Singapore

United Requires Permission for AI Agents, Keeps Search Indexing

As of November 2026, United Airlines' answer to agents on its site is a written permission rule, and its answer to search engines is still yes. The airline's announcement of November 11, 2026 restricts third-party personal AI agents on united.com, in the app and through travel agencies and aggregators, while its updated website terms keep an indexing exemption for search engines. For anyone planning ai automation for business, the useful part is where the line sits: indexing is a read of public pages, an agent is a request to act, and only one of the two comes free.

Key takeaways

United's announcement of November 11, 2026 bars unauthorised third-party personal AI agents across its own platforms and through intermediaries, and its website terms require written permission before any automated agent may search, book or buy.
The same terms exempt search engines indexing public pages, so the crawl permission and the agent permission now live side by side in one document.
The airline's stated reason is not traffic control: it cites account and credential exposure and a risk that automated actions breach FAA and DOT rules.
robots.txt does not carry this rule. Amazon's block of Meta's Muse on September 20, 2026 came from its Conditions of Use, because Muse publishes no user agent string to name.
An agent project that expects a client to accept these boundaries needs a permission list, human confirmation points and an activity record before it goes live.

What United's terms actually say

The website terms were updated on the same day as the announcement. Three sentences carry the whole rule.

An Automated Agent is defined broadly: software, a service or a browser feature that, with full or partial autonomy, searches, books, buys or manages items on the United site or app, or extracts data from them. Bots, scrapers and extensions fall inside the definition, and so does an AI assistant whose actions a person supervises or approves.

No Automated Agent may access the site or app without prior written permission, and United reserves the right to block one at any time, whoever operates it. The terms also bar a second use of the data: fares, schedules, availability and pricing may not be used to train, fine-tune, ground, evaluate or otherwise develop an AI model.

The exceptions are the interesting part. Search engines indexing public pages of united.com are exempt. So are assistive technology and the standard browsers a person uses. Built-in agent features of a browser are not exempt. The terms do not say how they treat answers an AI system builds from search engine indexes, which is a gap the airline has left open.

Document	Who it binds	What it controls
Website terms	The person using the site, whoever runs the agent	Search, booking, buying, data extraction, and grounding on site data
Contract of carriage	The passenger who buys a ticket	Agents making, modifying or servicing a ticket, including through an agency
robots.txt	Crawlers that send a user agent string	Named crawlers only; as of November 14, 2026 it named no agent for any AI
Digital Trust Center FAQ	Customers reading the policy	What counts as unauthorised, and the trip research that stays allowed

The contract of carriage reaches further than the site. It adds using AI agents to make, modify or service a ticket to a list of prohibited practices that already includes hidden-city ticketing, and it lets United cancel improper bookings made, changed or serviced by agents without notice. Travel agencies and booking platforms are covered indirectly: they may not use third-party agents to search, book or manage United travel for customers, and they need United's permission before using their own third-party tools.

A human hand on a laptop trackpad while a robotic arm is halted by a line before the keyboard.

Why an airline is worried about agent actions

United's announcement gives a reason that has little to do with pageviews. Sharing account credentials with a personal AI assistant can expose sensitive information, and actions taken by those tools may cause unintended purchases, account changes or use of MileagePlus miles.

The second reason is regulatory, and it sets the outer limit of what ai automation for business can safely do in a regulated booking flow. United says automated AI actions have the potential to violate FAA and DOT regulations, and points to check-in: the process requires a human to acknowledge that bags contain no banned substances such as explosives. An agent that ticks that box on someone's behalf is not saving a step; it is removing the person the rule is written for.

That distinction explains the scope of the restriction. The airline restricted access directly in its platforms and indirectly via travel agencies and aggregators, and said the work includes updates to booking, ticketing and distribution policies. Its FAQ states that it does not work with any third-party AI agents yet, and that bookings agents made before November 11, 2026 will not be cancelled.

Planning a trip with an AI tool stays allowed, as long as the tool does not touch united.com or the app. So does a search engine indexing a public page. What the terms bar is an agent reaching into the site to act.

Why robots.txt cannot carry this rule

The obvious place to look for an agent rule is robots.txt, and at United it says nothing about AI. As of November 14, 2026 the file named no crawlers or agents for any AI, while the terms and the contract do the work.

That is not a gap the airline forgot to fill. Any ai automation for business plan that assumes a robots rule covers inbound agents runs into the same wall. robots.txt works by naming a user agent string, the label a piece of software sends when it requests a page, and then stating what that software may fetch. A personal agent that browses as the user publishes no such string.

Amazon ran into exactly this on September 20, 2026, when shoppers who sent Meta's shopping agent Muse to amazon.com received a block page saying continued access by an unauthorised AI agent violated Amazon's Conditions of Use. Meta's own description has Muse browsing in a Chromium browser session that appears as the user's activity, and Meta's crawler documentation lists no user agent for Muse. Amazon had no name to put in a rule, so it enforced the customer agreement instead.

How much Amazon's robots.txt could do when it did have names shows in the file: it declared 101 user agent blocks, nearly all of them carrying Disallow: /, the line that refuses an agent the whole site. ClaudeBot appears twice in the list, so the blocks carry fewer distinct names than they do lines.

The legal backdrop matters too. On August 4, 2026 the Ninth Circuit threw out a court order Amazon had won against Perplexity and ruled that the shopper, not the agent's vendor, is the one accessing the website. When Amazon asked the circuit to rehear the case en banc, which in that circuit means the Chief Judge and ten more drawn by lot, the request was refused, and no judge asked for a vote on it. What remained for Amazon was its own terms of service, enforced against the person who had accepted them, with an advertising business worth 68 billion dollars in 2025 resting on shoppers browsing its pages.

The lesson transfers to any site owner: a robots.txt rule is a signal to software that identifies itself, and terms of service is the control that binds the person behind the agent. Reviewing robots.txt, terms and bot protection together is the only way to see whether they agree on what an agent may do.

A security guard stands at a desk between a printed crawler list and a folder of signed terms.

Split the two permissions in your own policy

A policy that separates indexing from agent action is easier to write than one blanket block, and it is easier to defend when a partner asks why. The working model has two lists with different owners.

The indexing list is about reading public pages. It names the search engines you want, keeps crawl paths open, and states that the exception covers indexing only. United's terms are precise here: the exemption is for search engines indexing public pages, and it does not extend to answers an AI system generates from an index. If your site depends on AI answers citing you, an indexing exemption alone will not settle the question.

The agent list is about acting. It defines what counts as an agent, which is wider than most teams expect: a browser extension or a built-in browser feature can qualify, and so can an assistant a person is watching. It then states what an agent may do, who may operate one, and what happens when the rules are broken. United's version states that using an agent on the site counts as acceptance of the agreement by the user, by whoever runs the agent and by the person the agent acts for.

Question	Indexing list	Agent list
Who requests	A search engine crawler	A person, an agency or an AI vendor acting for one
What is allowed	Reading public pages	Searching, booking, buying, managing, extracting data
Where it is written	robots.txt, sitemaps, crawl policy	Website terms, contract, partner agreements
What happens on breach	Crawl is slowed or refused	Access blocked, bookings cancelled, account action
Who is bound	The crawler	The customer and anyone acting for them

Then check for the gaps that United's own documents leave. Two are worth naming. The terms do not explain how the airline detects an agent, so enforcement depends on a capability the announcement does not describe. And the terms say nothing about AI answers built from search engines' indexes, which is the exact risk a brand chasing AI citations cares about.

Gap g1: how a site separates crawler indexing from third-party AI agent action in its terms of service

Once the restriction is in the terms, the agent that still works is the one with a documented permission boundary. That is a design question, and it has an answer you can check before a line of code ships.

The brief put the question sharply: what may an agent do on a site that requires written permission, and how does an authorised agent differ from an unauthorised one? On United's documents the difference is not the quality of the automation. It is the identity of the party acting and the record it leaves. An authorised agent operates under a written agreement or a known name, acts inside a defined scope, and produces an account of what it did. An unauthorised one arrives without a name, may reuse the customer's credentials, and can trigger actions the site owner never agreed to.

A permission-bound agent, the same shape erp integration services need at the system edge, defines what data it can read and what actions it can take, as two separate lists. External messages, budget changes and order changes go through agreed approvals or pre-authorization rather than the agent's own judgement. Each workflow names its trigger, its inputs and outputs, and its human confirmation points. The handover evidence is a permission list and an activity log, so a client can see afterwards what the agent did and on whose authority it did it.

That is also what keeps a booking or ticketing agent on the right side of a rule like United's. The FAA and DOT example is instructive: a check-in step that requires a human acknowledgement cannot be delegated wholesale, but it can sit in the workflow as a confirmation point that stays with a person. The Agent handles the retrieval and the drafting; the acknowledgement stays with the customer.

A traveller taps a baggage declaration on an airport kiosk while an assistant icon waits beside the screen.

Topkee's view: permission is a delivery artefact, not a policy sentence

Topkee builds custom AI agents and the ERP and CRM integrations behind them on the rule that data has a source, execution has permission, results are acceptable and delivery is handover-able. In its service work, a project lists readable data and executable actions separately, sets human confirmation points for external messages, budget or order changes, and hands over a permission list and activity log alongside the code. That is how ai automation for business turns the boundary United writes into something a client can audit.

The integrations follow the same design, and they are where most of the work sits for a team working with an ERP. erp integration services start from the interfaces and permissions a client already owns. System work verifies the interfaces and permissions of a client's CRM, ERP, e-commerce and cloud services before an agent is allowed to use them, so an agent reads and writes through connections that were authorised by the client rather than through whatever it can reach. That is the practical version of erp integration services for a team that wants automation without handing an agent the keys to every system.

Topkee AI Agent is positioned as an agent layer that works on permission. It reads the materials it is given, matches tools to the task, and connects to already authorised business services under the runtime tenant identity, rather than crawling whatever it can find. The platform's own documentation keeps the same distinction for measurement: article completion, client approval, publication, indexing, ranking and AI citation are different statuses and are counted separately, which is the separation United has now written into its terms for agents and crawlers.

For both permissions, the tooling exists in the open. Topkee's Weber site builder generates robots.txt for a site, so the crawl side can be edited and reviewed in the same place as the pages, which is a useful habit when the agent side of the rule lives in the terms.

A checklist you can run today

Take this to the person who owns the terms, not just the SEO team.

Read your website terms for the word agent. If an automated agent, bot or browser feature is not defined, the terms cannot restrict one.
Read robots.txt and ask what it would do about an agent with no user agent string. If the answer is nothing, the terms must carry the rule.
Write down what counts as an agent in your business: a booking agent, a shopping agent, a browser extension, a built-in browser feature.
Write the two lists: what an agent may read, and what it may do. Put approvals in front of messages, budgets and orders.
Check whether your indexing exemption covers AI answers, not just crawling. United's terms leave that open, and yours may too.
Decide how you would detect an agent. If you cannot, say so internally before you publish a rule you cannot enforce.
Ask every agent vendor for a permission list and an activity log before signing. If the vendor cannot produce both, the boundary is a promise.

Where to start next

Two pieces of reading go with this one. The first is a look at how agent traffic already reaches your analytics and what changes when agents stop arriving under their own name, in AI Agent Traffic and Your SEO Plan. The second is the measurement problem after access is settled: 2027 Local Search: KPIs That Replace Rank Tracking sets out why a citation and a crawl are counted separately.

If the checklist turns up a workflow that has to run inside an approval boundary, the next practical step is a scoping conversation on the agent build itself, with the permission list and confirmation points fixed before development starts.

FAQ

What does United's rule actually ban?

Third-party personal AI agents and assistants that access united.com or the United app without prior written permission, whether they search, book, buy, manage or extract data. United also blocked access through travel agencies and aggregators, and prohibits grounding AI models on aspects such as fares, schedules, availability and pricing from its site.

Can search engines still index United's pages?

Yes. The website terms exempt search engines indexing public pages of united.com, and those terms were updated on the same day as the restriction announcement. The exemption covers indexing. It does not say how United treats answers an AI system generates from those indexes.

Why doesn't robots.txt handle this?

robots.txt can only address a crawler that sends a user agent string. A personal agent browsing as the customer publishes none, which is what happened with Meta's Muse at Amazon in September 2026. The enforceable control in that case was the site's Conditions of Use, an agreement with the shopper.

Does this apply to me if I run a small site or an internal agent?

The United terms bind whoever accesses United. For your own site the same question applies in reverse: who may act on your data, and how do you evidence it? A written permission list, human confirmation points for anything that sends, pays or changes, and an activity log cover most of what a serious buyer will ask about.

What is the difference between an authorised agent and an unauthorised one?

An authorised agent operates under a known identity or a written agreement, acts inside a defined scope, and leaves a record. An unauthorised one arrives without a name, may reuse the customer's credentials, and can trigger actions the site owner never agreed to. The difference is documented permission, not the quality of the automation.