Five checks before letting an AI agent buy, pay or cancel on your behalf

By Nate (Nate's Substack) · October 31, 2026.

The email is a preview of a longer article whose full content is for paid subscribers. What follows summarizes only what appears in the text received.

Nate starts from a tension. He says "Black October" showed that AI makes it easier to break into websites without permission. At the same time, he wants AI to use websites on his behalf to book flights, shop and manage accounts. In his view, companies need a way to let his agent do all of that without giving an attacker the same access.

He predicts that the internet will become increasingly uneven for agents through 2027. Some companies will build reliable ways to accept them. Others will let them work through the existing web. Others will reject them. He believes the companies that make it easier to recognize and accept legitimate agent activity will gain power, because both consumers and businesses need that help. He says he supports that work. He also wants connections to be open enough that switching assistants doesn't mean losing access to the places where we live and work online.

He illustrates the problem with a personal experience. An agent can plan a trip perfectly and then get stuck on a hotel's booking page, because the hotel won't let the agent finish. Nate then has to decide whether to complete the booking himself or choose accommodation where his agent can book. That changes which businesses get his money. He concludes that a smarter model won't open a door a company has decided to close.

The email outlines the contents of the full article:

• What each trust system does. He cites Cloudflare's agent signatures, Google's AP2, Stripe's payment tokens, Visa's pilot and Meta's Sentinel. He says each answers a different question and that a table shows which.

• Why your agent stopped. He describes three zones that indicate whether to correct the agent, give it better information, approve something or find another route.

• How he splits work across five agents. He mentions Grok Bot, dots, Instinct, Muse and Duet, what each one handles and where he would be cautious in recommending them.

• Five controls for a first delegated task. Scoped access, specific approvals and checking the result where it is supposed to end up.

• A prompt that picks your agent. It researches your services and your country and returns a small first experiment you can verify.

The email does not detail the five controls or how each system works, so they cannot be summarized here. Paid subscribers get access to the full archive, the Nate's Library MCP and his Slack community.