If your customers send AI agents to log in and act for them, your customer agreements and platform terms set the rules for that traffic.
On August 4, 2026, the Ninth Circuit vacated a preliminary injunction Amazon had won against Perplexity's Comet shopping agent. It noted the outcome "does not impair Amazon's ability to regulate access to Amazon.com via private terms of service for its users."
Say you run a B2B ordering platform where customers reorder supplies at contract prices. One customer's purchasing lead has a browser agent place orders under her account each morning. Suppose it places a duplicate order she disputes, or slows checkout at peak hours. Which agreement governs the customer's use? Did her employer, the customer, accept the version with your agent rules?
Issue 16 of The Thursday Redline, my LinkedIn newsletter, covered the case. This is the working version for platforms.
Seven decisions for your agent terms
Your automated-access and suspension provisions may already reach some agent conduct. Settle these policy choices before anyone drafts. (Separate guides cover agents you deploy yourself and your own AI vendor contracts.)
1. What counts as agent use.
The decision: which conduct triggers your agent rules: credential logins, orders, data exports, or all three.
Why it matters: every other decision attaches to this one.
Limit: draw it too wide and it catches integrations you sell on purpose.
2. Who authorizes an agent, and for what.
The decision: five linked choices.
- Who may enable an agent: any user, or only the customer's account admin.
- Which actions the customer authorizes.
- When a human must confirm first, such as an order above a dollar threshold.
- How the customer withdraws authorization, and what happens to the agent's open sessions.
- How customer responsibility fits those choices, such as answering for agent actions taken through its account within the authority it set.
Why it matters: The federal E-SIGN Act (the Electronic Signatures in Global and National Commerce Act) addresses the legal effect of a contract formed with an electronic agent: it can't be denied effect solely because an agent was involved, "so long as the action of any such electronic agent is legally attributable to the person to be bound" (15 U.S.C. Section 7001(h)).
Maryland and D.C. law also recognize contracts formed through an "electronic agent," which both define as a program that acts or responds on its own, without review or action by an individual (Md. Code Ann., Com. Law Sections 21-101(g), 21-113; D.C. Code Sections 28-4901(6), 28-4913).
Limit: those statutes address contract formation, not a customer's responsibility for everything its agent does. Your terms define the contractual boundary of that responsibility, subject to applicable law.
3. What agents may do.
The decision: sort agent actions into allowed (browsing, reordering within limits), allowed with human confirmation (orders above a threshold), and prohibited (passing session cookies to outside servers, bypassing security measures).
Why it matters: a blanket ban can cost customers you'd rather keep.
Limit: each prohibition has to describe the conduct specifically enough to reach it.
4. Access and rate limits.
The decision: the numbers agents must stay within, such as requests per minute or concurrent sessions, and whether you reserve the right to throttle.
Why it matters: a number is easier to apply than "excessive use."
Limit: it works only if engineering can measure agent traffic.
5. Identification.
The decision: whether agent traffic must identify itself, and whether disguising it as a human session is a violation.
Why it matters: you can't apply the other decisions to traffic you can't pick out.
Limit: it works only if the agent complies.
6. The link to technical controls.
The decision: whether your terms say you may use rate limits and bot detection, and that circumventing them is a breach.
Why it matters: it turns a technical measure into a customer commitment.
Limit: technical signals aren't access rules on their own.
7. Agent-only cutoff or account suspension.
The decision: whether a violation lets you cut off agent access alone, the whole account, or either.
Why it matters: it gives you a contractual basis to act, scaled to the problem.
Limit: it doesn't compensate for harm or tell you whether suspending is wise.
How do customers accept the terms?
In Berman v. Freedom Financial Network, LLC, 30 F.4th 849 (9th Cir. 2022), the Ninth Circuit said that, absent proof the user actually knew of the terms, an online agreement is enforceable only if (1) the site gives reasonably conspicuous notice and (2) the user takes an action, like clicking a button, that unambiguously shows assent. Formation is a state-law question, and courts decide case by case whether a screen was enough.
A business customer usually accepts through an authorized representative acting for it. If you also have a signed customer agreement, such as an MSA or order form, it may govern or take priority over your online terms; check which document controls and how it treats updates.
New users. In Selden v. Airbnb, Inc., 4 F.4th 148 (D.C. Cir. 2021), the D.C. Circuit held Airbnb's sign-up screen gave reasonable notice of its terms. In Marshall v. Georgetown Memorial Hospital, 112 F.4th 211 (4th Cir. 2024), the Fourth Circuit, which includes Maryland, asked whether the interface would put a "reasonably prudent user" on notice. Neither case addresses amendments, and Marshall applied South Carolina law.
In practice: notice beside the sign-up button, and button text saying clicking means agreeing.
Existing customers. In Douglas v. United States District Court (Talk America), 495 F.3d 1062 (9th Cir. 2007), the court wrote: "Parties to a contract have no obligation to check the terms on a periodic basis to learn whether they have been changed by the other side." Continued use could count as assent only after proper notice (495 F.3d at 1066).
The provider there posted materially adverse changes with no notice at all, so Douglas doesn't hold that every edit needs fresh assent.
In Cheek v. United Healthcare of the Mid-Atlantic, Inc., 378 Md. 139 (2003), Maryland's highest court held that reserving the right to change a policy "at its sole and absolute discretion at any time with or without notice" (378 Md. at 142-43) made the promise illusory (id. at 149). That was an employment arbitration policy, not online terms, but it's Maryland's leading authority on unilateral-amendment clauses.
I found no Maryland appellate clickwrap decision and no D.C. Court of Appeals decision on amending online terms.
Keep the acceptance record. For each acceptance, log the customer entity, the person or session that acted, that person's authority where it applies, the governing agreement and version, and the evidence of assent.
When a customer's agent clicks "I agree," decision 2's E-SIGN rule applies only if the agent's action is legally attributable to the customer. E-SIGN doesn't say when that is, and nothing above decides whether notice shown to an agent is reasonably conspicuous notice to the customer.
What can't platform terms do?
RFC 9309, the robots.txt standard, is blunt: "These rules are not a form of access authorization" (Section 1). The IETF's AI-preferences documents are working drafts, not RFCs, and equally voluntary. A term states what you want. It doesn't detect an agent, block one, or pay you when one misbehaves.
Breach and remedy are separate steps, and each remedy has its own elements:
- Breach of contract. In X Corp. v. Bright Data Ltd. (N.D. Cal.), a May 9, 2024 order dismissed X's access-based contract claim because X hadn't pleaded damage from that access. A November 26, 2024 order found that X's proposed complaint sufficiently alleged damages, so the claim could go forward at the pleading stage. The parties settled and dismissed the case with prejudice in June 2025, with no ruling on that claim's merits.
- Trespass to chattels. Under Intel Corp. v. Hamidi, 71 P.3d 296 (Cal. 2003), absent dispossession or physical damage, California requires impairment of the system or loss of its use for a substantial time.
- Maryland. Md. Code Ann., Crim. Law Section 7-302 bars accessing a computer "intentionally, willfully, and without authorization," and subsection (g) gives a civil action to a person who "suffered a specific and direct injury because of a violation." I found no Maryland appellate decision construing "without authorization" in that section, so don't assume a terms breach alone meets it.
Both X Corp. orders are district court rulings, persuasive only, and neither shows how a platform with specific agent language, facing logged-in access, would fare.
The suspension call. Say the purchasing lead's agent breaks your rate limit three mornings running, and she's one of your best buyers. Cutting the agent keeps the account. Cutting the account ends revenue and may start a fight over whether the customer accepted the agent rules.
Where the Perplexity case stands
Posture as of September 28, 2026. In Amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444, the Ninth Circuit found Amazon unlikely to succeed on the "access" element of its federal and California anti-hacking claims on the facts before it: "It is the user who 'accesses' Amazon's computers, with the help of the Assistant to carry out specific acts on Amazon.com." It vacated and remanded. That wasn't a final merits ruling.
The court left open whether, "on a different record or new facts," Perplexity could gain entry itself. It wrote, "We do not establish a new legal regime governing agentic AI," and didn't address tort claims. The opinion binds federal courts in the Ninth Circuit and is persuasive elsewhere. Footnote 5 preserves the terms-of-service route. It doesn't say any term will be enforced or is sufficient, or that a customer's acceptance binds the AI provider.
Rehearing en banc was denied September 10, and the mandate issued September 18. Amazon's September 21 First Amended Complaint adds a tortious interference claim over its customer contracts and alleges that, on Comet for iOS, Perplexity's own cloud servers used customers' authentication cookies to browse the store. Those are allegations, not findings. Whether an interference theory can reach an agent's maker is an open question.
Update (October 2026): On October 13, 2026, Perplexity moved to dismiss the amended complaint with prejudice and to stay discovery pending the motion (Dkt. 129). It argues that the Ninth Circuit's preliminary-injunction access reasoning binds the district court as the law of the case, and that the new Comet for iOS allegations leave that analysis unchanged because the user, not Perplexity, still does the accessing. On the tortious interference claim, Perplexity argues that because Amazon's customer terms are an at-will contract, Amazon must plead an independently wrongful act, and the only one it pleads is the same alleged anti-hacking conduct. It adds that Amazon hasn't identified a specific customer party or plausibly alleged acts designed to induce a breach. In the alternative, it asks the court to decline jurisdiction over the state-law claims if the federal claim is dismissed. These are Perplexity's arguments, not rulings. The court's September 30 scheduling order set November 3 as Amazon's opposition deadline.
Decision Framework
- Which customers already rely on agents, and what would a strict policy cost us?
- Who at a customer can switch an agent on, and how is it switched off?
- Would our current terms reach the specific agent conduct we'd want to stop?
- Can we show which version each customer accepted, and how?
- Can our change clause carry the next terms update? If it reads like the Cheek clause, fix that first.
Audience-Specific Implications
For Platform Founders and Operators
Put your agent policy on the product roadmap beside API access and pricing. Without in-house counsel, name one owner for the acceptance log, the update notice, and the traffic evidence.
Practical Takeaways
- Give product and engineering a three-column list before drafting: allowed, allowed with confirmation, prohibited.
- Decide who can enable and revoke an agent on a customer account. Responsibility is easier to explain when it follows the authority the customer set.
- Check the governing agreement's amendment process first. Where it permits or requires it, give existing customers a dedicated notice and an "I agree" step. A silent posting sits close to the Douglas facts.
- Log the customer entity, who or what acted, their authority, the agreement version, and the assent evidence. That's your proof in an acceptance dispute.
- Start capturing agent-session load and cost data. Hamidi and the first X Corp. order treat a violation and damage as separate questions.
Closing Perspective
My view: settle the permitted-use list first. The Perplexity case isn't over, and it won't write that policy for you.
A permitted-use list tells customers what they may automate. It also gives product and engineering a policy they can put into practice.
Sources
- Amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444 (9th Cir. Aug. 4, 2026), opinion, pp. 15, 17, 21 n.5; rehearing en banc denied, Dkt. 71 (Sept. 10, 2026); mandate, N.D. Cal. Dkt. 121 (Sept. 18, 2026).
- Amazon.com Services LLC v. Perplexity AI, Inc., No. 3:25-cv-09514-MMC (N.D. Cal.), First Amended Complaint, Dkt. 122 (Sept. 21, 2026), paras. 2, 6.
- Amazon.com Services LLC v. Perplexity AI, Inc., No. 3:25-cv-09514-MMC (N.D. Cal.), Defendant's Motion to Dismiss the First Amended Complaint and to Stay Discovery, Dkt. 129 (Oct. 13, 2026), ECF pp. 2, 19-20, 28-32; Order, Dkt. 125 (Sept. 30, 2026), ECF p. 5 (response and opposition deadlines).
- Berman v. Freedom Financial Network, LLC, 30 F.4th 849 (9th Cir. 2022).
- Douglas v. United States District Court (Talk America), 495 F.3d 1062 (9th Cir. 2007).
- Selden v. Airbnb, Inc., 4 F.4th 148 (D.C. Cir. 2021).
- Marshall v. Georgetown Memorial Hospital, 112 F.4th 211 (4th Cir. 2024).
- Cheek v. United Healthcare of the Mid-Atlantic, Inc., 378 Md. 139 (2003).
- X Corp. v. Bright Data Ltd., No. 3:23-cv-03698-WHA (N.D. Cal.), Dkt. 83 (order, May 9, 2024); Dkt. 156 (order re second amended complaint, Nov. 26, 2024); Dkt. 355 (stipulation of dismissal with prejudice, June 27, 2025).
- Intel Corp. v. Hamidi, 71 P.3d 296 (Cal. 2003).
- 15 U.S.C. Section 7001(h) (E-SIGN Act).
- Md. Code Ann., Com. Law Sections 21-101 and 21-113; D.C. Code Sections 28-4901 and 28-4913.
- Md. Code Ann., Crim. Law Section 7-302.
- RFC 9309, Robots Exclusion Protocol (2022); IETF AIPREF working drafts vocab and attach.
This article is for informational purposes only and does not constitute legal advice. Every company's situation is different, and you should consult with qualified legal counsel before making compliance decisions based on the developments discussed here.
