When I started building AI agents for travel, I thought the hard part was making the agent understand what the user wanted.
Turns out, that was the easy part.
Today, an agent can understand something like “Find me a nice hotel in Tokyo next Friday, under $200, close to Shibuya” pretty well. It can search, compare, rank options, explain the differences, and even tell you which one it would pick.
Then the user says: “Cool. Book it.”
And suddenly, things get interesting.
Search Is Easy. Booking Is Not.
Finding a hotel and booking a hotel are two completely different problems.
If the agent recommends the wrong hotel, I can just ignore it. No real damage done.
But once the agent starts booking, things change. Now it’s dealing with real inventory, real money, cancellation policies, room types, payment methods, and actions that might not be reversible.
And payment? That’s another level entirely.
As a developer working on travel MCP infrastructure, I’ve started thinking a lot about where we should draw the line between what an agent can do and what an agent should be allowed to do.
Autonomy Shouldn’t Be an On/Off Switch
I don’t think the future is going to be “AI does everything for you.”
I think it’s going to be “AI does everything it is authorized to do.”
That sounds like a small difference, but from an engineering perspective, it’s huge.
Imagine I tell my travel agent, “Book me a hotel in New York for two nights.”
What exactly did I authorize?
Can it spend $150? $300? $1,000?
Can it choose a non-refundable room?
Can it upgrade the room because it thinks I’ll like it?
Can it use my saved payment method?
Can it accept a hotel policy that I never explicitly saw?
Humans are surprisingly good at filling in these gaps when dealing with another human. Software is not.
And AI agents are sitting somewhere in the middle. They’re good at interpreting vague human instructions, but they also have access to tools that can create very real consequences.
That’s where I think the transaction boundary becomes important.
Not All Tools Are Equal
For me, there are different levels of action.
Searching is one thing. Recommending is another. Selecting something is another. Creating a booking is another. Paying is another. Cancelling or modifying an existing transaction can be even more sensitive.
They may all look like “tools” inside an MCP server, but they definitely shouldn’t all have the same level of permission.
This is one reason I’ve become more interested in MCP as an infrastructure layer rather than simply a convenient way to connect LLMs to APIs.
If an MCP server exposes searchHotels, that’s mostly about giving the agent information.
If it exposes bookHotel, it’s giving the agent the ability to change external state.
Those are fundamentally different capabilities.
And I think future agent infrastructure will need to make that difference much more explicit.
Instead of simply asking, “Does this agent have access to the booking tool?”, we should be asking:
“Under what conditions can this agent use the booking tool?”
Maybe I’m okay with the agent booking anything under $200.
Maybe I’m okay with it booking a refundable room automatically, but I want confirmation for non-refundable rates.
Maybe I’m fine with automatic booking for business trips, but not personal travel.
That’s a much more realistic definition of autonomy.
The Same Problem Exists Everywhere
This isn’t unique to travel.
An AI shopping agent can search for products. Easy.
It can compare prices. Still easy.
It can add something to a cart. Fine.
But should it click “Buy Now” because it thinks the product matches my preferences?
Maybe.
An enterprise agent can draft an email. No big deal.
But should it send that email to 100,000 customers?
Definitely a different question.
The pattern is always the same:
Retrieving information is not the same as taking action.
And taking action is not the same as taking an irreversible action.
The Real Test Starts at “Book It”
This is also why I think the “last mile” of AI travel is going to be much harder than the demos make it look.
The demo usually ends with a beautiful itinerary and a list of hotels.
The real product starts when the user says:
“Okay, book it.”
At that point, the agent has to deal with real inventory, real prices, real payment, real cancellation policies, supplier failures, timeouts, and all the wonderfully annoying edge cases that exist in travel.
The model can be extremely smart and still fail if the underlying transaction infrastructure isn’t reliable.
So when I think about building travel agents now, I’m less interested in making the agent “fully autonomous.”
I’m more interested in making it appropriately autonomous.
Let the agent search without asking me.
Let it compare without asking me.
Let it make recommendations without asking me.
But when it’s about to spend money or create an irreversible commitment, the system should know exactly what it has permission to do — and when it needs to stop and ask me.
**The Question I Keep Coming Back To
**To me, that’s a much more useful way to think about agentic commerce.
The question isn’t really:
“How much can we automate?”
It’s:
“How much authority should we give the agent?”
And honestly, I think that question is going to matter just as much as model intelligence over the next few years.
Because the smartest agent in the world is still not very useful if we can’t trust it with the last click.
Top comments (0)