United Just Banned AI Agents From Booking Its Flights. Design Your Agent for Merchants That Say No
By Surya Pratap
November 12, 2026
8 min read
AI & Technology
November 12, 2026
8 min read
See the rule, and the designHover to exploreIf you are building an agent that buys things for people, yesterday's news from United Airlines matters more than any model release this month. On 11 November United said it would restrict "unauthorized, third-party personal AI agents or assistants", both on its own website and app and through the travel agencies and aggregators that sell its tickets. Its revised Contract of Carriage, as quoted in press coverage, goes further than most founders would expect. It covers agents even when the passenger supervises or approves each step, and it lets United cancel the bookings they make. This is not a court ruling or a regulation. It is a merchant deciding, in its own terms, what your product may do.
This article is based on United's announcement of 11 November 2026, and on coverage by PPC Land and Simple Flying, which quote the revised Contract of Carriage. I did not read the contract itself, so quotations of contract text below are as those outlets give them. The reading from section 3 onward is mine.
United's announcement is short. It says the airline is "taking steps to restrict access - directly within our digital platforms and indirectly via travel agencies and aggregators - to prohibit use by unauthorized, third-party personal AI agents or assistants", and that this includes "updates to our booking, ticketing and distribution policies."
The contract text, as quoted by PPC Land and Simple Flying, has three parts that matter:
Two details are reported but less certain. According to the Wall Street Journal, as cited by PPC Land, agents can still show United flights and prices; the prohibition starts at the transaction. And PPC Land reads the contract's existing rules to mean that tickets issued before 11 November remain under the earlier text, while noting that the contract gives no separate effective date for the new provisions.
The announcement gives two kinds of reason. The first is about the customer: "sharing account credentials with personal, third-party, AI assistants can expose sensitive information, and actions taken by these tools may result in unintended purchases, account changes, or use of MileagePlus miles." The second is regulatory: automated actions "have the potential to violate FAA and DOT regulations", and the example it gives is check-in, which "requires human acknowledgment that bags do not contain banned substances like explosives."
There is also a commercial reason, and United's chief executive said it out loud. At an event in Chicago, as reported by the Wall Street Journal and repeated by Simple Flying and PPC Land, Scott Kirby said he did not want "to create another middleman". An airline has spent decades pulling customers toward its own website and app. An agent that books on the customer's behalf sits between the airline and the customer, and decides which airline to show first.
United also says it is not alone: "Corporate leaders in the banking and retail industries have taken similar actions regarding AI agents". PPC Land lists examples from retail. Amazon blocked Meta's Muse agent from buying on Amazon.com in September. Walmart went the other way in October, publishing terms that let outside agents buy within limits the customer sets and saying it would block agents that do not comply.
Approving every step does not make an agent compliant. United's definition covers agents "whether or not" a person supervises or approves their actions.
In August we covered the Ninth Circuit ruling that, under anti-hacking law, an AI agent is "a tool, not a person". That piece predicted that the fight would move to contract, and that the person bound by the contract would be your user. United has now done exactly that. The remedy is not a lawsuit against the agent's maker. It is a cancelled booking for the passenger who used it, without notice.
That changes how you should think about three things.
Human-in-the-loop is not a compliance answer. Many agent products treat a confirmation step as the fix for every risk: the agent fills the cart, the user taps approve. That is still a good design for errors. But a merchant whose definition covers agents "whether or not" a person approves their actions has written that defence out of its terms. If your agent submits the transaction, the confirmation screen does not change who made it.
Your scope is now set by each merchant. Until now, agent products have been limited mainly by what models can do reliably. United shows that the limit can also be a single rule in a merchant's terms. The same task can be allowed at one merchant, allowed within limits at a second, and grounds for cancellation at a third. Your product needs to know which is which before it acts, not after a user's booking disappears.
Your user carries the risk. The person whose reservation can be cancelled is the passenger, not you. The consequence is outside your product, it may arrive without warning, and it lands on the person who trusted you. Our September piece on the Visa Trust Index found that 23% of US consumers would let an assistant pay. A user who loses a flight because of your agent will not be in that 23% again.
The practical answer is to separate what an agent may look at from what it may do, and to decide the second per merchant, in code, before the agent acts.
from dataclasses import dataclass
from enum import Enum
class Mode(Enum):
TRANSACT = "transact" # merchant allows agents to buy
LIMITED = "limited" # allowed within limits the user set
HANDOFF = "handoff" # agent may search; the user completes checkout
BLOCKED = "blocked" # do not touch this merchant at all
@dataclass
class MerchantPolicy:
domain: str
mode: Mode
source_url: str # where the rule is written down
reviewed_on: str # date someone last read it
max_amount: float | None = None
POLICIES = {
"united.com": MerchantPolicy(
"united.com", Mode.HANDOFF,
"https://united.mediaroom.com/news-releases?item=125496", "2026-11-12"),
}
def next_step(domain: str, amount: float, user_limit: float) -> str:
policy = POLICIES.get(domain)
if policy is None:
return "handoff" # unknown merchant: safest default
if policy.mode is Mode.TRANSACT:
return "transact"
if policy.mode is Mode.LIMITED:
limit = min(user_limit, policy.max_amount or user_limit)
return "transact" if amount <= limit else "handoff"
return policy.mode.value
Keep a policy for each merchant. Record the mode, the URL of the rule and the date someone last read it. Default unknown merchants to handoff, not transact. A rule you have not checked is a rule you are guessing about.
Search and compare freely, where that is allowed. Most of the value users get from a travel or shopping agent is finding and comparing options. Reported coverage suggests United still allows that, and it is where your agent can do most of its work.
Hand checkout back to the user. When the merchant says no, end with a link to the merchant's own page, prefilled where its links allow it, and let the user finish there. A good handoff is a feature, not a failure. It is also the step that keeps credentials out of your system.
Tell users what each merchant allows. Before the agent starts, say whether it will book or hand off, and why. If a merchant can cancel what your agent does, your user should hear that from you before they hear it from the merchant.
Two more things belong on this week's list. First, prefer merchants that publish rules for agents, such as Walmart's terms with customer-set limits, and channels the merchant has approved, over operating a logged-in session in a way the merchant forbids. Second, keep a log of every transaction your agent submits, with the policy that allowed it. Our October piece on Stripe's approval rules for agents shows the same pattern from the payments side: decide in code what the agent may do, and make that decision visible.
If you are the merchant
Many founders reading this run the product that agents visit, not the agent. United's move is a reminder to decide your own policy before the traffic decides it for you. Do you want agents to search, to buy within limits, or neither? Write the answer into your terms, publish it where agents and their makers can find it, and decide how you will tell agent traffic apart. An unclear policy produces the worst result: agents use your product in ways you did not plan for, and your customers bear the cost.
That agentic commerce is over. One airline has drawn a line at the transaction. Walmart has drawn a different one, with limits. The more likely outcome is a mix of merchants that allow agents, allow them within limits, and forbid them, which is why a per-merchant policy is worth building now.
That search is protected in the contract. The reports that agents may still show fares come from press coverage. PPC Land points out that the contract's definition of an AI agent includes actions to "discover, search for" products, while the prohibited practice names only making, changing or servicing a ticket and buying. That gap is what leaves search allowed, and United could close it.
That check-in is explicitly covered. United's announcement uses check-in as its example, and Simple Flying's headline says the ban covers check-in. PPC Land notes that the contract does not say whether checking in a passenger counts as servicing a ticket.
That United can detect every agent. Neither the announcement nor the coverage I read says how United will tell an agent from a person. A rule that cannot be enforced reliably can still be enforced against the users it does catch, and you do not want those users to be yours.
On 11 November 2026 United Airlines restricted third-party AI agents on its own channels and through travel agencies and aggregators. Its revised Contract of Carriage, as quoted in press coverage, defines AI agents to include those a passenger supervises or approves, prohibits using them to make, change or service a ticket or to buy any product, and lets United cancel the reservations they make. United cited customer security and FAA and DOT rules, and its chief executive added that he did not want another middleman.
For founders, the lesson is that a merchant's terms can now set the scope of an agent product as firmly as model quality does, and the person who pays for a breach is your user.
This week, list the merchants your agent transacts with, read what each one says about agents, and route every one you have not checked to a handoff the user completes.
Sources: United Airlines, United Restricts Access for Third-Party AI Agents (11 November 2026) — the restriction across United's digital platforms, travel agencies and aggregators, the reasons about credentials, unintended purchases and MileagePlus miles, the FAA and DOT check-in example, and the reference to banking and retail; Luis Rijo, PPC Land, United bans AI agents from buying its tickets, seats and upgrades (11 November 2026) — the quoted text of Rules 1, 5.H and 6.J.6, the reading of which tickets fall under the earlier text, the reported allowance for search, the gap between the definition and the prohibited practice, and the Amazon and Walmart examples; Luke Bodell, Simple Flying, United Airlines Officially Bans AI Agents From Booking Your Flights And Checking You In (12 November 2026) — Rule 6.J.6, the check-in and hazardous-materials context, and Scott Kirby's remark in Chicago. The code in section 4 is my illustration, and the reading in sections 3 to 5 is mine.
IdeaToMVP Academy
4-week live cohort for founders. Learn to ship AI agents, scope MVPs, and automate your business — taught by the same team that writes these guides.
