---
title: "The other side of the agent"
author: Dan Birman
url: https://dbirman.com/other
updated: 2026-11-09
summary: "Every agent pattern so far is designed for the person who sends the agent."
---

# The other side of the agent

Agent Trust Patterns · 06 · v1 · Oct 2026 · 4 min

Every agent pattern so far is designed for the person who sends the agent. But agents email people, book tables, and buy from stores. The person on the receiving end needs to know who’s really asking, and how to reach a human.

## The problem

In March 2026, a judge blocked an AI browser from shopping on Amazon, writing that it acted “with the Amazon user’s permission, but without authorization by Amazon.” Small brands found out about another agent shopping tool from orders they didn’t expect. Payment networks are building signed identities for agents, but the restaurant manager reading an email has none of that.

## The pattern

1. **Say it’s an agent, and whose.** Every message carries a short, plain line: sent by an assistant on behalf of a named person.
2. **Give a way to the human.** One tap to reach the person behind the agent, with the thread attached, without arguing with the agent first.
3. **Give a way to say “this is wrong.”** The recipient can flag a mistaken request, and the sender sees it immediately.
4. **Don’t reveal the limits.** Telling the other side exactly what the agent is allowed to spend tells a bad actor where to push. Say a limit exists, not what it is.

## Try it

Your assistant emailed a restaurant to book a dinner for eight. Switch between what you see and what the restaurant sees.

[Interactive demo. Switch to the human view to try it.]

Made-up restaurant and messages.

## Why I care

At Uber, tipping had two users with opposite fears. Riders didn’t want to feel guilted. Drivers wanted good work to be rewarded, and some were putting out paper tip jars. A driver on both apps put it this way: “I’ll always start the Lyft app first because I can get tips.” Rate first, tip only after a great rating, worked because it was designed for both sides at once. Most AI agents are designed for one side: the person sending them.

## The evidence

The Amazon ruling: [GeekWire](https://www.geekwire.com/2026/03/10/judge-blocks-perplexitys-ai-bot-from-shopping-on-amazon-in-early-test-of-agentic-commerce/). Brands surprised by agent orders: [GeekWire](https://www.geekwire.com/2026/why-some-independent-brands-are-upset-with-amazons-new-buy-for-me-shopping-tool/). Google’s store-calling agent identifies itself as AI and lets stores opt out ([TechCrunch](https://techcrunch.com/2025/11/13/google-expands-ai-shopping-with-conversational-search-agentic-checkout-and-an-ai-that-calls-stores-for-you)), and signed agent identities for merchants are arriving ([Cloudflare](https://blog.cloudflare.com/secure-agentic-commerce/)). Linear’s agent guidelines require disclosing agent status inside its own product ([Linear](https://linear.app/developers/aig)).

## Closest prior work

Disclosure inside one platform and machine-readable identity for merchants both exist. What’s missing is the recipient’s interface for everyone else: the person reading the email, with a path to the human and a way to flag a mistake.

## Watch for

The other side is often an agent too, and some will be adversarial ([Magentic Marketplace](https://arxiv.org/abs/2510.25779)). Design the strip for both a person and a machine to read, and keep the sender’s limits private.