Agents can find your store. They cannot buy from it.

The drop-off is present at every one of the six stages, and it is largest at the cart: of 43 ranked stores, 36 were reached at discovery (84 per cent), 30 at product (70), 17 at cart (40), 9 at checkout (21), 6 at a form (14) and 5 at payment (12). The largest single collapse is the cart, not the checkout. The published findings also name the specific walls behind individual stores, including an OTP wall at Foxtale and a broken payment flow at Blue Tokai Coffee.

It does not show that a governance layer is what these stores would buy. The sample is small, self-selected and Indian D2C storefronts, and one agent was used rather than a population of them.

A large merchant and consumer survey puts SMB agent readiness at 11 per cent versus 19 per cent for large merchants, with 15 per cent of merchants holding agent-ready structured data, while 68 per cent expect agents to be at least 5 per cent of digital sales within two years. Fraud protection is the top stated condition for merchant participation, and only around 23 per cent of merchants can clearly distinguish AI-driven traffic at all.

It does not show that SMBs will pay a third party for readiness tooling, and the gap it describes is one the platforms themselves are actively closing.

The platform already ships per-partner controls deciding whether an agent may read product data, may complete checkout, or neither, alongside least-privilege and secure-action-layer guidance aimed squarely at this merchant segment.

Platform-native controls are configuration inside one platform. They are not an independent cross-surface view, and they do not give a brand a record it holds or can audit without the platform.

The default posture at the largest commerce platform is to block automated agents outright — including buy-for-me agents and any end-to-end flow that reaches payment without a final human review step — on the stated grounds that no one wants to be where the agents are shopping. Blocking is a platform policy decision, not a merchant one.

It does not quantify what a blocked agent would have converted at, and it is trade-press reporting of a policy rather than a measured market outcome.

A named brand blocks agent traffic specifically because it distorts the conversion metric, and reports that blocking does raise conversion. This is the clearest available statement of the trade a small brand is being forced into.

One brand, self-described as early-stage in its understanding. It does not size the revenue forgone, and a cleaner conversion number is not the same as a better business.

Brands are already tracking referral traffic arriving from AI interfaces, and that traffic is converting at up to six times the rate of ordinary organic search — from an absolute base most retailers still measure below one per cent. The direction is real; the volume is not yet material.

It does not establish that the base will grow, that a small brand captures any of it, or that the multiples hold outside the retailers surveyed.

Almost every abandonment traces to a small number of concrete failures — edge bot rules, a different page served to the agent, a buy action that only exists after JavaScript runs — and a store that blocks crawlers cannot score well however good the rest of it is.

It is a vendor describing a product that scans for these failures, and the severity ceilings in its rubric are its own construct rather than an industry standard.

Price, image and in-stock is the gate: miss any one and an agent cannot sell the product at all, regardless of how good the storefront looks. A well-designed store in the documented example still left 47 per cent of products unready.

A vendor scoring rubric, not an independent benchmark, and readiness scores are not revenue.

Direct product feeds give agents structured, current product data that web crawling alone does not, and agentic commerce suites let retailers syndicate a catalog across supported agents without building separate integrations. Retailers are running explicit test-and-learn programmes to track how products are found, recommended and purchased across AI surfaces. This is the mechanism by which a small brand becomes reachable without building separate integrations.

It does not establish that any of those surfaces will send a paying customer, and a catalog being readable is not the same as a purchase being completable.

The control pattern is settled: a dedicated agent principal with a named owner and purpose, task-scoped least-privilege roles, just-in-time elevation rather than standing access, allowlisted tools, and end-to-end auditability of the action rather than the response.

It is written for enterprise identity estates. A two-to-thirty-person D2C brand has no such estate, which is the gap this thesis is about.

Agent identities are treated as distinct verifiable entities with their own provisioning and decommissioning, scopes are task-bound and ephemeral rather than broad and persistent, and accountability runs through a human delegation chain recorded in a tamper-evident trail.

The framework assumes an identity platform already in place. It does not address a merchant who has none and is currently deciding between blocking everything and admitting everything.

Across enterprise roundtables, roughly nine in ten reported agents running with no governance visibility and eight in ten reported shadow AI already present — the identification problem is widespread, not exotic.

Enterprise roundtable sentiment. It says nothing about small merchants, and it is evidence that visibility is wanted, not evidence of what anyone will pay for it.

A crawler refused at the edge never reaches the application, so nothing about the storefront itself is wrong and nothing in the markup says so.

Server logs and the agent's own report — never in a markup audit.

Some stores serve declared AI user-agents a thinner or altered page, so the agent can see the product and still not find the price, the stock or the buy action it just watched a human version display.

A differential fetch: once as a browser, once as a declared agent, then diff.

The agent can describe the product perfectly and still have no machine-readable way to act on it. A perfectly good page is not a transactable one.

Raw HTML inspection — hidden from any rendered-page audit.

An account-level control applied to all automation. In the ARI run, Foxtale stopped at checkout on an OTP wall despite being reached at every other stage.

Nowhere in the storefront. It is an account setting, not a page.

A store can be fully transactable and still fail at the final step because a payment option is broken or unsupported. In the ARI run, Blue Tokai Coffee was recorded with a broken payment flow.

Only at the moment of payment, after everything else has already succeeded.