Salesforce Put a Price on the Agent Gate — and Left the Liability in the Dark

Salesforce just shipped a toll booth and forgot to post the insurance policy. On August 31, the company announced that Winter '27 would productize its agent allowlist — an API Catalog that governs which autonomous agents are permitted to touch which commerce endpoints. General availability lands October 12. The pitch is clean: a control plane for the agentic web, cross-protocol (MCP, A2A), cross-cloud (AWS, Azure, Google). Administrators activate MCP servers. Merchants get a single pane of glass over every machine that wants to spend their money. Then read the survey numbers buried underneath it. Ninety-three percent of merchants say the AI provider should carry the liability when an agent causes damage. Only twenty-eight percent will open their full product catalog to agents at all. That gap — sixty-five points wide — is the real story. Not the catalog. The chasm the catalog is priced to sit on top of. Code doesn't lie, but narratives do, and the narrative here is "governance." The reality is a gate with no underwriter standing behind it. Worth understanding what Salesforce actually built, because the framing carries the sale. MCP — Model Context Protocol — arrived from Anthropic in late 2024 as a way for models to call tools through a standard interface. A2A — Agent2Agent — came from Google in 2025 to let agents negotiate with one another. Two protocols, two origin companies, one obvious vacuum: nobody owned the authorization layer sitting between them. Salesforce is claiming that layer and packaging it into CRM subscriptions. The API Catalog consolidates APIs and MCP servers from MuleSoft, Heroku, and Apex into a single admin surface. More than one hundred pre-built connectors ship alongside it. Agent skills and plug-ins register through the same pipe. On the commerce side, Agentic Commerce Search trains a dedicated small language model per merchant catalog, tuned to that merchant's shopper behavior. And note the packaging move itself: authorization becomes a priced SKU inside a subscription merchants already pay. That is a shift from selling seats to selling the gate — a business whose ceiling is set by agent transaction volume, not headcount. This is not a terminal-user product. It is an administrator product. Its interface quality will never move a consumer conversion metric. What it moves is whether an enterprise dares to wire an autonomous agent directly into order management, inventory, and payment rails. That is a trust decision, not a features decision — and trust is the new currency. You cannot ship it in a changelog. Here is the parallel worth holding onto. When I audited rollup designs, everyone insisted every chain needed a dedicated data availability layer. Most didn't. Ninety-nine percent of rollups never generated enough data to justify the overhead. The same skepticism applies here: most enterprises today do not generate enough agent traffic to need a dedicated governance control plane. Salesforce is selling infrastructure for a volume that does not exist yet. That is either vision or premature scaffolding, and the changelog will tell you which. Now the forensic part. I spent a week in 2017 auditing fifteen ICO whitepapers by opening repositories, checking commit histories, and comparing the promise to the artifact. Eight failed the check. The Winter '27 catalog passes some of the same tests and fails others. Start with GA certainty. Of the MCP-related features in the release, exactly two carry a clear general-availability date. The rest have vague timing, no GA or beta tag, and help pages that — at submission — were not even searchable. When documentation doesn't exist at announcement, the documentation team isn't ready. When the documentation team isn't ready, engineering is behind. Roadmap-as-product is the oldest trick in the book, and I have watched it empty retail wallets. Second, the write-back problem. Salesforce describes A2A-driven third-party agents reaching commerce data but never states whether those agents operate against live write-back or replicated data. That single sentence is the architectural hinge of the entire product. Replicated data means inventory and price drift — an agent sells a jacket that no longer exists. Live write-back means transactions, concurrency control, and rollback semantics Salesforce has not described. The silence is not modesty. It is an unresolved engineering question being sold as a solved one. Third, the unit economics. One small language model per merchant, trained on that merchant's catalog and shopper behavior, means inference cost scales linearly with merchant count. That inverts the SaaS law of declining marginal cost. It also explains why Agentic Commerce Search is bundled free for every Shopper Agent customer instead of priced. You do not give away a product with clean unit economics. You give away the one you cannot yet meter. Fourth, security risk scoring — the trust primitive that would let a merchant decide which agent is safe to admit — is marketed prominently but is not clearly GA. That is a security promise shipped ahead of the security capability. And the growth figures deserve the same scrutiny: a thirteen percent conversion lift and seventeen percent add-to-cart gain, both vendor-reported, neither independently tested. Early adopters start from high conversion baselines. Self-reported lift from a biased sample is a marketing artifact, not evidence. Fifth, the gate is programmable, and programmable gates scare off the people who have to configure them. I learned this watching Uniswap V4 hooks. Elegant. Composable. And the complexity spike drove away most developers who would have built on it. Salesforce's admin surface risks the same fate: powerful enough to govern, complicated enough that only the largest merchants staff the expertise to use it. Sixth, and quietly the largest: the compliance geometry. Cross-cloud orchestration across AWS, Azure, and Google means agent traffic crossing data-sovereignty borders. Agentic Commerce Search trains on shopper behavior, which is consumer personal data under GDPR and PIPL. Salesforce says nothing about the legal basis for that reuse. Merchant liability frameworks differ wildly between the EU's consumer-protection regime and looser emerging markets, yet the toll is priced uniformly. A single global fee cannot absorb differentiated regional liability cost. Alpha hidden in the noise. Everyone is reading the press release. Almost nobody is reading the footnotes. Here is where I part ways with the consensus read. The standard take is that Salesforce built a moat — the gate every agent must pass through. I don't buy it. Salesforce built a gate out of MCP, an open protocol. It is using openness to build a wall, and the same openness erodes the wall. I watched this movie with Cosmos. IBC is genuinely elegant engineering — light clients, no trusted intermediaries, a beautiful standard. And the application ecosystem stayed fragmented, ATOM captured almost nothing, because interoperability anyone can implement is interoperability everyone can fork. Salesforce's integration layer carries the same structural weakness. A competitor can reuse the same connectors. The switching cost lives in the merchant's governance configuration, not in the protocol. The real bet is not the catalog. It is the toll: authorization SKUs folded into the CRM subscription, plus a transaction toll on agent-driven traffic. Salesforce is first to put a price on agentic commerce, and that is the headline. But a toll booth that collects rent without underwriting the traffic is a fragile business. If the fee carries no liability counterpart, then the first merchant burned by a rogue agent destroys the pricing's legitimacy. Meanwhile Shopify bans AI crawlers. Amazon walls off Meta's agent. Two routes diverge: open governance versus closed fences. Salesforce bets merchants prefer the gate. Shopify and Amazon bet they prefer the fence. That fight decides whether the API Catalog becomes an industry standard or a footnote in someone else's roadmap. So watch one variable over the next twelve months. Not the connector count. Not the conversion lift Salesforce reports about itself. Watch who writes the reason code. When an agent buys the wrong thing, misprices an order, or leaks a customer record, someone must assign a standardized failure reason and redistribute the loss. Salesforce has left that frame undefined — no reason codes, no loss reallocation. Ninety-three percent of merchants are waiting on exactly that document. If Salesforce authors it, the moat deepens and the toll becomes defensible. If a regulator or a consortium writes it first, Salesforce degrades into a compliance executor, renting out someone else's rulebook. The gate is built. The open question is who holds the pen that decides who pays when it swings shut on the wrong person.