TLDR;
Meta and Sierra are developing Personal Agent Protocol with Shopify, Stripe, Walmart and other partners. The proposal would use OAuth so customers can authorise an agent and businesses can control what it may do. There is no specification or live implementation yet. Brands should map their agent permissions now, then wait for version 0.1 before committing engineering work.
What happened
Sierra announced Personal Agent Protocol on 6 October with Meta and partners including Genesys, Instinct, Rocket, Shopify, Stripe and Walmart. The goal is to give personal AI agents a consistent way to identify themselves, act for a customer and work through a business's website, APIs or own customer-service agent.
The proposed journey begins without authentication when a guest task is enough, such as checking availability or reading a returns policy. For account tasks, the customer signs in with the business and grants read-only or write access. An OAuth session carries across channels so discovery, login and a later transaction can remain part of one traceable visit.
CNBC reported that the group is responding to confusion about whether a business is dealing with a customer, an authorised personal agent or an unknown bot. The problem is already commercial. Amazon blocked Meta's Muse from shopping its marketplace, while other retailers have found human-verification controls accidentally stopping partner agents that they intended to support.
The announcement is a design direction, not a released standard. Sierra says version 0.1 will arrive later in October, followed by workshops and a reference implementation. SiliconANGLE also described the initiative as an effort to create standards for agent commerce. There is no published conformance test, licence, governance body or production deployment to evaluate yet.
Why it matters
Agent access cannot be solved with a single allow-or-block rule. A customer may reasonably let an assistant read order status but not change an address, or build a basket but not place the order. The proposed guest, read and write states give brands a starting point, but enterprise systems will need finer controls for value limits, sensitive products, refunds and identity changes.
A shared session could improve measurement and service. Today an agent may browse anonymously, trigger bot protection, sign in through a separate path and call support when checkout fails. If the same authorised session survives those steps, a brand can see the task, permission and outcome without pretending every automated request is malicious.
The trade-off is concentration. Protocol partners include major agent, commerce and payment platforms, and their first design choices may shape what merchants must expose. TechCrunch's access report showed that some blocks are deliberate while others come from anti-bot systems built for a human-only web. Standards can reduce that friction, but businesses still need the right to refuse actions and protect customer data.
How your brand can benefit / be affected
Inventory the tasks an external agent might attempt: product search, quote retrieval, account lookup, checkout, cancellation, return, booking change and support. For each one, define whether guest, read or write access is appropriate, what user confirmation is required and which system records the decision. This produces a useful control map even if the final protocol changes.
Test the boundary between authentication and authorisation. OAuth can establish a delegated session, but it does not decide whether a particular refund, purchase or account change is safe. Apply transaction limits, step-up checks, audit logs and reversible actions according to risk. Keep bot identification separate from permission so a known agent is not automatically trusted with every task.
When version 0.1 appears, compare it with existing MCP, OpenAPI and checkout integrations rather than adding another parallel route. Think Facility notes that the first specification is still pending. Check how the protocol proves user intent, rotates credentials, revokes access, handles disputes and exposes telemetry. A pilot should start with low-risk read actions and one clear owner for fraud, customer support and privacy review.
News date: 6 October 2026. Editorial review: 8 October 2026.