The change

Three of the most widely used companies in commerce and work software updated their terms for AI agents within a few weeks of each other. Walmart’s Terms of Use, last updated September 21, 2026, gained a new section on authorized agents. Google’s Workspace Service Specific Terms, last modified October 12, 2026, rewrote the section on Agentic AI Services. Stripe’s Link Virtual Card Terms, part of a Consumer Terms page dated September 30, 2026, gained a section on agentic transactions.

The products are different: a store, an office suite, and a payment card. The rule they write down is the same. When an AI agent acts for you, what it does is treated as if you did it, including when it gets something wrong.

What changed

• Walmart. A new definition of an “Agent” covers software that “autonomously or semi-autonomously accesses or interacts with the Walmart Sites” for you. A new section says “The Walmart Sites may permit you to use an Agent to browse, evaluate, or add items to a cart, or to make purchases on your behalf,” and that what an authorized agent does, “including purchases,” is treated as your own action.

• Google. Workspace customers were already “solely responsible” for “the actions and tasks performed by” an AI agent. They are now solely responsible for “any Agentic AI Action,” a new term that also covers an agent’s “omissions or failures to execute” tasks, and for any liability from “disabling or bypassing” built-in human confirmation steps.

• Stripe. The Link Virtual Card Terms gained a section titled “Agentic Transactions.” It says “Link may enable you and your Agent to use your Card with agentic transactions” and makes you responsible for those transactions “whether those transactions were intended by you or not.”

Walmart lets agents shop for you, and their orders count as yours

Walmart’s new section is the most detailed of the three, and it reads like a rulebook for a shopping assistant that buys on your account. The central sentence: “Actions taken by an Agent you have authorized, including purchases, within the scope of the permissions you granted, will be treated as actions taken and authorized by you, and you will be responsible for them to the same extent as if you had taken those actions yourself.”

The section then sets out who carries what:

• Watching the agent is your job. “You are responsible for monitoring the activity of any Agent you authorize and for promptly notifying us if you believe an Agent has acted outside the scope of your authorization or without your permission.”

• Misunderstandings are not Walmart’s problem. Walmart “is not responsible for the conduct, acts, or omissions of any third-party Agent, including any inaccuracy in the Agent’s understanding of your instructions.”

• Walmart can step in. It “may impose limits on the value, quantity, or frequency of purchases” made by an agent, and it may decline or reverse a transaction “that we otherwise believe may not reflect your intended purchase.”

• Your data goes to the agent. Authorizing an agent means you “consent to Walmart sharing the account, order, and transaction information reasonably necessary for the Agent to perform the functions you have authorized.”

• You can switch it off. You may revoke an agent’s access “at any time through your account settings,” which immediately invalidates its tokens.

The definition also carves out one group. An “Agent” does not include “assistive technologies that enable human users with disabilities to access and interact with the Walmart Sites.” The update came 12 days after the September 9 version, in which Walmart stopped promising in-store prices on pickup orders.

Google now counts what an agent fails to do

Google’s change is aimed at companies rather than shoppers, and it touches a tool almost every SaaS team already uses. Workspace customers already carried responsibility for the actions and tasks their AI agents perform. The new definition of an “Agentic AI Action” is “any action or inaction of or attributable to an Agentic AI Service or AI Agent,” including “omissions or failures to execute such tasks, interactions, or other functions.” An agent that forgets to send a file, or skips a step, is now inside the customer’s responsibility in so many words.

The new paragraph on safeguards adds a second layer. “Certain Agentic AI Services may be configured by default with safeguards that require human confirmation before executing certain operations.” If a customer turns them off, the customer “is solely responsible for any liability arising from disabling or bypassing any of these safeguards.” Google also now disclaims “all liability” for agents a customer builds and for third-party agents, and its indemnification obligations do not apply to claims about them.

Stripe brought its agent rule to the Link card

The Link Virtual Card Terms cover a card you can use through Link, Stripe’s consumer wallet. The new card section says that, as between you, Stripe, and the bank that issues the card, “you are responsible for all Agent-initiated transactions as if you had taken the action yourself.” Connecting an agent counts as authorizing it to transact for you, “whether those transactions were intended by you or not; those transactions were caused by bugs, hallucinations and/or misinterpretations; or those transactions differ from your provided instructions.” The one exception is a transaction that results from Stripe’s “technical failure or error.”

The wording is not new to Stripe. Almost the same sentence already appears in the Link Agentic Terms that Stripe introduced in April, when it carved agent purchases out of its unauthorized transaction protections. What changed is where it sits: it now also governs a payment card. In September, Stripe’s main terms also made users responsible for their AI agents, as we covered when Stripe’s terms made AI agent actions legally binding on users.

What did not change

• Walmart still requires arbitration on an individual basis for disputes, as the top of its Terms of Use states.

• Google’s terms still give the customer the job of deciding whether an agent fits its use case, authorizing what it can connect to, and supervising it in production.

• Stripe still excludes the one case where its own technical failure or error caused the transaction.

• Stripe’s Link Agentic Terms, the April rules for agent payments, still contain the same wording on “bugs, hallucinations and/or misinterpretations.”

Why this matters

AI agents are moving from demos into checkout pages and office tools, and the terms are settling on one answer to the question of who pays when they get it wrong. It is the person or company that turned the agent on. OpenAI took the same position when its terms for dots made users responsible for what they do, and so did X when its new terms made users answer for autonomous features.

For a SaaS company, this reaches further than one store or one card. Employees try AI assistants that browse and buy, admins switch on agents in Workspace, and company cards end up connected to tools nobody reviewed. Each vendor puts the risk on the account holder in its own document, and keeping track of them is part of vendor contract monitoring even when nobody signed anything.

Potential impact

For a company whose people use AI agents at work, the update raises five practical questions:

• Which AI assistants or agents can make purchases with a company card or account, and who approved them?

• Are human confirmation steps in Google Workspace agents still on, and who is allowed to turn them off?

• Do your expense rules say who pays for a purchase an agent made by mistake?

• Does anyone review what agents did, as Walmart’s terms expect the account holder to do?

• Who would notice the next vendor that adds a section like this to its terms?

How Venpo detected it

Venpo monitors the terms of Walmart, Google, and Stripe and flagged each of these sections when it appeared. Every quote in this article was checked against the redlines and the live pages. The records are on the Walmart change page and the Stripe change page.

Business outcome

Teams that track these vendors saw the new agent sections next to the text they replaced, within the same few weeks. That is enough to set a policy for AI agents before the first mistaken purchase rather than after it. Spotting a pattern like this across vendors is the difference between manual and automated vendor monitoring.

Key takeaway

Walmart now lets AI agents shop for you and treats their orders as yours, Google made Workspace customers answer for what agents do and fail to do, and Stripe extended its rule on agent mistakes to the Link card, so the safest assumption is that any agent you switch on acts in your name.