An agent can book a hotel today. It can read the site, pick the room and pay with a card. That part works more often than people think.

What doesn’t work is a month later, when the traveler asks the same agent to move the dates.

Who allowed the agent to cancel? Does the hotel know the agent is acting for the guest, and not for someone pretending to be? If the new rate is higher, was the agent allowed to pay the difference? If the room is gone by the time the change goes through, who fixes it? And where is the record of any of this?

None of those are connection problems. The wires already exist: payment networks, booking systems, and a growing set of agent protocols, including the Personal Agent Protocol from Meta and Sierra. What doesn’t exist yet is agreement on what an agent is allowed to do, and proof that it stuck to it.

That’s the gap we think matters most. The pipes will be solved. Permission won’t solve itself.

Trust has two sides

Most of the conversation about trust is about the traveler. Will people let an agent book for them? Some early adopters already do.

The harder side is the business on the other end. A hotel, a tour operator or a card issuer has to decide whether to accept what an agent asks for. To do that, it needs to know three things: that the agent is acting for a real traveler, what that traveler allowed it to do, and that someone will answer for it if something goes wrong.

Three things that have to be true

A mandate. The traveler signs off on what the agent may do: what it can book, up to what budget, for which dates, and until when. Think of a company card with limits on it, except the hotel can check the limits for itself.

Common permissions. A mandate only works if the business reads it the way the traveler meant it. Card networks solved this decades ago with a shared list of merchant categories, which is why a card’s limits work at any merchant in the world. Agents need the same thing: one shared list of what an agent can be allowed to do, so a mandate set up in one place means the same thing everywhere else. The newest agent protocols list detailed permissions as work still to come. Travel should arrive with one list, not ten.

A record. What was allowed, what was promised, what was paid, and who confirmed it. Kept in one place for the whole trip, not scattered across the five systems a trip can touch, and checkable by someone other than the party that wrote it.

Authorized isn’t the same as acceptable

This is the part we think is most often missed.

A traveler can authorize an agent to do something that is still a problem at scale. Search every few seconds for a better rate. Hold rooms it may not take. Cancel and rebook every time the price drops. Each action is allowed. Together they cost the hotel real money, and they push suppliers toward stricter terms that end up hurting every traveler.

So permissions can’t only cover what an agent may buy. They also need to cover how often and how much. The supplier’s terms belong in the same decision as the traveler’s consent, and neither should be able to override the other.

Decide who fixes it before it breaks

In travel, the purchase is the easy part. Changes, cancellations and disruptions are where trust is won or lost.

When something goes wrong today, the question of who owns the problem is often answered at 2 a.m., by whoever picks up the phone. With agents booking across several businesses at once, that has to be decided at the moment of booking, line by line, and written into the record. A trip with a package, a tour and a hotel has more than one merchant. It should never have nobody responsible.

Open at the edges, governed in the middle

Does all this need a new central network, or an open protocol like email? We think the answer depends on the layer.

Connections should be open; anyone should be able to plug in. Money should ride the rails that already work. Identity will probably need a few trusted parties. And the rules that decide what each business receives, and what each agent may do, should be set by the travel brand that owns the customer relationship, using a vocabulary everyone shares.

Open at the edges. Governed in the middle. A few small things everyone agrees on.

How Tripian looks at it: content, context, clearance

We started with data. For years our focus has been making sure that what AI recommends to a traveler actually exists and can be booked. That’s still the foundation: more than 4 million places across 550+ destinations, validated continuously.

But data turned out to be necessary, not sufficient. Recommending isn’t completing. And completing a trip on someone’s behalf raises the question this piece is about: what is the agent allowed to do?

That’s how Nested Artificial Intelligence® is built, as three nested rings:

• Content: what exists. Places, products and offers, kept current.
• Context: what’s true for this traveler, right now. Where they are in the trip, what has changed, what matters.
• Clearance: what may be done. The rules of the traveler, the travel brand, the supplier and the law, reconciled before anything is released, booked or paid for.

Each outer ring can narrow what the inner rings make possible. It can never widen it. That one rule is how we think about agents too. An agent should never have more authority than the traveler gave it, and a sub-agent should never have more than the agent that handed it the work.

Content is becoming a commodity. Context is a race. Clearance is where agentic commerce will be won or lost. We’ll go deeper on each ring in the pieces that follow.

An invitation

We’re drafting a first version of common permissions for travel: what an agent can book, spend, share and change, and how often. We’d rather build it with the operators, platforms and payment providers who will have to live with it than hand it to them.

If that’s you, we’d like to hear what belongs on the list.

 

– Jeff Kischuk, Founder and CEO, Tripian