What an agentic purchase or booking is (and why it already affects you)
Until now, when someone wanted something from your business, they did it themselves: they came to your website, chose a time or a product and paid. An agentic purchase or booking changes the main character: the person asks their AI assistant, and the assistant comes to your website to set it all up.
“Book me a table for four on Saturday at 9 pm.” The assistant checks your calendar, sees the free slots and prepares the booking. The same with “buy me the three-session pack”: it assembles the order and waits for the final word. AI assistants are moving from answering to doing.
The phrase “letting ChatGPT make bookings” sounds like a distant future, but the pieces are moving, and if your restaurant, clinic, salon or shop already takes bookings or sells online, this will reach you just as mobile phones once did. The question that runs through this article: opportunity, or a door left wide open?
The three reasonable fears: fake orders, tampered prices and an overloaded website
The three fears are reasonable, and they are real if there is no control:
- Fake orders. An AI books twenty tables “just in case” or confirms purchases nobody wants. Your calendar fills up with ghosts and you lose slots that real customers could have taken.
- Tampered prices. An agent “believes” it knows what something costs and submits €30 when it is €45, or applies a discount that never existed. You find out once a sale has already closed with the wrong number on it.
- An overloaded website, or odd visits. Agents with no limits that request and repeat until they overwhelm your site, or that attempt manoeuvres such as prompt injection: hidden instructions that get your system to do something it should not, like handing over your customers' data.
Notice that all three share the same root: letting agents operate without rules. The problem is not AI; it is AI let loose. And that is fixed with three very concrete rules.
Rule 1: an AI does nothing on your website unless you switch it on
Control starts with a switch that is off by default. Purchases and bookings by agents only exist if the business turns them on. Without explicit activation, an agent can read the public parts of your website — opening hours, menu, products — just as a browser reads them, but it cannot book or buy.
You decide whether, when and for which services. Perhaps you open dining-room bookings but not private events yet; or you enable purchases and leave bookings for later. And you can switch it all off whenever you like.
Before you decide, it helps to know what you are facing: how to tell whether AI agents already visit your website.
Rule 2: the person always confirms, or signs a mandate
The AI can prepare the whole operation: find a slot, choose a time, fill in the details. But the final step belongs to the person. There are only two valid routes:
- Explicit confirmation. The agent prepares the booking or the purchase and waits for the customer's “yes”.
- Signed mandate. The person signs a prior authorisation allowing the agent to act on their behalf.
Without one of those two routes, there is no booking and no purchase. That is what separates a deal done from a deal invented: if there is no person behind it saying “go ahead”, there is nothing.
Rule 3: the price is calculated by the server, never by the AI
An agent does not decide what anything costs. The price is calculated on your website's server at the moment the operation closes, using your current rates and conditions. The AI only passes the request on.
This is the rule that prevents tampered prices: it does not matter what the agent “believes” the set menu costs or what discount it has imagined. What counts is what your server calculates when the operation closes. If the result does not add up for the customer, there is no sale, and that is that.
And if an agent tries something odd: block first, ask later
The rules above work for agents that play fair. For the rest, there is the AI firewall: a doorman that inspects every request from an agent before it touches anything.
The first filter is a fast lane with no AI, deterministic: on every request it decides whether to allow it, block it or quarantine it. Anything suspicious for its content — an attempted prompt injection or a bid to extract customer data — is reviewed afterwards by a team of agents. And one detail changes everything: if no verdict is reached, the request is blocked. When in doubt, the door stays shut.
Whatever is judged to be an attack is learned as a rule for every website for 30 days: whoever causes trouble on one finds the door closed on the others. And privacy does not pay the price: the IP address is never stored in plain text, only a daily hash.
In practice: a table for four and a purchase with confirmation
The table. An assistant asks for a table for four on Saturday evening. The restaurant's website offers time slots and controls capacity: it only shows the times that fit four diners. The agent sees those options, prepares the booking and the customer confirms. If the restaurant required a deposit, the amount is set by the server. And if the restaurant has not switched on agent bookings, none of this happens: the agent just reads the menu and the opening hours.
The purchase. An assistant assembles the order in the shop — product, quantity, delivery details — and stops there. It waits for the customer's “yes”. When it comes, the server calculates the total and the payment is processed to the business's account. The agent never touches the price or the money.
In short, your checklist for staying in control:
- Know whether you already receive visits from agents.
- Decide what they may do (nothing, read, book, buy) and switch it on only if you want to.
- Require human confirmation or a signed mandate for every operation.
- Prices always calculated by your server.
- The power to turn off the tap whenever you like.
And it all starts with a website that assistants can understand without exposing anything that is not public: how to make your website readable for AI assistants without exposing data.
Frequently asked questions
Can an AI book or buy on my website without my permission?
It should not, and it cannot if the website is properly built: operations by agents require explicit activation by the business. Without it, an agent can only read what is public.
Who sets the price when the buyer is an AI: the AI or my website?
Your website. The price is calculated by the server at the moment the operation closes; the AI only passes the request on. That way there are no invented discounts and no outdated rates turned into a sale.
What happens if an AI agent tries to trick my website or extract my customers' data?
The agentic firewall intercepts it: the fast filter decides whether the request is allowed, blocked or quarantined; anything doubtful is reviewed and, without a verdict, blocked. Whatever is identified as an attack protects the rest of the websites for 30 days.
Can I let AIs read my website but not book or buy?
Yes: reading and operating are different permissions. You can have a website that assistants can read — opening hours, menu, products — and keep the bookings-and-purchases switch off until you decide.
If you want that control without becoming a security expert, WordNext Guardian sets it up for you: your website readable by AI assistants, operations by agents only if you switch them on, mandatory human confirmation and prices always calculated by the server. Take a calm look and decide.