the agent still completes the purchase, and the business still gets its ad revenue. That is likely why big companies are reluctant right now. They have not written these rules yet. But slowly, Karan expects to see exactly this kind of model: you can come to my site, but in return you take two or three ad-targeted recommendations back with you. A new revenue model, built for agents instead of against them.

What to do Monday

Karan's take for anyone running a site or a small business starts with two words: it depends.

If you run an e-commerce store, allow agents. Discoverability is sales, and an agent finding your product is a win. If you publish a blog, block the bots that come only to scrape and train, but allow the ones that come for information and give you credit as the source. Decide who to block and who to allow, bot by bot, instead of choosing one blanket rule. If you write content, consider turning on monetization so agent traffic pays you a small amount per visit. Never hand an agent your own passwords. Use an approval-based tool or an API rail instead. And keep checkout on your own storefront where you can, with a human approval step before money moves, mirroring what the banks and the governed rails already require.

Day 8 said to build for agents. Day 10 says something less comfortable: the agents are coming either way, and the question is no longer whether your site works for them. It is who gets to say yes, what they charge, and whether you made your choice before someone else made it for you.