United Airlines writes an AI-agent ban into its contract of carriage
United Airlines announced on Nov 11 2026 that it's banning unauthorized third-party AI agents from making, modifying, or servicing tickets. It's not a blog post. It's not a footnote in the terms of service. It's an amendment to United's Contract of Carriage. You know, the legal contract that governs all the tickets United sells. So United is serious about it. It wants to make the ban stick. It doesn't just want it to be a suggestion.
This is a weird time for the agent web. Agentic browsers, comparison, and transaction tools are starting to move out of demo mode and into consumer usage. One of the first areas where agents can potentially save people money is in travel. So the first big US carrier to officially ban them is United. They have a mix of good security and regulatory concerns, and a commercial interest in not having their back-end used for someone else's interface.
What United actually changed
In the new Contract of Carriage, there's a new rule. Quoted in the news coverage as Rule 6.J.6. Banning "the use of AI Agents to make, modify or service a Ticket, and/or to purchase any service or product." There's also another rule, 5.H. United can cancel reservations made or managed by AI agents without notice.
United's definition of an AI agent is quite broad. It includes AI assistants integrated into messaging or social platforms, standalone agents, and AI-enabled browsers. United is banning AI agents on its website and app. They say it will also limit access indirectly via travel agencies and aggregators. In other words, United isn't just banning agents at its front door. It's trying to also shut the side doors. So that agents can't get at the same inventory.
The most interesting thing is that this ban includes situations where a person is supervising the agent. Or giving permission to the agent. So the "person in the loop" defense isn't going to work. United's position is that it's banning the act of the agent making or servicing the ticket. Who ever hit the last button doesn't matter. They won't cancel existing bookings made by agents before Nov 11 2026. At least that's what's on United's help center page. So they're softening the retrospective effect. But not the forward-looking effect.
Why an airline cares
United has a few buckets of concerns. First is account security. When you share a login with a third-party agent, you're exposing sensitive information. Plus, United warns that the actions of the agent "may result in unintended purchases, account changes or use of MileagePlus miles." That's a real concern. Because an agent with stored credentials has the same rights as the account holder. And the account holder may not know what they're allowed to do.
Second is regulatory compliance. Airlines are governed by Federal Aviation Administration (FAA) and Department of Transportation (DOT) rules. Some of these rules require a human acknowledgment at certain points. The most obvious example is check-in. In 49 CFR 175.25 airlines are required to inform passengers about prohibited dangerous goods. And passengers must acknowledge that they've been informed. If an agent is doing check-in for someone, United says that the required acknowledgment might be omitted.
Third is commercial. United CEO Scott Kirby said at an event in Chicago that he didn't want "to create another middleman." That's a clear statement of strategy. Airlines have been trying to own the direct relationship with travelers for years. They want to reduce their reliance on distributors. When an AI agent acts as an intermediary between the airline and the customer, comparing fares across airlines. And capturing the interaction. That's a new kind of middleman. And United doesn't want to subsidize it.
There's also a cost concern. Flight searches cost the airlines money. That's what aviation analyst Henry Harteveldt told CBSNews. If personal agents are doing thousands of flight searches for users, for all these different flight combinations. Airlines might see a lot more automated traffic. Without proportionally more bookings. Banning agent transactions doesn't stop the searches. But it does reduce the incentive to develop agents that pound on the airline systems.
The check-in problem is the strongest argument
The most defensible of United's concerns is the hazmat acknowledgment. The hazmat rule is there for safety. Not for commercial advantage. And it's associated with a particular interaction. An interaction that's supposed to be performed by a human. An agent that's doing check-in for someone without surfacing the prohibited items notice. It's not just skipping a form. It's also skipping the safety communication. Which is required by the regulators.
But the argument is less compelling. Because you could have the agent surface the notice. And require the passenger to acknowledge it before continuing. It's a technical problem that can be solved. What United is really saying is that they don't trust third-party agents to get the acknowledgment right. And there's no way to check. For the current state of agent tooling, it's a reasonable concern.
The security concern is strong. But it's not unique to AI. A travel agent or corporate booking tool or a script with stored credentials. They can also result in unintended purchases. The difference is that it's on a larger scale. And there's more opacity. Agents can act quickly. And in lots of sessions. Without a human reviewing each confirmation. More liability for the airline. The more things they can't audit that are automated.
The delegation question
The real issue is with delegated authority. When a person books a ticket. They're exercising their own legal capacity. When an agent books a ticket for them. The agent is acting as a delegate. So what authority have they actually been given? Right now, most agents are working by borrowing the user's credentials. So you've got authentication (who are you) and authorization (what are you allowed to do). That's a bad model for high-stakes transactions.
The alternative is scoped, revocable delegation. So you have a protocol where a user can give an agent permission to search/compare. But not to buy. Or to buy up to a certain amount. For a certain period of time. With an audit trail. It's analogous to OAuth. OAuth was a way to replace password sharing for third-party apps. By issuing tokens with explicit scopes. That can be revoked. We need something similar for agent authentication. And the travel industry is a good place for it. Because the transactions are high-value. And the regulatory requirements are concrete.
So United's ban doesn't provide that protocol. It creates an incentive to develop it. By banning credential sharing explicitly. It forces agent developers to ask for a real delegation mechanism. Instead of just borrowing someone's password. This is a good kind of friction. Even though it might temporarily block useful tools.
If you're developing agent infrastructure. This is a design lesson. The hard part of delegation isn't the token format. It's the policy. Your scoped token is only useful if the relying party can express in their domain what that scope means. "Book a flight" isn't a scope. "Search fares. Hold a reservation for 24 hours. And purchase up to a certain amount with a named passenger." That's closer. United's rule is a blunt no. But it's pointing towards the granularity you'll need eventually.
How would United enforce it?
The hard part of any agent ban is enforcement. It's hard to detect agents. A sophisticated agent can act like a human browser. It can pace its requests. It can deal with the challenges that bot detection throws at it. United can block known AI-enabled browsers. And known agent traffic patterns. But it's a cat-and-mouse game. The airline has to be right all the time. The agent developer just has to be right once.
The long-term enforcement is at the transaction level. United can require human confirmation at the payment. And the regulatory acknowledgment. They can mark accounts that are behaving in an automated way. They can use their contracts with travel agencies and aggregators to enforce the restriction further downstream. Which is why they mention indirect access. United has legal cover in the Contract of Carriage. They can cancel suspicious bookings retroactively. Which is a deterrent. Even if it's not perfect detection.
So the combination of policy. Plus partial technical enforcement. Plus retroactive cancellation. That's probably the best an airline can do at this point. It won't stop all agents. But it makes it more expensive. And more risky. So it changes behavior. The question is, does it also prevent legitimate use cases? Like accessibility tools to help a disabled traveler make a booking.
The accessibility exceptionThis is where United's policy might come into conflict: accessibility. From a technical perspective, things like voice assistants, screen readers, etc. are really agents on behalf of a user. So a blind person using a voice assistant for booking isn't the threat model here. But it's entirely possible that a ban on third party agents might include this use case too. United will need to be able to separate out an accessibility tool from a general purpose agent. But that's not an easy thing to do.
And this goes for corporate travel tools or even just human assistants who book on your behalf. Those are all things that are covered by existing rules and contracts. I assume United doesn't want to ban them. But it seems that they have a specific category in mind. That's "personal AI agents" as they're emphasizing. But it's hard to enforce categories based on intent in software. The more explicit you can make the definition, the more likely it is that you won't accidentally ban something that is a legit tool.
So this is the part of the story that matters most for travelers. It's easy to get behind a policy that bans autonomous agents from making unauthorized purchases. But it's a lot harder to get behind a policy that also bans a disabled traveler from using the assistant they want. United hasn't told us which of those it's going to do. And that will depend on how the implementation treats exceptions.
What it means for the agentic web
United's move is a sign that the agentic web won't be a one-size-fits-all thing. Some categories like search/compare are fairly open. But other categories like regulated commerce will be locked down by incumbents that control the transaction and take on the liability. Travel is a leading indicator in that regard. It's high value transactions with complex inventory and strict consumer protection laws.
So the end result probably won't be a blanket ban. It'll be a negotiation. The airlines want direct relationships and compliance with regulation. And agent developers want programmatic access and a good user experience. So the middle ground is a delegated authority standard. With clear scopes, audit logs, and a way for the airline to confirm that the human gave the nod to what the law requires. The company that comes up with that standard will have a huge impact on the way agents transact for a long time.
In the meantime, expect more policies like this one. It's easy to copy this pattern. Change up the contract. Define the agent broadly. Ban the transaction. And then give yourself the right to cancel. Whether other carriers copy United or go in a more permissive direction will depend on their level of fear of disintermediation vs the value of the incremental bookings that agents can deliver.
Conclusion
United's change to the Contract of Carriage is a thoughtful, legally sound effort to prevent third party agents from entering the flow of their transaction. Sure. The security and safety concerns are there. Especially with that hazmat acknowledgment at check-in. But there's also a commercial reason. This ban isn't so much anti-AI as it is an anti-letting-someone-else-own-the-customer-relationship-without-our-permission.
The important thing to take away for anyone building agents is that credentials aren't a delegation strategy. For high stakes transactions you're going to need explicit, scoped, revocable authority. And the companies that control those transactions have the legal tools and incentives to make that a requirement. United has drawn a line in the sand. Now it's up to the agent developers and standards bodies to figure out what to do next. And how they answer that will determine whether the agentic web will be able to integrate with regulated commerce. Or if it'll have to find ways to go around it.
Sources
- United Airlines, third-party AI agents help page: https://www.united.com/en/us/fly/help-center/digital-trust-center/artificial-intelligence/third-party-ai-agents.html
- United Airlines Contract of Carriage: https://www.united.com/en/us/fly/contract-of-carriage.html
- Simple Flying, "United Airlines Officially Bans AI Agents From Booking Your Flights And Checking You In": https://simpleflying.com/united-airlines-bans-ai-agents-booking-flights-check-in/
- The Wall Street Journal, "United Airlines Is Banning AI Bots From Booking Flights": https://www.wsj.com/tech/ai/united-airlines-is-banning-ai-bots-from-booking-flights-5b514b38
- CBS News, "United Airlines bans AI agents from booking flights": https://www.cbsnews.com/news/united-airlines-bans-ai-agents-booking-flights/