When the customer is an agent: how to become bookable for AI

The most important page on your website two years from now will be a page no human ever sees.

That sounds like a provocation, so let us take a concrete example. A hotel with 38 rooms in Aarhus. A company in Hamburg needs to send six employees to the city from Tuesday to Thursday in week 47, and the travel manager asks her assistant to find and book a hotel close to Dokk1 under 1,200 kroner a night. The assistant is an AI agent. It does not read the hotel's front page, does not look at the photos of the breakfast buffet, and is not persuaded by good copy. It does three things: finds candidates, fetches facts, and tries to complete the booking.

The hotel in Aarhus has a beautiful website. The prices are in a PDF. Availability can only be seen in a booking widget loaded with JavaScript. The agent gets no facts, no availability and no way to book. So it does what agents do: it moves on to one of the large booking portals, where everything is machine readable, and books the six rooms there. The hotel gets the guests. It just pays a commission that eats a double digit share of the room price, for a customer who tried to come direct.

From being found to being transacted with

In September we wrote about the A2A protocol and what it means for SMEs: that customers, suppliers and buyers are getting agents, and that those agents must be able to find and read you. That post was about being found. This one is about the next step, being transacted with.

An agent ready business is a business where an AI agent, on its own, can find it, read its facts, complete a transaction and trust the result, without a human opening the website.

That takes four layers, and most Danish companies today have the first, half of the second, and neither of the last two.

Layers 1 and 2: being found and being read

The first layer is being findable. A short llms.txt on the domain, an agent card at the agreed path, Organization schema with address, registration number and phone. We covered it in the earlier post, and it takes a morning.

The second layer is being readable, and this is where the hotel fell. An agent must be able to fetch the facts that decide the choice, as text and as structured data: prices and price ranges, availability or delivery time, coverage area, terms, certifications, and whatever makes you different from the neighbour. Not in an image. Not in a PDF. Not behind a form or a script.

The test is the one we described in what AI models actually read: switch JavaScript off and see what is left. For the hotel the answer was a logo, a menu and three reviews. No price. No availability.

Layer 3: there has to be a door a machine can open

The third layer is the new one, and it is the one that moves money. An agent that has found you and read your facts must be able to do something: check whether there is availability, get a quote, place an order, book a time. That requires a door a machine can open.

In 2025 three doors of that kind were built, and they are worth knowing by name. MCP, the Model Context Protocol, which Anthropic published in November 2024, has become the common way to give an AI model access to a system, whether a booking system, a warehouse or a CRM. The Agentic Commerce Protocol, launched by OpenAI and Stripe in September 2025, lets a user buy directly inside ChatGPT from the merchants who have opened up for it. And AP2, the Agent Payments Protocol from Google with around 60 partners behind it, is about how an agent pays on behalf of a human with a mandate that can be verified.

What they have in common matters more than the differences: all of them assume that the business at the other end has a structured place where an agent can ask and act. An API or an MCP server on top of the system you already have. Not a new platform. A door into the old one.

For the hotel in Aarhus it means one thing: an MCP server on top of the booking system with three functions. Check availability for dates. Get a price for a number of rooms. Create a reservation that waits for confirmation. That is about two weeks of work when the booking system has an API, and the hotel owns it afterwards. It is the kind of thing we build as custom software inside the systems a company already runs.

Layer 4: a transaction you can trust

The fourth layer decides whether any of this is a good idea. A door a machine can open is also a door the wrong machine can open.

So we have three rules that cannot be opted out of when we build this. Anything that costs money or commits the company waits for approval from a human, until you have watched it work long enough to raise the limit. The reservation is created. Reception confirms it. That is still ten times faster than today. Every request is logged with who, what and when, so you can see which agents come by and what they ask about. That quickly becomes your most interesting market data, by the way. And the agent only gets access to exactly what it needs. It can create a reservation. It cannot see the other guests.

On top of that sit the rules you already know. GDPR applies whether it is an agent or a human sending personal data in. And if your own side of the conversation is an AI, it has to say so, under Article 50 of the EU AI Act from 2 August 2026.

A business that can be found but not transacted with gets dropped in the agents' world the way a shop without a card terminal does.

Where to start

The order is the layers. There is no point building a door into a house nobody can find. So: llms.txt and agent card first, a morning. Then every fact as text and schema, a week. Then the first door, the function your customers most often ask about on the phone, availability or price or an appointment, built as MCP on top of the system you have. And human approval until the numbers say you can let go.

The hotel in Aarhus is assembled from several real hotels we spoke with while writing our whitepaper on the Danish hotel and tourism industry. None of them had the third layer. All of them paid the commission. That is the kind of place in operations we look for in an AI Potential Review: 30 minutes, free, and we ask where your customers come from, not about the technology.

Because the question is no longer whether your customers will send an agent instead of calling. It is whether the agent can get in when it is standing at the door.