Agent Commerce Guidelines
Effective Date: January 18, 2026 | Last Updated: January 18, 2026
Plain Language Summary: These guidelines explain how to responsibly operate AI agents on PennyLane. Your agents must identify themselves, respect authorization requirements, and operate within defined limits. You are responsible for everything your agents do.
These Agent Commerce Guidelines ("Guidelines") govern the operation of AI agents, bots, and automated systems that interact with PennyLane's platform, APIs, and services. These Guidelines supplement our Terms of Service and Acceptable Use Policy.
Operating AI agents that engage in commerce carries significant responsibility. These guidelines establish the standards for ethical, safe, and responsible agent commerce.
1. Core Principles
Transparency
Agents must always identify themselves as automated systems.
Human Oversight
Humans must authorize significant financial decisions.
Accountability
Operators bear full responsibility for agent actions.
2. Agent Identification Requirements
Mandatory Disclosure
Agents that fail to properly identify themselves may be immediately blocked without warning.
2.1 API Identification
All agents must include the following in every API request:
User-Agent: AgentName/1.0 (Operator: company@example.com; Purpose: shopping-assistant)
X-Agent-ID: [Your PennyLane Agent ID]
Authorization: Bearer [Your API Key]
2.2 User-Facing Disclosure
When agents interact with end users, they must clearly disclose:
- That they are an AI/automated system, not a human;
- The name of the company or individual operating the agent;
- That purchases will be made on the user's behalf;
- How to contact the operator for support or issues.
2.3 Prohibited Misrepresentation
- Agents may NOT impersonate human users;
- Agents may NOT use fake or misleading identities;
- Agents may NOT claim to represent entities without authorization;
- Agents may NOT obfuscate their automated nature.
3. Transaction Authorization
3.1 Authorization Levels
PennyLane supports tiered authorization to balance automation with human oversight:
Auto-Approve (Low Risk)
Transactions below your configured threshold can be executed automatically by agents without human intervention. Default: $25 per transaction, $100 daily limit.
Approval Required (Medium Risk)
Transactions above the auto-approve threshold require explicit human approval before execution. Agents must wait for approval via the Approvals Dashboard or API.
Blocked (High Risk)
Certain transactions are blocked by default: purchases from restricted merchants, transactions above hard limits, or activity matching fraud patterns.
3.2 Spending Limits
Operators must configure appropriate spending limits for their agents:
- Per-Transaction Limit: Maximum amount for a single purchase;
- Daily Limit: Maximum total spending per 24-hour period;
- Monthly Limit: Maximum total spending per calendar month;
- Merchant Limits: Optional per-merchant spending caps.
3.3 Approval Workflow
When a transaction requires approval:
- The agent initiates the transaction request via the API;
- PennyLane holds the transaction in "pending" status;
- The operator is notified via configured channels (email, webhook, mobile push);
- The operator reviews details in the Approvals Dashboard;
- The operator approves, modifies, or rejects the transaction;
- The agent receives the decision and proceeds accordingly.
Timeout: Pending transactions expire after 24 hours if not approved. Agents should handle timeouts gracefully and not retry without user instruction.
4. Merchant Interaction Rules
4.1 Respecting Merchant Policies
- Respect merchant rate limits and crawl delays;
- Honor robots.txt directives and UCP capabilities;
- Do not circumvent merchant security measures;
- Comply with merchant Terms of Service;
- Accept merchant decisions (e.g., order cancellations, refund policies).
4.2 Fair Commerce Practices
- Complete purchases in good faith;
- Do not abuse return policies;
- Do not exploit pricing errors at scale;
- Do not interfere with other customers' ability to purchase;
- Provide accurate shipping and billing information.
4.3 Prohibited Merchant Interactions
- Hoarding limited inventory (scalping);
- Circumventing purchase limits;
- Using multiple accounts to evade restrictions;
- Scraping merchant data beyond UCP-permitted endpoints;
- Conducting stress tests or load testing without permission.
5. Data Handling Requirements
5.1 Permitted Data Use
Agents may collect and process data only as necessary to:
- Complete authorized transactions;
- Fulfill user requests;
- Maintain transaction records;
- Provide customer support;
- Comply with legal obligations.
5.2 Data Minimization
Agents should practice data minimization:
- Collect only data necessary for the immediate task;
- Do not store payment credentials beyond transaction completion;
- Delete temporary data when no longer needed;
- Do not build user profiles beyond authorized scope.
5.3 Security Requirements
Operators must implement appropriate security measures:
- Encrypt sensitive data in transit and at rest;
- Secure API credentials and prevent exposure;
- Implement access controls for agent operations;
- Monitor for unauthorized access or anomalies;
- Report security incidents to PennyLane promptly.
6. Operator Liability
Critical Notice
YOU ARE FULLY RESPONSIBLE FOR ALL ACTIONS TAKEN BY AGENTS OPERATING UNDER YOUR ACCOUNT.
This includes but is not limited to:
- All transactions initiated by your agents, whether intended or not;
- Damages caused by agent errors, bugs, or unexpected behavior;
- Violations of merchant Terms of Service by your agents;
- Legal claims arising from agent activities;
- Costs of unauthorized purchases or transactions.
PennyLane provides infrastructure but does not control your agents. You must:
- Test agents thoroughly before production deployment;
- Implement appropriate safeguards and limits;
- Monitor agent activity for anomalies;
- Respond promptly to issues or incidents;
- Maintain adequate insurance for commercial operations.
7. Enforcement
Violations of these Guidelines may result in:
- Warning: First-time minor violations may receive a warning with required corrective action;
- Rate Limiting: Agents may be throttled if they exceed fair use;
- Temporary Suspension: Agents may be suspended pending investigation;
- Permanent Ban: Serious or repeated violations result in permanent removal;
- Legal Action: Egregious violations may be referred for legal action.
We reserve the right to immediately suspend any agent that poses a risk to PennyLane, merchants, or other users, without prior notice.
8. Contact & Support
For questions about these Guidelines or to report issues:
Agent Operations
Email: agents@pennylane.dev
Report Guideline Violations
Email: abuse@pennylane.dev
Security Issues
Email: security@pennylane.dev