Personal Agent Protocol: What Businesses Should Do

Personal Agent Protocol is a proposed open standard from Sierra and Meta for how a customer's personal AI agent signs in to a business, what it may do there and what the business can see. Announced October 6, 2026, it uses OAuth sessions and read-only or write permissions. A v0.1 specification is planned for later in October.¹

The Agentic Edge: AI agents and automation, explained for the people who decide, fund and ship.

TL;DR

Customers' AI agents are already showing up at business websites, and the rules for how they sign in and act are not settled. Personal Agent Protocol (PAP) proposes a common front door: guest access for simple questions, customer sign-in for account tasks, and customer-chosen read-only or write access, with the business setting the limits.¹

It is an early plan with Walmart, Shopify and Stripe among the partners, and no published specification yet. Use the next few weeks to settle your agent policy. Rebuilding your website can wait.

What happened

On October 6, 2026, Sierra co-founders Bret Taylor and Clay Bavor published "Introducing Personal Agent Protocol" on the Sierra blog.¹² Sierra sells a platform businesses use to build customer-facing AI agents. Its site says it "helps businesses build better, more human customer experiences with AI."²

Sierra describes PAP as an open standard that Meta and Sierra are developing with industry partners, and says it is "open for anyone to implement."¹

Personal agent, in one line: an AI assistant that works for one consumer, such as Meta's Muse, and handles tasks like sending an email or booking travel for them.³

Why now: Muse, and a locked door at Amazon

Meta launched Muse on September 8, 2026. It is rolling out in the US on iOS, Android and muse.ai. Meta says Muse can open a browser and fill out forms, can check out with Link (built by Stripe), and checks with the person before sensitive actions like sending an email or making a purchase.³

Amazon started blocking Muse from Amazon.com on the night of Sunday, September 20, twelve days after launch.⁴⁵ Muse users who tried to shop there were shown this message: "Continued access by an unauthorized AI agent violates Amazon's Conditions of Use, to which our customers have agreed."⁶

Amazon said it was not told in advance that Muse would access its store and never authorized it, and that Muse does not identify itself as an AI agent.⁴⁶

Adweek also reports Amazon saying that Muse appears to capture and store customer credentials and scrape account data.⁶ Meta's launch post describes credential handling this way: "Any credentials a person shares with Muse go into secure storage, so Muse can use them without seeing them."³

Our read: clashes like this are what PAP is meant to head off. Taylor told CNBC: "It is kind of chaos until such a standard exists."⁷⁸ Meta made the business case in its own announcement, as quoted by CMSWire: "Turning away a personal agent means turning away the customer behind it."⁹

How Personal Agent Protocol works

Sierra's post describes this flow:¹

1. Discover. The agent starts on the company's website, where it can find out what the company offers.
2. Guest session. For simple asks, like checking product availability or a returns policy, the agent can start as a guest.
3. Sign in. For account tasks, the customer signs in on the company's page or uses credentials already set up with their agent.
4. Permission. The customer decides whether the agent gets read-only or write access. The company sets the parameters for what agents can do.
5. Do the task. Through the company's website, its APIs, or the company's own agent for tasks that need a conversation, such as a warranty claim. The session carries across channels, so a question asked before sign-in and an order change made afterward are part of the same visit.¹¹⁰

OAuth, in one line: "the industry-standard protocol for authorization."¹¹ Sierra says PAP sessions are built on it.¹

MCP, in one line: the Model Context Protocol is "an open-source standard for connecting AI applications to external systems."¹² Sierra names MCP and OpenAPI as standards a company's APIs can be built on for PAP.¹

Who is in, and who is not

Sierra names Genesys, Instinct, Rocket, Shopify, Stripe and Walmart as industry partners.¹ Meta's own announcement, as reported by CMSWire, also names NiCE and Decagon.⁹

Amazon, OpenAI and Anthropic are not part of the founding group.⁷⁸ Implicator reports that Taylor, who chairs OpenAI's board, expects OpenAI and Anthropic to take part and would be "really disappointed" if competitors did not use it.⁷

Meta says it has designed the core parts of the protocol and that a working group of partners will build out the rest, according to CMSWire.⁹

Meta named the areas it is still designing with partners: how personal agents securely convey user identity, how businesses can steer personal agents toward efficient website use or optimized APIs and skills, and how personal agents talk to business agents on the user's behalf.⁹

What is not ready yet

Sierra's post says: "We welcome all partners and plan to publish the v0.1 specification later this month..." The same sentence says they also plan to host design workshops with interested parties and publish a reference implementation.¹ We found no published specification as of October 8, 2026.

Under "What comes next", Sierra names three possible additions: more detailed permissions, push notifications (for example when a flight is delayed or an order ships), and payments extensions that could let an agent complete a purchase without sharing credit card information.¹

TNW reports that payments are a future extension rather than part of v0.1.¹⁰ No specification, license or governing body has been published.⁷

Why it matters

Several standards are competing to set the rules for AI agents that deal with businesses. Most of them focus on payments, checkout, or proving that a bot is what it claims to be. PAP covers sign-in and permissions: whose account the agent is using and what it is allowed to do there.

It has company on that layer too. On the same day, Decagon open-sourced PACT, a consent and permissions protocol co-developed with Instinct, and said it would join the PAP working group.¹³

The same names keep turning up. Shopify and Stripe gave Visa feedback on its protocol, and Shopify and Walmart worked with Google on UCP.¹⁸¹⁹ All three are also PAP partners.¹ Big retailers and payment firms are backing more than one standard at once, and you can too.

For executives

Our read: whether to adopt PAP is a smaller question than whether your business welcomes, limits or blocks customers' AI agents at all. Amazon chose to block Muse.⁴ Meta argues that turning away an agent means turning away a customer.⁹ Both are business choices with revenue and risk attached.

PAP could make a middle path practical: let agents in, but signed in, scoped and visible. That only pays off if the big agent makers adopt it, and OpenAI and Anthropic have not joined yet.⁷

For product managers

If customers' agents are going to use your site, they need clear paths for your top tasks: order status, returns, bookings, account changes. PAP describes three ways in: your website, your APIs, or your own agent.¹

The product decisions start now. Which tasks can an agent do as a guest? Which need sign-in? Which should never go beyond read-only? That read-only or write split is the first control PAP gives the customer, and you set the limits around it.¹

For project and delivery leads

There is nothing to build against yet. The specification is not out, and a reference implementation is planned but not yet published.¹ Plan a discovery sprint, not a delivery project.

Do the groundwork that pays off under any standard: know which sign-in system you use, which customer tasks have APIs, and who in security, legal and customer experience must sign off on agent access.

What to do this week

1. Check your traffic for agents. Ask your web or security team how much traffic already comes from AI agents, and what your bot rules do to it today. Our guide to what happens when Cloudflare blocks AI agents is a good starting point.
2. Write a one-page agent policy. Welcome, limit or block? For each, name the tasks agents may do as guests, signed in read-only, and signed in with write access.
3. List your top five customer tasks and whether each has an API or only a web form. Sierra's case for PAP is that today's routes (clicking through pages and, when that fails, calling the support line or opening web chat) "can take a long time", while a direct connection "could get the same task done securely in seconds."¹
4. Ask your customer-service vendor whether it plans to support PAP. Sierra and Meta lead the effort, and Genesys, NiCE and Decagon appear in the partner lists.¹⁹
5. Assign someone to read v0.1 when it is published, and report back on effort and gaps.¹

Questions to ask your team or vendor

1. How do we tell a customer's AI agent from a scraper or attacker today?
2. If a customer's agent signs in, can we limit it to read-only access?
3. Which account actions should never be done by an agent without the customer confirming?
4. Does our sign-in system already support OAuth for third-party apps?
5. Will our customer-service platform support Personal Agent Protocol, and when?
6. Which agent payment and checkout standards do our payment and commerce providers support: Visa's, Mastercard's, AP2, ACP or UCP?
7. Who owns the decision to block or allow a specific agent, as Amazon did with Muse?

Risks and what we don't know yet

The spec. Until v0.1 is published, the technical details are not public. Plans announced on a blog can change.¹

Adoption. A standard is only useful if the agents customers actually use support it. Amazon, OpenAI and Anthropic are not in the founding group.⁷⁸

Governance. No license or governing body has been published.⁷ A protocol whose core parts Meta says it designed, developed with Sierra and a group of partners, is not the same as one run by a neutral standards body. For contrast, Google handed AP2 to the FIDO Alliance.¹⁶

Payments. Buying without sharing card details is one of the possible later additions, not something PAP does today.¹¹⁰ For purchases, other protocols still apply.

Liability. Who pays when an agent buys the wrong thing is still unsettled. We covered that in the AI agent authorization liability gap. This is not legal advice.

Bottom line

Customers' AI agents are arriving whether businesses are ready or not, and Amazon's block of Muse shows how messy that gets without shared rules. Personal Agent Protocol is a serious first attempt at those rules, with big retail and payments names among its partners. Decide your agent policy now, and read the spec when it is published.

Related reads

• AI Agent Payments: The x402 Standards Race in 2026 maps the payment-side standards that PAP leaves for later.
• Web Bot Auth in 2026: Shipped Before It's a Standard explains how websites can verify which bot or agent is knocking.
• AI Agent Authorization: The 2026 Liability Gap covers who is on the hook when an agent acts for a customer.
• Salesforce Will Meter AI Agent Calls: What to Do shows another vendor giving agents their own identity.
• Rogue AI Agents Hit Wikimedia: Lessons for Leaders shows what happens when agents arrive unannounced.

Not legal advice. Standards and partner lists were checked on October 8, 2026 and may change.

References