If you build or buy AI visibility monitoring, this is the change that affects you most directly — including us.
Access to agent surfaces is now tiered by identity. The tool list stays public. The right to call those tools does not.
Key takeaways
- UCP defines three trust tiers: Anonymous, Signed and Token. Only Token can complete a purchase and read orders.
tools/listis anonymously callable.search_catalogwith an unreachable profile URL returns 422profile_unreachable.- Shopify tightened bot rate limits on the Storefront API and hosted pages from 30 May 2026; unsigned requests get the strictest tier.
- Merchants can obtain signing credentials in the admin for crawling their own store.
- Authenticated Global Catalog requests default to 5 requests per second per client. The tier limits themselves are not published as absolute numbers.
The three tiers
Tier | What you proved | What you can call |
|---|---|---|
Anonymous | Nothing |
|
Signed | A Web Bot Auth signature | Catalog search and lookup; partial cart and checkout |
Token | Signature plus authorisation | Everything, including |
The design intent is visible in the asymmetry. Publishing the tool list costs nothing and helps the ecosystem; letting an unidentified caller transact costs a great deal. So the catalogue of capabilities is open and the exercise of them is gated.
The measurement that makes it concrete
We called search_catalog on a live store, passing an agent profile URL that does not resolve. The response:
HTTP 422—{"error":{"code":-32001,"message":"UCP discovery failed","data":{"code":"profile_unreachable","content":"Unable to fetch agent profile: Http error"}}}
Not a rate limit, not a permission message — a discovery failure. The server tried to fetch our profile, could not, and stopped. A publicly reachable agent profile is a hard prerequisite even for reading.
The same store answered tools/list anonymously with a 207KB response describing 15 tools. Public catalogue, gated execution, exactly as designed.
Two hard constraints on top
Web Bot Auth is now a gate, not a nicety. From 30 May 2026 Shopify tightened bot rate limits on the Storefront API and on Shopify-hosted storefront pages, with unsigned requests subject to the strictest limits. Merchants can retrieve signing credentials in the admin to crawl their own store — which is the supported path for your own monitoring and should be the first thing you set up.
Published rate limits are relative, not absolute. The documentation gives an ordering — Token above Signed above Anonymous — and one concrete number: authenticated Global Catalog requests default to 5 requests per second per client. Do not treat that figure as a global ceiling when planning capacity.
What this does to GEO practice
Monitoring gets more expensive. Any tool that wants to observe what agents actually see has to become an identified agent, not a scraper. That is a real engineering and operational cost — profile hosting, signing, key rotation — and it will push a tier of crude scraping tools out of this surface entirely.
AI visibility becomes partly an identity problem. Your content can be excellent and still be unreachable to a caller whose trust tier does not permit the call. complete_checkout is Token-only; a monitoring system that never reaches Token cannot observe the end of the funnel at all, no matter how good its prompts are.
Benchmarks need a tier label. Two tools reporting different agent visibility for the same brand may both be right, because they called at different tiers. Any serious comparison has to state the tier it measured at.
What merchants should actually do
Most of this is a platform concern, but three items are yours:
- Get your own signing credentials from the admin before you commission any crawling of your own store, internal or agency.
- Do not fight the rate limits. If a partner is being throttled, the answer is signing, not retry loops. Unsigned traffic is the lowest tier by design.
- Ask vendors what tier they measure at. It is a fair question, and the answer tells you whether a report covers discovery only or the full transaction path.
Where this sits in the stack
Trust tiers live at the protocol layer, which is mostly platform-hosted. That is a comfort and a trap: comfortable because you do not have to build it, a trap because you can be unaware that it is broken on your store. Confirming your own protocol layer is healthy takes one command — see the ten-minute readiness audit, and the six-layer stack for how the layers depend on each other.
FAQ
Does this mean agents can no longer scrape my site? Unsigned requests are not blocked outright; they face the strictest limits and cannot reach the gated tools. Meanwhile the official instructions tell agents not to fall back to scripted form filling — so the combination pushes well-behaved agents toward the tool path and away from scraping.
Can I block agent traffic entirely? You can restrict crawling by the usual means, and channel participation has its own switches in the admin. Whether you should is a different question; see the attribution gap for why switching things off tends to cost more than it protects.
How do I know which tier a given agent used? Not from your side today, in any detailed way. This is one of the open gaps: trust tiering is well specified for the caller and poorly surfaced to the merchant.