Resy Banned Its Own Founder. It Was Right.

Brian Distelburger co-founded Resy. So when he woke up one morning this summer to find his Resy account suspended, it is worth paying attention to the details, because the man who built the machine just got caught in it.

The mechanism is the story. Distelburger, it turns out, had built himself a personal AI agent. Not a lab experiment: a running member of the household, in charge of the calendar, the kids' school stuff, notes, assembled from ordinary off-the-shelf parts. One of its subagents had been watching Resy for hard-to-come-by Thursday dinner reservations. Date night, in other words.

He forgot one thing: a rate limit. A rate limit is a cap on how many times software may ask a server for something — the throttle that keeps a concerned citizen from looking like a machine hammering the same door over and over. Without one, the agent hammered Resy the way somebody desperate for Knicks finals tickets would. Resy's security system saw a machine. It did not see the hand holding the remote. The next morning: a strongly worded email, terms of service, "bad behavior," account gone. He had been using Resy since it launched and had held an American Express Platinum card for over twenty years. None of it mattered. He has been warning other builders since: set your guardrails, or you may accidentally ruin your marriage.

The obvious lesson here is about guardrails. Rate limits, sandboxes, restraint. That is the reading the AI crowd will take away, and it is nearly right and completely wrong. A slower, better-mannered bot is still a bot. The security system is not a bookkeeper docking you for asking too fast. It is a detector, and it is trying to detect one thing: a person.

Here is what I mean. Resy's security exists because bots and brokers hurt restaurants. Reservation data from Resy showed that among suspected bots and brokers, no-show rates were four times higher than normal diners — the people who grab tables speculatively, or resell them, are not the people who lose sleep over a restaurant wasting an evening. This is the argument Resy and Tock made publicly when they came out in support of the Restaurant Reservation Anti-Piracy Act: bots that resell reservations without the restaurant's permission lead to no-shows and late cancellations that land on small businesses. When a table sits empty, the restaurant pays, not the algorithm. So the platform built a filter that watches for behavior no real guest would ever exhibit: hammering, holding, reselling — patterns that belong to someone who does not care about the restaurant's welfare.

Now the part that should make you stop. That filter worked on its own co-founder. It did not recognize him. And it should not have. At the layer where the system sees the world — request volumes, timing, behavior — there is no difference between Distelburger's dinner-planning subagent and a scalper's sniping bot. Same hammering, same endpoints, same meaninglessness. The system could not tell them apart because the distinction does not exist in the data it has. The distinguishing feature is intention: whether there is a person behind the account who will show up, behave well, and make the restaurant glad it held the table. That is not expressed in any request. It has to be inferred, and inference is what breaks.

So this is not a case of overzealous security catching an innocent. It is the product doing its job. The co-founder got caught because he built an agent that acts exactly like the people the product exists to exclude. The ban is not the bug. The ban is the product.

The confusing part is the timing. Earlier this month, Resy and Yelp went live inside ChatGPT, following OpenTable, which had already been integrated for months. You can now ask an AI to find a restaurant, compare availability, and book, all inside the conversation. One widely-shared post summed up the new state of things: businesses now have to design for two customers — the human diner and the human diner's agent.

Let that sit next to what just happened to the co-founder. The platform is building an official door for agents to walk through at the same time it is banning the unofficial agents already in the building. That is not hypocrisy, exactly. It is confusion about what the door is for. A booking gate does not solve the real problem — it is not the interface that is scarce, it is the table. Someone still loses. The agent era does not change the allocation problem; it just makes it visible in a new way. We have spent twenty years fortifying websites against bots, and now the entire premise of AI agents is undoing those protections on purpose, as someone pointed out in the wake of all this.

Here is where I go from surprised to worried. Think about what actually makes someone good at getting a hard reservation. It is not speed. It is the accumulated web of being known — calling the host, walking in, showing up reliably, letting a restaurant know you are worth holding a table for. A food writer who famously "perfected" Resy put the point exactly: the goal shifted from being fast to being a regular, and a bot can't give you taste or happiness. He used an agent too, but constrained it in an interesting way — told it only to book his actual favorite places, a couple of times a day, rather than anywhere it could grab. The constraint is a proxy for taste. It is a way of installing judgment inside a machine that has none.

The agent era has a bias, and the bias is toward treating every allocation problem as a speed problem. That is not an upgrade. It is a substitution of the one thing you can automate — asking quickly — for the one thing you cannot — being the kind of guest a system wants to keep. And you can see the cost in the platform's own data: the fastest way to a table is the behavior most likely to leave it empty, which is the exact trade the filters are built to refuse. Speed and desirability run in opposite directions in this market. Optimization in one direction degrades the other.

Now the second act, because it is the part retellings rush past. How did the co-founder get his account back? He did not send a faster agent. He submitted appeals, repeatedly, through every channel he could find, describing his own persistence as close to embarrassing. And the account came back only after he acknowledged the breach — a step that only works as an act of a person, because the whole point is that a person is on the hook. You cannot automate taking responsibility. The blank rhythm of the thing is the point: the machine that triggered the ban, and the acknowledgment that reversed it, are the same function running in two directions — detecting whether a person is present.

Put it that way and the episode becomes legible, and a little chilling. In the agent era, personhood is the scarce resource: the thing being audited, the thing that gets you banned, the thing that gets you unbanned. And the systems doing the auditing cannot see it. They infer it from behavior, and their inference is so blunt that it flagged the product's own creator while he was buying date-night reservations on his own platform. The gap between the resources that matter — personhood, trust, taste — and the signals systems can actually read has never been wider, because for the first time there are billions of automated interactions flowing through the space between the two.

That gap is the test worth taking away, and it applies well beyond restaurants — to tee times, campsites, tickets, doctors' appointments, every scarce thing an agent can now hunt. Ask of anything your agent does on your behalf: does this make me more of a person to the people I am transacting with, or less? An agent that books you a table is fine. An agent that helps you be the kind of regular a restaurant is glad to seat is doing something that compounds. The agents that try to win by speed are building toward a future where the platforms, forced to choose, just build a bigger hammer. The agents that act like good guests are building toward the rarer thing: being treated like people by systems that cannot tell.

There is a detail I want before I would call any of this settled: how many ordinary, legitimate diners get swept up in these filters — not resellers, just people with an agent, or even a script. The co-founder of the company got a form email and no specifics about what his agent did wrong. A regular diner who got banned for using a third-party booking tool for personal convenience got the same treatment. Nobody publishes the denominator, which tells you something on its own: the platforms would rather not know it themselves. The data gap and the business model point the same direction. A system that cannot explain itself to its own co-founder is a system in the market for a better source of evidence about who its customers are.