Walmart published the terms before it published the tool. That single sentence is the whole story, and almost nobody read it that way. On the surface, the announcement looks like a retailer swinging its shelves open to autonomous agents: a dedicated server endpoint, delegated purchasing on a customer's behalf, a written code of conduct for whoever operates the agent. Read the fine print and something colder appears. The governance layer shipped; the access layer is still in beta. Walmart did not open a gate. It nailed a sign to a gate it intends to open later, on terms it wrote alone.
Anyone who has spent time on-chain will recognize the shape. Registries, scoped permissions, revocation paths, a named accountable party. This is the architecture DeFi has been groping toward for three years — except it arrived from Bentonville instead of a token launch, and the crypto press missed the part that matters: the payment rail Walmart chose is not the one Visa and Mastercard spent the last year building. Charts lie. Intuition speaks. This is not a chart. It is a spec sheet, and the spec sheet says the card networks lose.
Strip the press release and the component list is unremarkable. Walmart's Agent Gateway is OAuth-style delegated authorization, scoped API tokens, per-session spend caps, a webhook that kicks an order back to a human for approval, and a server-to-server order API. Five primitives. None of them new. I have audited contracts built from the same five — delegated approvals, allowance ceilings, timelocks, multisig escalation — and the failure modes were identical every time: scope creep, missing idempotency, and a human who clicks approve without reading.
What Walmart actually invented is the paper. Written terms, an Agent Profile registry, an accountable principal behind every agent. The innovation is governance, not architecture. That distinction matters because governance is the only layer that can be standardized across retailers, and it is also the layer most easily captured. In 2017 I put fifteen thousand dollars across twelve unverified ICOs and lost nine of them; every one of those whitepapers described delegated authority in elegant prose and implemented none of it in code. Walmart at least shipped the terms as a document with enforcement language attached.
The second thing worth flagging is the number everyone quoted and nobody sourced: 67% of catalog data will be agent-ready. That figure has no named institutional origin. My audit experience says the honest number is lower. Agent-readable catalog means stable GTIN and UPC identifiers, structured attributes, per-store real-time inventory truth, machine-readable promotional rules, variant resolution, ETA computation, and machine-readable return terms. Most retail PIM systems cannot produce half of that on a Tuesday. Walmart can — its marketplace has forced structured product data on sellers for years. That is precisely why it moved first: it is one of the few exceptions, and exceptions write rules.
The third fact is buried deepest. Walmart already serves consumers through three bespoke integrations. Three handshake deals. A gateway exists to convert three bespoke deals into N self-serve ones. When N is small, platform plays fail at a rate that would embarrass a token launch. That is not a prediction about failure. It is a base rate.
The interesting question is not whether the gateway works. It is where the money and the authority settle. Follow the payment token. Walmart's terms forbid agents from touching card data and forbid them from modifying payment methods. Read that as privacy and you have misread it. Read it as custody and it snaps into focus: the token stays inside Walmart's perimeter, which routes the card networks' agentic payment rails around the largest retail surface in the United States. Visa's trusted-agent protocol, Mastercard's agent credentials, Google's payment mandate — each assumes the agent presents a credential the network can see. Walmart's architecture assumes the agent presents a credential only Walmart can see. This is the same fight stablecoins have had with card rails for a decade, except this time the merchant took the first round without firing a shot, using the customer's own consent as cover.
A spend cap is not a safety feature. It is the removal of the only control point that ever worked. Default per-order approval is the last gate against indirect prompt injection — the attack where a listing, a review, a shipping note, or a marketplace seller's description carries instructions the agent reads and obeys. Once a customer selects "set a limit and skip approvals," that gate disappears and the exposure changes character: not single-transaction fraud, but unbounded exploitation inside the cap. I have watched this exact class of bug in audited contracts — an allowance set high enough for convenience is an allowance set high enough for a drain. The announcement offers the option and attaches zero risk language to it.
Then idempotency. Agents retry. Networks time out. A retried order that is not deduplicated at the API layer is a double charge, and the terms do not say who absorbs it. In my 2022 audit work on L2 bridges, the bugs that actually drained funds were never exotic reentrancy. They were missing nonce checks on retried messages. Same failure, different industry, same silence.
One number got quoted and never analyzed: agent-linked checkout converts at roughly one-third the rate of click-through. Everyone read that as immaturity. It could equally be unit-economics degradation. Click-through traffic arrives with intent and carries upsell, basket-building, and recommendation slots. Agent traffic carries none of that. The honest hypothesis is lower conversion plus lower basket size plus zero cross-sell. The same figure supports "early days" and "the model does not work," and the announcement picked the flattering reading.
The structural weakness nobody says out loud: Agent Profiles are a per-store identity silo. An agent registers with Walmart, then Target, then Kroger, each with its own paperwork and its own ban list. Per-retailer identity is not scalable, and every party in the room knows it. That is the gap an on-chain registry fills — one portable, revocable, attributable identity that any merchant can verify without holding the keys. In 2026 I route capital through autonomous agent protocols and screen them on exactly this property; the ones that survived due diligence all shared one trait, a revocable identity with an accountable owner. Walmart just demonstrated demand for that middle layer by building a worse version in-house.
And the most commercially loaded sentence in the document: the agent is treated as the cardholder. That pre-assigns liability. Under card rules, an authorized cardholder's transactions are the cardholder's problem. Walmart is quietly declaring that an over-permissioned agent's order is the customer's problem, with the operator on the hook and returns as the only remedy. That is not a policy detail. That is the entire risk transfer, in one line, and it will be litigated.
The consensus reading is that Walmart opened up while Amazon stayed closed, and that this reflects two philosophies about agents. It reflects two balance sheets. Amazon's ad business runs near fifty billion dollars a year; Walmart Connect runs near four to five. Both are order-of-magnitude estimates, and the ratio is the point. For Amazon, an agent that bypasses the search page does not degrade the funnel — it deletes the profit pool. For Walmart, the same bypass is an affordable toll. The divergence is financial structure, not strategic temperament. Anyone modeling retailer agent strategy off stated philosophy instead of ad-revenue concentration is modeling the wrong variable.
Second point, and this is the one that should worry promo-driven incumbents: uniform agent pricing is a subsidy to everyday-low-price operators. Walmart's terms forbid agent-specific pricing. They do not forbid member pricing, personalized coupons, dynamic pricing, or clearance. But when an agent compares across merchants, the optimization function collapses to price plus ETA plus availability. A hi-lo retailer whose model depends on catching shoppers inside a promotional window loses that window, because an agent can wait indefinitely, compare across stores, and scrape the price curve. EDLP wins by default. The promo arbitrage is not a feature of retail; it is the business model of half of it, and nobody framed the terms that way.
Third: retail media does not die, it relocates — from page slots to result ordering. A sponsored slot on a search page is advertising. A sponsored slot inside an agent's answer is manipulation of the user's proxy. There is no disclosure framework for that, and the first retailer to sell it will call it relevance. The agent is the audience now, and nobody has written the rules for advertising to a machine that speaks for a human.
Watch two numbers, not the announcement. The first is the quarter Walmart discloses agent-sourced GMV as a share of e-commerce; that is the real starting gun, and it will arrive later than the narrative implies. The second is who ends up holding the agent credential — the merchant, the card network, or a neutral registry. Code doesn't lie. Trust is the risk. The gate is not open yet, and when it opens the question is not what Walmart will let an agent buy. It is who holds revocation, and whether that answer lives in Bentonville or in a registry nobody owns.