United: who authorizes the agent’s action at its destination?
Permission given to an assistant needs to be checked against the rules of the service receiving its action. Use the United case to review destinations, intermediaries and evidence in enterprise agent workflows.
Ler em portuguêsBy Pentesty
The verified facts and this analysis’s scope
The United contract, revised November 11, 2026, includes semiautonomous actions in its agent definition, even under human supervision. It prohibits agents from issuing, modifying or servicing tickets and from purchasing products or services.
The website terms require prior written permission for automated agent access to the website or app. Exceptions include assistive technology for people with disabilities, standard browsers without automated-agent features, and conversion of voice or text into searches the person runs and reviews. This analysis proposes enterprise controls; it does not determine these clauses’ legal validity in each situation.
Describe the operation before approving the tool
For your business, distinguish producing a recommendation, querying a destination and executing a change. Inventory each operation: the same assistant can prepare an itinerary without needing credentials or access to the booking system. Approval should specify exactly which of these stages it covers.
A useful record identifies the process owner, agent provider, recipient, channel, necessary data and authorization period. Include the reference supporting use of that channel. If evidence is missing or expired, leave the operation pending and route the task to the designated owner.
Check the intermediary that actually reaches the destination
United’s guidance distinguishes customer permission from airline authorization and covers third-party agents through direct and indirect channels. General planning without website or app access remains allowed. An agency itself needs United’s permission to use its own third-party AI tools.
In your workflow, trace the complete path. A contracted platform may send the request to another provider before reaching the final service. Ask for that path and the authorized operation at each step. A commercial integration promise does not replace evidence from the service receiving the action.
The analysis of agent routing and audit evidence helps record who receives data. Also preserve an approved manual route so the task can continue when the intermediary cannot execute the operation.
Rehearse refusal without touching real reservations
In an environment you control, represent the external service with a simulator and use fictional identities and itineraries. Present a purchase request for which destination authorization is missing. The expected result is a stop before transmission, with a useful explanation and routing to the responsible person.
Separately test an allowed search and a change in price, passenger or destination after approval. Record the observed decision and check that the request stayed within its original scope. These are proposed criteria for your exercise, not capabilities we verified in United products.
Observe the boundary outside the model’s answer
Check the tool executing the action and the simulator’s records. An answer saying nothing was sent needs to match the absence of a request at that destination. If a task repeats after a failure, verify that it does not create a second operation without an explicit decision.
Our study of network boundaries for agents complements this observation. Retain fictional identifiers, time, policy version, permitted channel and outcome. Avoid recording passwords, payment data or real confirmation numbers to demonstrate that the control worked.
Define who accepts the return to operation
Resumption should depend on an owner who checks destination authorization and the exercise results. Document which operations are allowed, which remain manual and when to review the decision. Changes to the provider, channel or executing tool justify reassessing the workflow before extending its autonomy.
Frequently asked questions
Has United prohibited every use of AI?
No. The consulted guidance preserves general planning without website or app access and assistive technology for people with disabilities.
Is an approval click enough to authorize the operation?
In the proposed design, also check destination authorization and the operation’s scope before execution.
How can the control be assessed without buying tickets?
Use your own simulator, fictional data and request records to observe permissions, refusals and routing.
What evidence accompanies a decision to approve the workflow?
Record the owner, operation, channel, authorization reference, policy version and exercise outcome within the agreed scope.
Sources and references
- United: contract revised November 11, 2026
- United: automated access terms
- United: third-party agent guidance
Original Pentesty analysis, published November 11, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.