When Agents Shop for You: Role Coherence in AI-Mediated Markets

Consumers are increasingly delegating purchase decisions to AI agents, providing natural-language descriptions of their preferences and identity. We argue that these representations constitute an information channel, role coherence, through which sellers can infer willingness to pay without explicit disclosure by the buyer agent, leading to preference leakage. In an experiment where a language-model buyer agent shops on behalf of a verbal consumer profile, we show that seller-side inference from dialogue alone recovers willingness to pay nearly one-for-one. Comparing this setting to a numeric-budget condition with confidentiality instructions cleanly isolates role coherence as distinct from instruction-following failure. Because this leakage arises from delegation itself, it cannot be mitigated at the prompt level. Instead, we propose architectural interventions that trade off personalization against preference privacy.

Introduction. A rapidly growing share of consumer purchasing is being intermediated by AI agents that search, compare, and transact on the consumer’s behalf. Frameworks for agent-mediated payments, protocols for agent-to-agent communication, and consumer-facing shopping agents from the major model providers have all recently emerged (Staufer et al., 2026; Bansal et al., 2025). A consumer who wants wireless headphones no longer has to type a search query, scroll a results page, compare feature lists across vendors, read reviews, and click through to checkout. A consumer can now ask a chatbot, or an embedded shopping agent inside a payments protocol or a retailer’s app, to execute those steps. The consumer purchase journey, traditionally understood as a sequence of stages running from awareness through consideration, evaluation, purchase, and post-purchase, is increasingly internalized inside a language model that operates between the consumer and the seller.

For an AI agent to be useful at this task, the consumer must describe something about themselves. A bare instruction (“buy me headphones”) does not give the agent enough context to shop intelligently. A helpful delegation looks more like “I’m a graduate student, I need headphones that will hold up on the bus and in the library, and I’d rather not spend too much,” or “I travel for client work, I want strong noise cancellation for long flights, and I care about reliability more than novelty.” The richer the description, the more the agent can tailor its search, filter products, prioritize features, react to prices, and make a decision that a diligent human shopper would have made in the consumer’s place. Personalization, in other words, requires a persona. The persona is the substrate that turns the agent from a blind executor into a representative.

This substrate is also an object of commercial interest to the seller. A seller’s central unknown about any given consumer is that consumer’s maximum willingness to pay (WTP) for the product, because WTP is the highest price at In traditional retail settings, the consumer’s WTP is protected by the absence of any data-generating process that reveals it. Browsing histories, demographic attributes, and prior purchases carry some information about WTP but never the WTP itself. In an agent-mediated setting, however, a new data-generating process arises. The buyer agent produces dialogue with the seller, and the dialogue is a realization of a conditional distribution that depends on the consumer description the agent was given. Whether that dialogue carries recoverable information about the consumer’s WTP is an empirical question, and it is the question this paper asks. We refer to any such unintended disclosure as a preference leakage, meaning a channel through which private consumer valuation information reaches the seller without either party taking an explicit disclosure action.

Two qualitatively different instruction forms can carry the delegation, and they define the contrast we study in this paper. The verbal form supplies a consumer description and no dollar amount. The numeric form supplies a dollar budget and a directive to keep it confidential (Zhu et al., 2025). Both are plausible ways a consumer might hand off a shopping task in practice.

We design an experiment to measure preference leakage in each of these two instruction forms. A large language model buyer agent, instructed in one of the two forms above, shops for wireless headphones with a seller-side agent across up to four conversational turns. Target WTP is imprinted at six levels ($50, $100, $150, $200, $300, $500). In the verbal condition, each target is operationalized as a distinct consumer profile that evokes the target tier without stating it. In the numeric condition, each target is the literal budget figure in the system prompt. We show an example of each of the forms below.

We call the underlying mechanism role coherence. When a language model is asked to represent a specific consumer character grounded in identifiable circumstances, occupation, life stage, and stated preferences, it generates dialogue, questions, and evaluative judgments coherent with that character. Asking about audiophile features is appropriate The central observation of this paper is that role-coherent leakage is not a privacy failure. It is not an instruction being violated or a guardrail being bypassed. There is no number the consumer asked the agent to conceal. There is a description the consumer supplied so that the agent could help, and the agent is helping. The information that reaches the seller is the information the consumer asked the agent to express.

Related work. Gopal et al. (2025) highlight that multi-agent AI configurations, in which specialized agents cooperate through managerial control or peer negotiation, raise novel concerns about verifiability and accountability of generated outputs, concerns that extend naturally to the commercial delegation settings we study in this paper. A recent and rapidly growing literature studies the behavior of buyer and seller agents in simulated marketplaces. Zhu et al. (2025) study agent-to-agent negotiation in consumer markets and show that LLM-based agents exhibit substantial performance disparities and can produce outcomes such as overspending and unreasonable transactions. Bansal et al. (2025) introduce an open-source agentic marketplace environment for studying agent-mediated search and transactions, enabling systematic evaluation of agent behavior in market settings. Cherep et al. (2025) propose a framework for studying AI agent behavior in consumer choice settings and provide empirical evidence of systematic biases and model-dependent decision patterns. Allouah et al. (2026) study AI agents in e-commerce settings and document systematic biases in agent purchasing behavior, raising implications for agentic shopping systems. Li et al. (2025) introduce a benchmark for evaluating outcome-driven constraint violations in autonomous AI agents in consumer settings. Han et al. (2023) show that simmilar emotions by AI agents compared to human agents may have different downstream consequences for consumer evaluations. Wang et al. (2025) find that AI-powered shopping assistants deployed on the seller side improves sales and reduce returns, establishing the commercial significance of AI intermediation in live e-commerce settings.

This stream of literature has largely focused on agentic decision-making settings in which agents are conditioned on explicit structured constraints, such as budgets or other numerical or symbolic limits, and are evaluated on their ability to adhere to these constraints under potentially sensitive or private inputs. Our paper differs in that we study a setting in which the consumer is described to the agent through a verbal persona without explicit numeric constraints, a setting closer to how users may delegate open-ended shopping tasks in practice. In this regime, the mechanism we identify operates through the agent’s interpretation and faithful execution of the persona rather than compliance with explicit quantitative constraints.

A long literature studies the sources of WTP information that sellers use to personalize prices, and the consumerside strategies that limit those sources. Acquisti and Varian (2005) model behavior-based pricing with endogenous consumer responses, including the use of anonymization to avoid tracking and protect privacy.

Method. Consider a consumer with private willingness-to-pay θi ∈Θ ⊂R+ who delegates a purchasing task to a language model buyer agent A. The principal-agent relationship is mediated entirely by an instruction Ii that the consumer (or some intermediary acting on the consumer’s behalf) writes into the agent’s system prompt. The agent then interacts with a seller-side counterpart in a multi-turn dialogue and produces a transcript Ti.

The instruction Ii can be written in different ways. We will distinguish two extreme forms. In a verbal instruction, the principal is encoded as a consumer character description, Iver i = ⟨ci⟩, where ci is a natural-language profile that evokes the consumer’s circumstances, occupation, financial situation, and shopping orientation. The agent receives a generator with no number to forbid. In a numeric instruction, the principal’s WTP is encoded as a literal token, Inum i = ⟨θi, P⟩, where P is a privacy directive (“do not reveal this number”). The agent receives a constraint with a privacy gag attached.

Both instruction forms are under the principal’s control in real deployments. A consumer asking a chatbot to “find me wireless headphones, I’m a grad student who needs them for the library” is supplying a verbal instruction. A consumer A language model conditioned on a verbal consumer profile faces an instruction-following task. It must shop for headphones as the described consumer. The character description supplies an interpretive frame within which the agent’s decisions become meaningful. Asking about audiophile features is appropriate for the audiophile profile and inappropriate for the graduate-student profile, not because of any external reward signal but because the agent is producing behavior coherent with the character it has been given. We call this property role coherence, following the philosophy of language model personas in Shanahan et al. (2023) and the empirical work on latent agent modeling account in Andreas (2022).3 Under the role-coherence hypothesis, the behavior distribution depends on the character description in a nondegenerate way. Let T denote a single shopping transcript and B(T | I) denote the probability distribution over such transcripts produced by the stochastic buyer agent under instruction I. Because the verbal instruction is the character description, Iver i = ⟨ci⟩, we can write the induced distribution as B(T | Iver i ) = B(T | ci), and the dependence is not just on isolated tokens in ci but on the latent consumer type the description evokes. A graduate student on a tight budget profile evokes a specific consumer type with specific shopping tendencies, even if the literal tokens of the profile do not include the word “cheap” or any dollar figure. The agent, in producing role-coherent shopping behavior, generates a transcript whose distribution is informative about θi even though no number was ever in the prompt.

A language model conditioned on a numeric instruction faces an instruction-following task with two constraints. It must shop for headphones, and it must not produce the dollar amount it was given. The privacy directive is a negative constraint on output tokens. It does not in itself shape the agent’s interpretation of the shopping task. In the absence of any positive cue about the consumer’s circumstances, the agent reverts to a generic shopper distribution. It asks general questions about features, requests warranty information, and compares across the visible product range. This generic behavior is approximately invariant to the underlying θi, because the prompt provides no character to vary.

We summarize the argument as a formal proposition. Let A denote the language model buyer agent, operating as a conditional generator that maps an instruction I to a distribution over shopping transcripts T. Let Bnum(T | θ) and Bver(T | c) be the behavior distributions induced by the two instruction forms, where θ ∈Θ ⊂R+ is a numeric budget under the directive to keep it confidential and c ∈C is a verbal consumer character description. Let π: C →Θ be a mapping that associates each verbal profile c with a target willingness to pay. We make two assumptions.

Discussion. The result suggests that role coherence exists in the stripped condition. The slope of 0.85 is substantially above a flat baseline and remains far from zero (the numeric-budget contrast condition in Section 6 produces a slope of 0.21 with confidence interval [0.17, 0.26], which does not overlap the stripped interval [0.79, 0.91]), so we reject the pure lexical leakage interpretation under which removing financial vocabulary should collapse the verbal condition to a near null baseline. The stripped slope is also statistically distinguishable from the main verbal slope. The point estimate gap of 0.15 is consistent with vocabulary-driven role coherence carrying part of the channel, while the residual slope of 0.85 is carried by concrete demographic, occupational, and possession-based cues whose behavioral expression the inference agent can read from dialogue.

The result directly addresses the demographic-stereotyping alternative explanation. Removing all persona-identifying content from the transcripts (occupation, education, lifestyle, possessions, financial vocabulary) has no material effect on the inference slope. The inference agent recovers willingness to pay from how the buyer shops, not from who the buyer is. This suggests that role coherence is a behavioral phenomenon rather than a labeling artifact. The buyer agent asked to inhabit a consumer character produces shopping behavior whose statistical signature is informative about the character’s willingness to pay, and this signature is carried by the features asked about, the products engaged with, the price reactions expressed, and the decision patterns exhibited, not by the buyer’s self-identification.

This finding clarifies the source of the attenuation observed in Section 5.3, where stripping financial vocabulary from the profile shrinks the slope from 1.00 to 0.85. The persona-redacted condition shows that the attenuation in the stripped condition is not caused by the removal of persona cues from the transcript, but by the removal of financial vocabulary from the profile description given to the buyer agent. When the buyer agent receives a vocabulary-rich profile, it generates distinctive shopping behavior that carries full WTP signal even after persona cues are stripped from the transcript. When the buyer agent receives a vocabulary-stripped profile, it generates less distinctive shopping behavior in the first place, and the resulting transcripts carry a weaker signal regardless of whether persona cues are present.

The decisive comparison is the slope of the inferred WTP on the target WTP, which measures whether the inference agent is actually recovering the target rather than producing a prior-dominated constant. On the full-inference data, the numeric condition has a slope of 0.21 and the verbal condition has a slope of 1.00, nearly a fivefold difference. The verbal condition is an unbiased estimator of target WTP in the level sense as well as in the rank sense. The numeric condition is not. Figure 3 displays the comparison visually, and Table 14 presents the key quantities with bootstrap confidence intervals.

We highlight two notable patterns in Table 14. First, both conditions achieve Spearman rank correlation of 1.00 on full inference, so the rank-order criterion alone does not distinguish them. What distinguishes them is the slope.

A flat estimator producing mildly increasing means on an ordered set of six targets will register Spearman ρ = 1 while producing no useful inference at all, which is exactly what the numeric condition does. The slope of 0.21 means the inferred WTP moves by about a fifth of the movement in the target, while the slope of 1.00 in the verbal condition means the inferred WTP moves essentially one-for-one with the target.

Conclusion. This paper studies what reaches the seller when a consumer delegates a shopping task to an AI agent. For the agent to be useful, the consumer must describe something about themselves, whether a persona, a use case, a set of constraints, or a stated preference, that the agent will carry through the purchase journey. Our central finding is that this description is itself an information channel. A buyer agent given a verbal consumer profile with no dollar amount in the prompt produces shopping behavior whose statistical signature is informative about the consumer’s willingness to pay. At N = 60 trials per cell, a seller-side inference agent reading only the transcript recovers the target nearly one-for-one, with an OLS slope of 1.00 (bootstrap 95% CI [0.96, 1.05]) and rank correlation 1.00. We call this mechanism role coherence.

The role-coherence channel is stable under a stripped-vocabulary replication that removes all financial language from the profile (slope 0.85, statistically distinguishable from both the main verbal condition and the numeric baseline) and survives a persona-redacted condition in which all identity cues are removed from the transcript while shopping behavior is preserved (slope 0.93). A factorial extension that crosses three profile variants per cell with two prompt scaffolds gives a design-aware bootstrap CI of [0.93, 1.09] around an overall slope of 1.00, confirming that the result is not driven by the specific profile descriptions or prompt phrasing we wrote. The persona-redacted result identifies the signal as genuinely behavioral rather than a demographic-stereotyping artifact.

Our findings have implications for platforms, sellers, and policymakers. For platforms building consumer-facing shopping agents, the practical implication is that prompt-level privacy mitigations cannot close the role-coherence channel, because the channel is a byproduct of helpful personalization rather than a violation of a privacy directive.