AI Agents Now Spend Your Money. Nobody Agrees Who Sets the Rules

Nobody elected the systems that now decide what millions of people buy. Still, they decide.

A new Forbes analysis by Hamilton Mann asks the sharper question. Not who regulates AI agents. Instead, he asks what actually rules them. In my view, the honest answer embarrasses the industry.

Today, three things steer an agent. First, the catalog schema. Second, the ranking heuristic. Third, the vendor’s incentive. Policy steers almost nothing. The shopper steers even less.

The numbers force the issue

McKinsey estimates that AI agents could mediate $3 trillion to $5 trillion of global consumer commerce by 2030. Meanwhile, Gartner projects the agent and assistant market to grow thirteenfold between 2025 and 2030.

Agent-mediated transactions still make up a sliver of e-commerce. That gap worries me. Because the numbers stay small, nobody watches. So the rulebook gets written right now, in the quiet.

Advising and Acting Are Not the Same Thing

A recommendation engine suggests. An agent commits. Most buyers still blur the two. However, that blur is the entire risk surface.

If the distinction feels fuzzy on your team, start with our breakdown of what separates AI tools from true AI agents.

Why classic oversight fails here

Noam Kolt flagged this early in Governing AI Agents. He argues that the old principal-agent toolkit may break down. Incentives, monitoring, and enforcement all assume human speed.

My read is simpler. You cannot supervise a delegate that acts a thousand times before you read its first decision. Therefore, oversight has to sit in the architecture. Otherwise it is theater.

Beauty Exposes the Part of Agentic Commerce Nobody Discusses

Mann makes a claim most commentary skips. Men and women are not situated the same way when agents enter beauty and fashion. Moreover, beauty sits among the fastest-expanding categories for AI-mediated discovery.

The industry treats beauty as a convenient pilot. In fact, the data suits machines almost too well.

The catalog does the deciding

Ulta Beauty went live on Google’s Universal Commerce Protocol as a launch partner. Glossier ships through the Agentic Commerce Protocol on ChatGPT. A single foundation can carry more than 30 attributes. Skin type, undertone, finish, coverage, and ingredient flags all shape the match.

A concrete example

Picture a shopper asking for a foundation. Combination skin, medium coverage, under $40.

The agent never sees a face. Instead, it filters a catalog.

Brand A tagged 34 shades with undertone, depth, and finish values. It added fragrance-free and non-comedogenic flags too. Brand B sells the same 34 shades. However, its team wrote rich copy for humans and filled only six structured fields.

As a result, the agent surfaces Brand A. It never mentions Brand B. Brand A did not win on merit. It won on readability.

Where the bias actually enters

Now push the example one step further. Deep-shade ranges usually got tagged last, because brands launched and merchandised them last.

So the thinnest results land on the shopper whose shade range was already underserved. Nobody coded a bias rule. Instead, the catalog inherited a twenty-year retail gap. Then the agent enforced it at machine speed, with total confidence.

That is my core argument. Attribute density looks like objectivity. It is not. The rules live in schema fields, and almost nobody audits them.

Instruction Files Hold More Power Than Policy Decks

Ask an engineer what governs an agent. You will not hear the word regulation. Instead, you will hear about instruction files, tool permissions, and skill definitions.

That layer works as the operative constitution. Anyone with repo access can edit it. Few teams audit it. Users never see it. Our explainer on how AI agent skills and SKILL.md files work, and where they fail, walks through the damage a plain text file can do.

Identity is the second load-bearing layer

Many teams staple agents onto human accounts. In my view, that is the most common unforced error in the market.

An agent that borrows your credentials also borrows your blast radius. Therefore, agents need their own identities, scoped permissions, and revocable access. Separating AI agent identity from human identity is a practical way to limit that exposure and keep agent access easier to control.

Until that becomes standard, one bleak answer holds. Whoever holds the session token rules the agent.

Governance Failures Arrive as Invoices

In late May 2026, an AI consultant told Axios about a $500 million bill. One enterprise client ran it up on Claude in a single month. The cause was simple. Employees got unrestricted access, and nobody set usage controls.

Uber burned its entire 2026 AI budget by April, according to reports. Per-engineer costs ran between $500 and $2,000 a month. Agentic loops consume tokens far faster than a normal chat query.

Neither case involved malice

Both cases came down to arithmetic. So treat cost ceilings as a selection criterion, not an afterthought. If you’re comparing agent platforms before committing to a budget, an OpenHands vs Devin vs Manus comparison breaks down the key differences in cost, capabilities, and use cases.

Merchants Already Answered the Question

OpenAI launched Instant Checkout in September 2025. By March 2026, the company shut it down. Brands pushed back hard because they lost traffic, data, and loyalty flows.

Today the surviving pattern looks different. Agents recommend. Shoppers finish the purchase on the merchant’s site.

That outcome tells you plenty. Model providers do not rule agents. Merchants still hold the checkout.

The recommender role still pays

By March 2026, AI-referred traffic converted roughly 42% better than traditional traffic. In addition, AI referral traffic to U.S. retail sites climbed about 393% year over year in Q1.

Three Things I Would Fix First

Cap the agent, not the intent. Put hard transaction ceilings and kill switches in the config. A policy deck stops nothing.

Audit the schema, not just the output. Run the foundation test above against your own catalog. Then see which customers quietly vanish.

Give agents their own names. Scoped identity and full action logs turn an opaque delegate into an accountable one.

The Bottom Line

Regulation will arrive eventually. Meanwhile, procurement contracts, schema audits, and identity architecture will settle far more.

So treat agent governance as a compliance chore in 2026. Then spend 2027 explaining decisions you never made.

Related: AI Agent Identity vs Human Identity: The Access Control Model That Actually Works