Hi everyone, thanks for coming back to Customer Futures. Each week I unpack the fundamental shifts around Personal Agents, digital customer relationships and Empowerment Tech.
If you’re reading this and haven’t yet signed up, why not join a growing number of global executives, entrepreneurs, designers, regulators and other digital leaders by clicking below.
To the regular subscribers, thank you.
(p.s. did your email cut this newsletter short? You can find the full post here)
Hi folks,
Welcome back to Customer Futures, and Part 3 of my five-part series looking under the hood of Meta’s new Personal AI Agent, Muse.
In Part 1, we explored why Meta has given Muse its own computer in the cloud, complete with a browser, memory, storage and connections to other services.
Then in Part 2, we looked at Meta’s important approach to permissions, including Sentinel, the independent security system controlling what Muse is allowed to do.
Today we’re going to explore what happens when Muse actually tries to interact with businesses on your behalf.
Because there’s a problem: businesses are starting to block it.
Amazon has already explicitly blocked Muse. Other companies like JPMorgan are also restricting automated agents from accessing their services. And the existing systems designed to keep bots out are now getting in the way of legitimate personal AI agents.
But there’s an even more interesting part of the story. Meta itself has been restricting competing AI assistants from operating through its WhatsApp Business APIs.
Interesting, eh?
We’re beginning to see a fundamental fight over who gets to control the digital customer relationship.
So today, we’re going to unpack:
How Muse is impersonating customers
Why businesses are blocking AI agents
How the proposed ‘Personal Agent Protocol’ offers an alternative
The contradiction with Meta and WhatsApp
Why AI agents are going to need their own identities
Let’s go.
1. Muse is impersonating you
Let’s start with a simple example. Imagine asking Muse to go through your household finances and find ways to save £200 a month.
It checks your energy bills, reviews your broadband contract, identifies subscriptions you’re no longer using and looks for better deals. Pretty useful.
Now imagine Muse discovers you’re paying £70 a month too much for broadband. So it finds a better deal and opens your broadband provider’s website to investigate switching.
But how does the broadband company know it’s really your agent? And more importantly, how does it know you’ve authorised Muse to change your contract?
Well, today it probably doesn’t. And this is where Meta’s technical paper becomes particularly interesting. As we explored in Part 1, Meta says that:
“Muse has a real up-to-date Chromium based browser running behind a virtualization layer.”
In other words, Muse has a proper browser. It can navigate websites, read pages, fill in forms and complete tasks, just like you would. And when it needs to log in, Meta has designed a clever system for managing your credentials:
“What you enter goes straight to secure storage and is not visible to your main agent”
Your credentials are inserted into the browser only when needed. So Muse can access your account without actually knowing your password.
Smart. But there’s a catch.
The business on the other side will simply see you logging in. It doesn’t necessarily know that an AI agent is operating the browser. It doesn’t know which agent is involved, or what permissions you’ve granted it. And it certainly can’t automatically verify the rules that Meta’s Sentinel is enforcing.
Remember from Part 2 that Sentinel independently approves what Muse is allowed to do. Meta has built a sophisticated system of permissions, including one-time, session-based, task-based and time-limited approvals.
But those permissions are internal to Muse. The broadband company doesn’t see them. It just sees an authenticated customer account.
And that’s the problem.
Muse is effectively impersonating you, even when you’ve legitimately authorised it to act.
Now, we already understand how to solve this in the physical world. If I want my accountant to deal with the government tax authority, I don’t give them my passport and ask them to pretend to be me.
They have their own identity. And I have mine. And there’s a separate authority establishing what they’re allowed to do on my behalf.
That’s delegation. Fundamentally different from impersonation.
Yet much of today’s internet still assumes that whoever is operating an authenticated customer account is the customer themselves. The human.
But Personal AI agents are about to break that assumption. And businesses are already reacting.
2. The agent-blocking wars have begun
In September, Amazon blocked Meta’s Muse from accessing its shopping website. Not just from making purchases.
From browsing.
According to TechCrunch, Amazon confirmed it had blocked Muse, arguing that AI agents should identify themselves transparently and respect businesses’ decisions about whether to allow automated access.
When a journalist asked Muse to look up a product, the agent explained that Amazon was ‘blocking automated access’.
Think about that. A customer can visit Amazon, browse products, compare prices and make purchases. But send an AI agent to do the same thing, and it gets blocked.
Why?
Because for the longest time businesses have assumed that customers are human users, and:
Won’t read the small print
Can’t easily compare multiple products, prices and variables like delivery options and returns
Can be moved along a sales funnel smoothly, persuaded by CX nudges and branding
Will be influenced by sponsored items and social signalling (like how many people have already bought it)
Anything other than a human user is a threat to be blocked. A script to be detected and thwarted.
But AI agents are smart, real-time, automated and don’t watch ads. So of course businesses don’t want verified bots shopping instead of people.
And Amazon isn’t alone. A recent investigation by The Verge pointed to the growing number of businesses restricting AI agents:
Amazon: Explicitly blocked Muse, having previously restricted shopping agents from Google and OpenAI.
Walmart: Muse faces ‘verification challenges’, despite Walmart supporting agent-based shopping.
Delta Airlines: Restricts automated access to its services.
JPMorgan Chase: Now limits third-party agent access over security concerns.
Charles Schwab: Restricts automated access to sensitive financial services.
Yelp: Requires commercial licensing for certain automated uses of its data.
Now, not all of these are explicit Muse bans. Some are broader restrictions on automation, and others are existing anti-bot protections getting in the way.
But they illustrate the same problem.
The internet was designed to distinguish humans from bots. Now customers actually want the bots to represent them.
And the systems designed to keep automated software out are now blocking the very software that customers have chosen to use.
Of course, businesses have legitimate concerns. How do they distinguish an approved personal agent from a malicious bot? How do they know what the customer has approved? And who’s responsible when an agent makes a mistake?
These are real security, fraud and liability questions.
But the other issue, the more commercial one, is obvious.
What happens when personal agents become really good at representing customers?
Imagine an agent that never forgets to cancel a subscription. Never misses an insurance renewal. Always finds the cheapest energy tariff. And can negotiate a better deal without getting bored or giving up.
For customers, that’s extraordinary.
For businesses that depend on customer inertia, it’s now a huge threat. And that’s not to mention the risk that those brands are about to lose the direct customer relationship to these new personal agent platforms.
There’s an important side point here about financial services: we’re not far away from having my finance agent sweep across my savings accounts and hunt for better deals. Better rates. Moving my money to a better place to suit me, not the bank manager. It’s a very real prospect that we’ll see real-time agentic runs on the banks.
So many financial institutions rely on customer inertia, customer laziness, and customer ignorance. It’s going to be fascinating to see how the FS sector, and the regulators, react to all this.
Anyway, a recent Business Insider investigation explored these commercial, rather than technical, risks.
While some businesses may want to block agents because they’re unsafe, many will want to block them because they’re becoming too useful to customers.
And those are very different motivations.
Which raises a fascinating question. If I’ve approved an AI agent to represent me, should a business be able to refuse to deal with it?
Or put another way, should I have the right to bring my own software into the customer relationship?
3. Enter the Personal Agent Protocol
Now, this is where things get interesting. Because a bunch of companies have got together to solve the problem.
They’re proposing a new Personal Agent Protocol, originally abbreviated PAP, and now known as ‘Poppy’.
Here just some of the companies involved: Sierra, Walmart, Shopify, Stripe, OpenAI, Cloudflare, Okta, ElevenLabs, Notion, Mastercard, Visa, PayPal, Bank of America, Wells Fargo, Plaid, Target, Gap, Nordstrom, United Airlines and Hertz, Cigna, and Liberty Mutual.
That’s quite a few heavy hitters, from a wide range of sectors.
Oh and there’s one more.
Meta.
The very one being blocked by other businesses.
Poppy is an early, open protocol designed to help personal agents and businesses connect and transact without forcing the agent to impersonate the customer.
Why do we need another protocol? Well its introduction describes the current situation quite neatly:
“Today it is all or nothing.”
Either the business blocks the agent, or the agent signs in as the customer and operates through their account. And neither is a good outcome.
Poppy proposes a third approach.
Let the agent identify itself as an agent, and establish what it’s authorised to do.
The draft specification includes some interesting technical details.
First, businesses can publish a machine-readable poppy.json file describing how agents can connect to their services. Think of it as a welcome mat for personal agents. It can explain which APIs are available, how to establish an authorised session and whether the business supports direct agent-to-agent interactions.
Second, the personal agent has its own identifier. So the business can distinguish the software making the request from the customer it represents.
Third, Poppy builds on OAuth to establish delegated access. The customer can authenticate directly with the business and approve what the agent is allowed to do. The specification defines separate read and write permissions, with businesses able to offer more granular scopes.
So our household finances agent might be allowed to retrieve broadband bills, but not change the contract.
And finally, Poppy supports multiple ways of interacting. The agent might use the website, an API, an MCP endpoint or just communicate directly with the business’s own agent.
All within an authorised relationship.
Now we’re getting somewhere.
Now, this is still an early draft. It’s not widely adopted, and it doesn’t solve every identity, delegation or liability problem.
But the direction is important.
Instead of pretending to be the customer, the agent can identify itself and demonstrate that it has permission to act.
That’s a fundamental change. And it’s precisely why I believe AI agents are going to need their own digital identities.
Not a human-style identity document (it’s not like AI agents are going to scan their driving license or veterans card), but a way to establish which agent is involved, who operates it, who it represents and what authority it has been granted.
Because identity and authority are two different things.
Knowing which agent is making a request doesn’t tell you whether it has permission to perform the task. And knowing that a customer has approved something doesn’t tell you whether the agent presenting that approval is the one the human authorised.
So we need both.
Which brings us to a rather uncomfortable contradiction.
4. Meta wants its agents to get in…. but what about everyone else’s?
While Meta has been building Muse to interact with businesses across the internet, it’s also been restricting competing general-purpose AI assistants from operating through its own WhatsApp Business infrastructure.
Late last year, Meta announced changes to the WhatsApp Business Solution Terms, preventing third-party AI assistants from using the platform from January 2026. This affected the competing AI assistant providers, while businesses using AI for their own customer service were treated differently.
And European competition regulators weren’t particularly impressed.
The European Commission raised concerns that Meta’s restrictions could prevent competing AI assistants from entering or expanding in the market. Meta then revised its approach, introducing paid access, but the Commission argued that the new pricing arrangements would have rhe same effect.
So the regulatory dispute rumbles on.
Now, the WhatsApp Business API isn’t the same as a public website. Meta has good reasons to manage security, infrastructure and commercial access to its platform.
But the broader contradiction is fascinating:
Meta wants Muse to be welcomed into other companies’ digital services. Yet Meta also wants to decide which competing AI assistants can operate through its own platforms.
Meanwhile it’s simultaneously helping develop an open protocol for personal agents to interact with businesses.
Hmmm.
This isn’t just a Meta problem, of course. Google, Amazon, Microsoft, Apple and other major platforms will face similar questions. They all want their own agents to access the rest of the internet. But will they welcome everyone else’s agents into their own services?
And who ultimately gets to decide?
Because whoever controls access to the customer could end up controlling the next generation of digital commerce.
5. Who gets to represent the customer?
As ever, we need to look at the bigger picture.
For the last 30 years, businesses have controlled most of the infrastructure governing digital customer relationships. They decide how we prove it is us, what information we can access, which interfaces we use and what activities we’re allowed to perform.
Websites. Apps. Portals. Customer accounts.The customer has to come to the business to ask, and be let in.
But personal AI agents introduce something fundamentally different. Customers will increasingly have their own digital representatives, operating across multiple organisations, managing activities and making decisions on their behalf.
And those representatives won’t necessarily want to use the business’s carefully designed customer journey. They’ll want to get things done. Sometimes through a website. Sometimes through an API. And sometimes by talking directly to the business’s own agent.
And that, dear friends, completely changes the customer relationship.
Because the customer is bringing their own digital interface to the business, rather than the other way around.
But to make that work, we’re going to need new infrastructure. Ways to identify agents independently of the people they represent. Ways to establish and verify ‘delegated authority’.
And ways for customers to manage those permissions across different AI platforms and services.
Not just inside Meta’s Sentinel, or Google’s equivalent, or whatever OpenAI develops next.
We need portable, interoperable ways for customers to establish who can act for them, what they’re allowed to do and when that authority expires.
It’s why I think the work happening around digital wallets, verifiable credentials, agent identity and delegation protocols is going to become so important. And it’s why initiatives like Poppy are worth watching.
This is more than a new authentication or liability problem.
It’s about who controls the customer relationship.
The business? The agent provider? Or the customer themselves?
For me, that’s the real opportunity for AI agents and ‘Empowerment Tech’. Giving individuals their own digital capabilities, including the ability to choose their own representatives and bring them into relationships with businesses.
The last 30 years hve been about building infrastructure to prove who the customer is.
We’re about to spend the next decade building digital trust infrastructure to prove who the customer has sent.
And that’s why AI agents are going to need their own IDs.
Next up: When your customer sends an agent instead
So far in this series, we’ve explored the computing infrastructure behind Muse, its approach to permissions and now the ID problem that emerges when personal agents interact with businesses.
But there’s another side to this story.
What happens to the businesses themselves?
What happens to websites, apps, customer journeys, loyalty and personalisation when customers stop showing up themselves, and start sending their personal agents instead… on behalf of (OBO) the individual?
In Part 4: When your customer sends an agent instead, we’ll explore how personal AI agents will fundamentally reshape digital commerce and the customer relationship.
See you next time.
Thanks for reading this week’s newsletter.
If you’ve enjoyed it, and want to learn more about the future of Personal Agents, digital customer relationships and customer engagement, then why not subscribe: