On October 6, 2026, Sierra co-founders Bret Taylor and Clay Bavor announced the Personal Agent Protocol, an open standard for how consumers’ AI agents authenticate with businesses. Meta, Walmart, Stripe, Shopify, Genesys, Instinct and Rocket are building it alongside Sierra, according to PYMNTS. There is no specification yet, so nothing can be implemented today. But the problem it targets is already in production traffic, and the engineering work it implies is worth starting now.
What the Personal Agent Protocol actually covers
The protocol defines how a personal agent signs in and what it is allowed to do once it gets in. Consumers decide how much access their agent gets, and companies set the boundaries on what agents can do through their websites, APIs or their own company agents, per PYMNTS. Taylor put the motivation bluntly: “It is kind of chaos until such a standard exists,” as reported by Implicator.
The proposed flow is concrete enough to plan around. An agent lands on a company site and discovers what the business offers. A guest session may be enough for questions about return policies or stock. Account access requires the customer to sign in on the company’s page or use credentials already set up with the agent, and the customer chooses read-only or write access. Sessions would run on OAuth, and businesses can expose regular pages, APIs through MCP and OpenAPI, or a conversational agent of their own, according to Implicator.
Scope matters here. The first version does not handle payments. Payments, push notifications and finer-grained permissions are listed as future extensions, per Implicator. Reports also do not describe any monitoring mechanism, so claims that the protocol will let you audit agent behavior are ahead of the evidence.
Why this surfaced now: the Amazon and Muse standoff
Meta launched its Muse personal agent on September 8. On September 20, Amazon cut Muse off from Amazon.com, saying Meta had not told it Muse would access the store, that Muse did not identify itself while browsing, and that it appeared to capture and store customer credentials, according to Implicator. Meta says credentials sit in secure storage that Muse can use without seeing passwords or payment methods, and that Muse asks users before sensitive actions like purchases. Those safeguards are Meta’s own claims and have not been independently verified.
Meta’s counterargument to blocking is commercial: “turning away a personal agent means turning away the customer behind it,” as The Daily Caller quotes its October 6 post. Taylor described the goal as making sure “companies will know when it’s a personal agent versus an actual person.” Both positions are reasonable, and the protocol is an attempt to replace a blanket allow-or-block decision with an identity and permission model.
The standard is early and the field is crowded
Three other agent commerce efforts already exist. Visa has the Trusted Agent Protocol, which Stripe and Shopify have joined. Google has the Universal Commerce Protocol, with Walmart and Shopify participating, covering agent-initiated checkout. OpenAI has the Agentic Commerce Protocol, co-developed with Stripe and released in September 2025. Implicator lists all three, and notes that OpenAI and Anthropic are not on the Personal Agent Protocol partner list.
Taylor, who also chairs OpenAI’s board, said he would be “really disappointed” if competitors did not use the standard, and The Daily Caller reports he expects both OpenAI and Anthropic to sign on. That is a prediction, not a commitment. As of the reporting, no specification, license or governing body had been published, and a v0.1 spec is expected later in October along with design workshops and a reference implementation.
For an enterprise architect, the practical reading is that the protocols will overlap for a while. The layer worth investing in is the one they all need: knowing who or what is calling, and what it was authorized to do.
What to prepare before the spec lands
None of the following depends on the final wire format. All of it reduces risk whichever protocol wins.
- Classify agent traffic. Identify which sessions on your site and APIs come from automated agents versus people, and log the user agent and behavior patterns you see today. You cannot set policy for traffic you cannot see.
- Define guest versus authenticated capabilities. Decide which actions an unauthenticated agent may take (policy lookups, availability) and which require a signed-in customer. The proposed flow already separates the two.
- Model read-only and write scopes. If your OAuth setup only knows “logged in” or “not”, add scopes that distinguish viewing an order from changing or placing one.
- Expose clean machine interfaces. Meta says businesses should be able to steer agents toward efficient website use or optimized APIs and skills, per PYMNTS. Documented OpenAPI specs or MCP servers beat agents scraping your checkout page.
- Plan for fraud and dispute handling. Payments are out of scope for v1, so card rules, chargebacks and liability for agent-initiated orders remain with your existing payment stack and processor. Raise the question with them now.
- Assign an owner. Identity, API, fraud and legal teams all touch this. Without one accountable owner, the decision to block or allow agents will be made by default.
What to watch in the next few weeks
Three signals will show whether this becomes infrastructure or another competing proposal. First, whether the v0.1 spec and reference implementation actually appear on the promised timeline. Second, whether OpenAI and Anthropic join, since their absence leaves the largest consumer agent surfaces outside. Third, whether Amazon, which blocked Muse over identification, engages with the protocol at all.
The companies that fare best will not be the ones that guessed the winning standard. They will be the ones whose systems can already tell an agent from a person, grant it a narrow scope and revoke it cleanly.
Planning API, identity or AI agent work for your platform? Talk to Luby’s engineering team about how to get your systems ready for agent-driven customers.