AI agents in ecommerce: a readiness checklist.
Five areas to audit before AI agents shop your catalog at volume. Each item is something a retail team can verify this quarter without new tooling.
How to use this
Work through the areas in order. The first two determine whether an agent can read you at all; the last three determine whether you can prove what happened afterwards. Score each item as met, partial, or unknown — the unknowns are usually the most informative result.
1. Product data
- Every purchasable variant has an unambiguous identifier and title in the served HTML.
- Price, currency, and availability are present as structured values, not only as rendered UI.
- Feed freshness has a known lag, and someone owns it.
- Return, shipping, and warranty terms exist as text an agent can extract, not only as an icon.
2. Storefront delivery
- Primary product content is in the server-delivered HTML, verifiable in raw view-source.
- Product pages respond without requiring cookies, consent interaction, or client-side navigation.
- Rate limiting and bot rules do not silently drop provider-documented fetchers you intend to allow.
3. Cart and checkout
- Checkout does not depend on interactions that only a human browser session can complete.
- Risk rules are reviewed against agent-initiated request patterns, not only human session patterns.
- Failure modes are observable: you can tell a declined agent checkout from a silent drop-off.
4. Logging and measurement
- Server, CDN, or application logs retain user-agent, path, referrer, and timing long enough to analyze.
- Log-origin request events can be joined to the storefront surface they hit.
- You can report the share of eligible request events that remain unclassified after labeling.
5. Crawler and agent policy
- robots.txt reflects a deliberate decision per provider-documented token, not an inherited default.
- Allow and disallow choices are reviewed by the team that owns demand, not only by security.
- Identity claims in user-agent strings are treated as claims until verified.
What comes after the audit
Most teams finish this checklist with a short list of unknowns in the logging row. That is the starting condition Cartograph is being built for: turning log-origin request events into a labeled evidence set, and reporting the unclassified remainder honestly as an Unidentified Traffic rather than inferring intent that was never observed.