Walmart Wrote the Rules Before It Shipped the Code

The terms of service took effect on October 25. The Agent Profiles ship next month. The Agent Gateway — the actual interception layer — is in enterprise and developer beta with no general availability date. Three dates that do not line up, and the misalignment is the entire story. Walmart did not release a product. It published a rulebook for a product that does not exist yet. Front-run the narrative, not just the chain — and here the narrative is a legal document with a timestamp and no executable behind it. This matters to anyone trading the intersection of payments, identity, and settlement, because what Walmart is building is not retail software. It is a delegated-authorization system for non-human identities, and it is being assembled in public. Context first. 'Muse' is the retail channel that connects Walmart's catalog to external agents — OpenAI's ChatGPT, Google's Gemini, Meta's assistant. The Agent Gateway is the enforcement point: every agent request enters here. Agent Profiles are the identity layer: which agent, acting for which human, authorized to what degree. The competitive backdrop is a clean experiment. Amazon blocks agents outright. Walmart opens a controlled door. Same problem, two optimal solutions — a function of traffic structure, not values. Amazon's demand pool is deep enough that blocking costs little; Walmart is the challenger and needs the overflow. The core is the architecture, and it is less novel than the press release implies. Profiles plus Gateway is a combination of non-human-identity delegation and a policy enforcement point. Profiles answer who the agent represents. The Gateway answers where the request gets intercepted when policy is violated. This is isomorphic to OAuth2 delegated authorization, scoped tokens, and API-gateway rate limiting — mature patterns, integration-level engineering, not architectural invention. The block confirms what the eyes missed: there is no new cryptography here, only a disciplined assembly of existing primitives. Three engineering decisions carry all the signal. First, human confirmation is the default. Second, spending limits are configurable. Third, the price an agent sees must equal the price a human sees. Read those three together and the intent is unambiguous: Walmart is not building an autonomous checkout machine. If it were, the default would be approve-once-then-silent. Choosing the opposite default means the design goal is to admit agents while preserving the human in the loop. The four powers stay on Walmart's side of the wall. Checkout authority, pricing authority, payment authority, enforcement authority. Agents are demoted to traffic funnels. The control matrix — no access to card data, no modification of payment methods, default approval plus limits, price parity — is a complete enforcement policy. Remove any one clause and the gateway leaks. The security boundary is thinner than the marketing suggests, and it is worth naming precisely. The ban on card access is the correct call — it pulls the most sensitive credential out of the agent's reach and replaces the card number with a scoped, revocable token, which is exactly the tokenization logic payment networks have been slow to ship. But the real last line of defense is not the card ban; it is the spending limit. The card ban prevents data leakage. The limit prevents money loss. The coverage lists them side by side and hides the fact that the limit is what actually caps the damage when an Agent Profile is hijacked or a prompt injection walks an agent into an over-limit purchase. The Gateway is also a data-governance gate, and the coverage underplayed it. An agent pulling catalog, inventory, and price at machine frequency is effectively a public API onto Walmart's product database. One real function of the Gateway is metering and rate limiting — capping how much competitors and agent vendors scrape. And the decision to build proprietary rather than adopt a standardized agent-payment or agent-checkout protocol means fragmentation: every integrator builds a separate connector for every retailer. Now the number nobody explains. Agent-driven direct checkout converts at roughly one-third the rate of agent-clicks-then-hands-off-to-human. The most valuable figure in the entire disclosure, delivered with no sample size, no category, no time window. I treat it as a directional signal, not a model input. But the direction is devastating to the autonomous-agent thesis: the more automated the path, the worse it converts. And the terms are built to match that reality. Default approval and spending limits would sabotage conversion if Walmart believed automation converted. It doesn't. It wants agents to walk the customer to the door, not swipe the card. Here is the contrarian read, and it is where the retail crowd is mispricing this. Everyone is reading 'Walmart opens to AI' as bullish for e-commerce volume. Read the fee schedule instead. There isn't one. Zero commission, zero placement fee, zero affiliate cut. For now, agents are free customer acquisition. But the largest risk is buried inside that free. If recommendation slots cost nothing, the agent vendors have no economic incentive to rank Walmart first. Retail media budgets — the high-margin engine — migrate from on-site shelf placements into the agent's answer. That is a structural threat to advertising revenue, not an order-volume boost. Price parity is likewise defensive, not protective: it simultaneously blocks cross-platform arbitrage, hides differential pricing from outside detection, and forecloses the 'agent-exclusive price' regulatory question. The clause exists because Walmart already priced the risk internally. There is a second layer the coverage missed. Amazon's outright block has antitrust exposure — a dominant platform using technical means to refuse third-party agents sits squarely in the refusal-to-deal and self-preferencing frame. Walmart's openness quietly hands regulators a control sample. And Google carries a structural contradiction: a Gemini shopping agent cannibalizes Google Shopping's own ad revenue, so its incentive to build a strong shopping agent is structurally weaker than OpenAI's or Meta's. Walmart signing all three is not neutrality — it is playing them against each other to compress channel cost. One operational fact deserves the forensic label. The rules are live; the enforcement layer is beta. Between October 25 and general availability there is a window where an agent's behavior can violate the terms and the gateway cannot yet identify it. Browser automation, vision agents, screen-clickers — none of them pass through the Gateway, and the terms have no technical teeth against them. Hash the truth, verify the story: a compliance statement decoupled from an execution layer is a press release, not a control. My own scars inform the read. In 2017 I refused to sign off on a token distribution contract until a batchMint overflow was patched — I do not trust promises, I verify code. In 2024, running an ETF arbitrage desk, I insisted on writing the core latency logic myself because institutional trust is built on infrastructure, not intent. Walmart is doing the smart version of the 2017 lesson in reverse: it verified the legal layer first and deferred the code. That protects the balance sheet and leaves the technical risk open. What to track, not what to feel. Whether Walmart discloses agent-channel order share; whether the Gateway ever converts to paid, and on what model; whether an open agentic-commerce protocol gets adopted by a major retailer — that single event determines whether proprietary gateways retain value or become integration debt; and whether Amazon reverses under regulatory pressure. The layer that actually matters is authorization and settlement — who becomes the intermediary between agents and merchants, issuing scoped, revocable, limit-bound credentials that replace the card number entirely. That is the tokenization story, and it is the one worth positioning for. Speed kills the hesitant; logic kills the greedy.