Sierra and Meta yesterday announced the Personal Agent Protocol, an open standard that defines how consumers' personal AI agents authenticate with businesses, what data they can access, and what actions they're allowed to take. Genesys, Instinct, Rocket, Shopify, Stripe, and Walmart have signed on as development partners. A v0.1 specification and reference implementation are due later this month.
The chaos problem
"It is kind of chaos until such a standard exists," Sierra CEO Bret Taylor told CNBC.
He's not exaggerating. A month ago, Meta launched Muse, a personal AI agent that can autonomously shop, book travel, send emails, and manage tasks on behalf of its users. It shot to the top of Apple's App Store and now has millions of users in the United States, according to David Singleton, Meta's VP of Engineering at Superintelligence Labs. OpenAI's Dots, Instinct, and a growing field of personal agents are doing the same.
The problem: these agents interact with businesses the way humans do — loading web pages, clicking through forms, calling support lines. Businesses often can't tell whether they're serving a person, a legitimate agent acting on someone's behalf, or a scraper harvesting their data. Amazon has already blocked Meta's agents and sued Perplexity over alleged concealed scraping. The friction is real and growing.
"Companies will know when it's a personal agent versus an actual person," Taylor said. "For a lot of companies there's a risk: you don't want just a random bot that isn't acting on behalf of a person to have access to this service."
How the protocol actually works
The design principle is straightforward: consumers decide what access to give their agent, and businesses set the parameters for what that agent can do.
A personal agent starts by discovering what a company offers and how to connect — beginning on the company's website. It can open a guest session for low-stakes tasks like checking product availability or reading a returns policy. When a task requires account access, the customer signs in through the company's own page and chooses whether the agent gets read-only or write access.
The whole thing is built on OAuth, the same standard behind every "Sign in with Google" button on the internet. Taylor compared it directly to the social login technology he built when he was CTO at Facebook. Sessions carry across channels, so a question asked before signing in and an order placed afterwards belong to the same visit.
The company then decides how the agent interacts: through its existing website, through APIs built on standards like MCP and OpenAPI, or through its own company agent. The business retains control at every step.
"We're defining rails that we hope personal agents and business agents can run over for the future," Singleton said, comparing the effort to email standards.
The protocol landscape is already crowded
Here's where it gets complicated. The Personal Agent Protocol is entering a market that already has at least ten competing agentic commerce protocols with, as one industry tracker put it, "zero interoperability."
OpenAI and Stripe built the Agentic Commerce Protocol (ACP). Google and Shopify co-developed the Universal Commerce Protocol (UCP). Visa launched its Trusted Agent Protocol. Mastercard has Agent Pay. Coinbase transferred x402 to the Linux Foundation with backing from AWS, American Express, and Google. And that's not the full list.
But the Personal Agent Protocol isn't directly competing with most of these. As explainx.ai noted, the existing protocols cover different layers of the stack: discovery, checkout, and settlement. The Personal Agent Protocol sits at what they called the "relationship layer" — which agent is this, whose behalf is it acting on, and what has it been authorised to do. In theory, it could work alongside ACP or UCP rather than replace them.
That layered view is important. A realistic future transaction might involve a personal agent authenticated via the Personal Agent Protocol, discovering products through MCP, checking out via ACP or UCP, and settling payment through Visa or x402 rails. The protocols are complementary layers, not winner-take-all competitors.
What's not in v0.1
The announcement is deliberately narrow — and that's worth noting. Payments are listed as a future extension, not part of the initial specification. As The Next Web reported, a payment approved by software on someone's behalf has no clear carve-out from strong customer authentication rules in markets like the EU, which were written for humans approving transactions tied to a named payee and an amount.
Governance is also undefined. Who owns the spec long-term? How do new companies join? Taylor said he'd be "really disappointed" if competitors like OpenAI and Anthropic don't participate, but neither is a partner today.
And there's the adoption gap: as one analysis noted, "partners are helping develop it, which is not the same as shipping support." Whether Walmart or Shopify enable this in production is unannounced.
Why this matters for your business
Regardless of which protocols win, the direction is clear: AI agents are becoming a channel. Not a future channel — a current one. Muse has millions of users. ChatGPT's shopping features are live. Google's agentic commerce tools are rolling out globally.
If you run a business with a website — which is to say, if you run a business — agents will arrive at your front door. The question is whether they'll scrape your pages like bots, or authenticate like customers.
The practical preparation is the same regardless of which standard emerges. Tony Bates, CEO of Genesys, framed it well: "Brands need a trusted way to know who an AI agent represents, what it's authorised to do, its intent, and how to work with it securely."
For businesses exploring this space, the immediate steps are structural, not protocol-specific:
- Get your data agent-ready. Structured product catalogues, clear pricing, machine-readable policies. Agents can't negotiate what they can't parse.
- Design permission boundaries. What should an agent be able to do on behalf of a customer? Check an order status? Modify a booking? Return a product? Define these scopes now, before the protocols force the question.
- Build audit trails. Every agent interaction should be logged with who authorised it, what it did, and when. This isn't just good practice — it's the foundation of every emerging security framework for agentic AI.
The Personal Agent Protocol may or may not become the dominant standard. With Bret Taylor's unique position — CEO of Sierra, chairman of OpenAI, board member of Shopify, and the person who built Facebook Login — he's arguably the most connected person in tech to attempt this. But the protocol is less important than what it signals: the era of agents-as-customers has arrived, and businesses that aren't preparing for it are already behind.
Sources
- Introducing Personal Agent Protocol — Sierra
- Meta joins companies to tame 'chaos' of doing business with AI bots — CNBC
- Sierra announces Personal Agent Protocol, an open standard for personal AI agents — The Next Web
- Personal Agent Protocol: Meta, Walmart, Stripe Standard — explainx.ai
- 10 Agentic Commerce Protocols, Zero Interop: The 2026 Guide — Paz.ai
- Introducing Muse: The World's First Personal AI Agent Built for Everyone — Meta
