United just banned AI agents from booking flights. The rule it is really writing applies to every regulated company.

On November 11, 2026, United Airlines changed its Contract of Carriage. A new Rule 6.J.6 lists "the use of AI Agents to make, modify or service a Ticket, and/or to purchase any service or product" as a prohibited practice, next to hidden-city ticketing. United can cancel reservations an AI agent makes. Bookings made before November 11 stand.

The ban is narrower than the headlines. AI assistants can still search United flights and show fares. The traveler has to complete the purchase.

One detail in the definition matters more than the rest. United counts software as an AI agent when it takes autonomous or semi-autonomous action, even when a person supervises or approves it. A human clicking "yes" does not make the action safe in United's eyes.

Why United drew the line where it did

United's statement names the problem in plain words. Sharing account credentials with a third-party AI assistant can expose sensitive information. Actions the assistant takes can cause unintended purchases, account changes, or use of MileagePlus miles.

Read that list again and it is four separate gaps:

1. Identity. The agent is logged in as the customer, with the customer's password. United cannot tell who is acting.
2. Authorization. Nothing limits what the agent may do once it is in. Search, buy, change and redeem all look the same.
3. Intent and consent. A purchase the traveler did not mean to make is still a purchase.
4. Accountability. When something goes wrong, there is a chat log somewhere else, not a record United can stand behind.

None of these is about whether the AI is smart. They are about what happens when an AI acts on a system of record with no rules enforced at the moment it acts. That is a runtime enforcement problem, and a ban is the bluntest way to solve it.

United added a fifth reason, and it is the most important one for any regulated business. According to The Wall Street Journal, United said automated AI actions could break FAA and Department of Transportation rules about what airlines must present to customers. An AI agent cannot attest at check-in that a bag holds no explosives. Some steps exist because a specific person has to see something and confirm it. An agent acting on its own cannot do that, no matter how capable it is.

This is not only about airlines

United is the first US carrier to put AI agents in its contract, but the pattern is wider. Banks, retailers and travel sites are already blocking personal AI agents from acting inside customer accounts. United's CEO, Scott Kirby, put the business reason plainly: "I don't want to create another middleman." Every regulated business will face the same request soon: a customer's AI wants to change an address, file a claim, move a payment or redeem points.

The question is not whether AI agents will start regulated work. They already do. The question is what checks run between the agent and the system of record.

What United says it wants instead

United did not say "never." It said it wants standardized, secure integrations with privacy, authorization and accountability built in, before it lets agents transact.

Delta is taking the other path. It told The Wall Street Journal that authenticated AI assistants can complete bookings, with extra safeguards for sensitive transactions such as trips for unaccompanied minors. But even the airline letting agents in has a reported case of the gap. A Delta Platinum Medallion member says Delta's own AI Concierge told her that her return flight would stay booked, while the backend canceled both segments of her trip. The conversation said one thing and the system of record did another, and nothing sat between them to check. Guardrails on the AI reduce mistakes like this. They do not eliminate them. That is why the action itself should be executed by a deterministic layer that applies the same rules every time, and why the AI should only report a change as done once the system of record confirms it. United, for its part, says its systems can already tell whether a booking came from a person, a travel agency or an AI agent.

That is a precise description of a governed door:

• The agent is a door, not the finish. The AI starts the request. A governed process finishes it.
• Scoped access, key by key. Read and write are switched on separately. Some actions, like buying or redeeming miles, are marked as tools no AI may ever call.
• Sensitive steps on a secure screen. Identity checks, payment and consent move out of the chat to a screen the process controls, prefilled with what the agent gathered. The traveler confirms rather than repeats.
• Every action checked before it runs. Policies are evaluated at runtime, and a deterministic decision follows: execute, execute with safeguards, escalate to a person, or block.
• A record for every run. A Decision Trace shows why the action was allowed and which agent started it. An Audit Trace shows every step and what was written.

The same booking, governed

Here is how the flight change United is worried about runs with runtime enforcement in place:

1. The traveler asks their AI assistant to move a flight. The assistant finds the options and shows fares, which United allows today.
2. The assistant hands off to the airline's own secure screen, prefilled. It never holds the traveler's password.
3. Paying with miles triggers an identity step-up, because loyalty redemptions are a known fraud target.
4. The traveler confirms the fare difference and accepts the fare rules. That is the consent, captured on the airline's screen.
5. The change is written to the reservation system, and the record shows the agent started it and the traveler approved it.

The AI did what it is good at. The regulated part ran under the airline's rules.

Where to go from here

If you run regulated processes, United's move is a preview of the question your board will ask: what stops an AI agent from doing something it should not do, in our name?

• See how runtime enforcement works in travel, and across every industry we serve.
• Browse the travel processes we run, including loyalty redemption, loyalty fraud and name corrections.
• Read how to connect an AI agent to a system of record safely.
• See how your own AI starts governed work through AI Agent Completion.

AI agents will keep asking to act. The companies that win will not be the ones that ban them longest. They will be the ones that can say yes safely, because every action is checked before it runs and recorded after.