Personal Agent Protocol: How AI Agents Connect with Businesses

On 6 October 2026, Sierra and Meta announced the Personal Agent Protocol, an open standard intended to govern how a customer's AI agent deals with a business online. The idea is simple to state and hard to execute: when software acts on a person's behalf, the business on the other end needs a reliable way to know who the agent represents, what it is allowed to do, and how to respond. Today, according to the effort's backers, that is largely guesswork.

This explainer walks through the problem the protocol targets, the mechanics that have been published so far, what remains unspecified, and why a crowded field of overlapping agent standards makes the outcome uncertain. Nearly everything known comes from announcements and secondary reporting; the specification itself had not been published at the time of writing.

The problem: businesses cannot tell agents from people

Reporting by Yahoo Tech, citing CNBC, says Meta, Walmart, Stripe and Sierra are publishing the protocol, with Sierra co-founder and OpenAI chairman Bret Taylor leading the effort. Taylor said businesses currently cannot reliably tell whether an AI agent or a human is visiting them, calling the present situation "kind of chaos until such a standard exists." He compared the intended model to signing in to third-party sites with an existing account, an authentication approach he helped build while leading technology at Facebook.

The security rationale came from David Singleton, a vice president at Meta Superintelligence Labs, who said effective agents require consumers to share sensitive financial and personal data, which makes governance essential. Singleton said Meta's personal agent, Muse, has millions of US users. That is his claim and has not been independently verified.

How the protocol is meant to work

A write-up by FourWeekMBA summarises Sierra's announcement post, which is authored by Taylor and Clay Bavor and describes the protocol as "open for anyone to implement." According to that summary, authentication is built on OAuth, the widely used authorisation framework. Customers choose read-only or write access. Companies decide which "door" an agent uses: their website, their APIs (using standards such as MCP and OpenAPI), or the company's own agent.

A separate review by eesel.ai, a helpdesk software vendor, adds session details attributed to Sierra. A session can begin as a guest, for example to check availability or a return policy. Account tasks require sign-in. Sessions can span channels, so a question asked before signing in and an order change made afterwards belong to one visit.

What is promised but not yet delivered

Sierra plans to publish a version 0.1 specification "later this month," per both write-ups, along with design workshops and a reference implementation. Possible later additions, stated conditionally, include more detailed permissions, push notifications and payments extensions. The eesel review says it could not find a public copy of the spec, and observes that per-action limits do not appear to be part of the first version as described. FourWeekMBA's summary adds that the available sources do not explain how an agent proves whom it represents, and that no company has been confirmed as running the protocol in production.

Who is in, and who is not

Sierra's post names Genesys, Instinct, Rocket, Shopify, Stripe and Walmart as partners, alongside Meta and Sierra, according to FourWeekMBA. Partner lists differ between sources: the eesel review says Meta's own post adds NiCE and Decagon and omits Instinct, and that Decagon says it is joining the working group. The aggregator AI Coverage lists Walmart, Stripe, Genesys, NiCE and BBVA, and notes that its claims rest on a press release and are not independently checked. Readers should treat the roster as fluid.

The absences are as informative as the membership. CNBC, as relayed by the summaries, reports that OpenAI and Anthropic are "not on board now," and Taylor said he expects them to join and would be "really disappointed" if competitors did not adopt it. The eesel review notes that OpenAI, Anthropic, Amazon, Google, Zendesk and Salesforce are not named in any of the four launch posts. CNBC also reports that Amazon has blocked Meta's agents over concerns about website scraping, which illustrates the adversarial dynamic the protocol is partly meant to defuse: a business that cannot verify an agent has little reason to let it in.

A crowded field of agent standards

The Personal Agent Protocol does not arrive in an empty field. The eesel review describes a competing, openly licensed effort called PACT (Personal Agent Consent and Trust), released the same day by Decagon and Instinct under an Apache-2.0 licence, with a spec, schemas, a reference provider and conformance tests. As described there, PACT has an agent discover a business through an A2A Agent Card that lists scopes, has the customer approve those scopes through OAuth's device flow without the agent seeing the password, and attaches both agent and customer identity to requests, with signed receipts in replies. The review also notes that Decagon says it is joining the Sierra and Meta working group, so the two efforts may converge rather than compete.

The same review places these efforts among existing protocols with different scopes. A2A and MCP are published, but A2A leaves authorisation implementation-specific, and MCP covers tools rather than consent. Web Bot Auth addresses website traffic, while Visa's Trusted Agent Protocol and Mastercard's Agent Pay address checkout and payments. By the review's account, none of these tells a company help desk that a customer's agent is requesting a refund. That is the gap the new protocol claims to fill, although this is the reviewer's comparison rather than an independent assessment.

Limits and open questions

Sierra itself acknowledges, per the eesel review, that "some agents may not respect the protocol," and the company released a tool on 8 October, fleming-1, that detects AI callers on phone calls. A voluntary standard only helps with cooperative agents; detection and enforcement remain separate problems.

Several questions are unanswered in the sources reviewed. Governance is not described: the aggregator coverage says only that the standard is "open," without membership rules, decision-making or licensing. The mechanics of identity proof are unspecified. And the commercial incentives are unresolved, since large platforms that control shopping and search have their own reasons to prefer proprietary routes for agents.

What to watch next

Three markers will show whether this becomes infrastructure or stays an announcement. The first is the v0.1 specification: its treatment of identity, permissions and liability will matter more than the partner list. The second is whether OpenAI, Anthropic, Amazon and Google sign on, or whether rival standards persist. The third is production use: the first company that routes real customer transactions through the protocol will reveal how much of the design survives contact with fraud, refunds and disputes.

For businesses, the immediate takeaway is modest. The standard is not yet usable, and nothing published so far settles how an agent proves whom it represents. For now it signals that major platforms see unverified agent traffic as a problem worth solving jointly.