Personal Agent Protocol: what Sierra and Meta are proposing
On October 6, 2026, Sierra and Meta announced the Personal Agent Protocol (PAP), an open standard for how your AI assistant should deal with a company on your behalf. It is early, with no published specification yet as far as we could find. It is still worth understanding now, because it tackles a real problem: today's agents mostly pretend to be you clicking around a website.[1]
The problem it is aimed at
Ask a personal AI agent to change an order or check a return policy and, in most cases, it does what a person would do. It loads web pages, finds the form, clicks through it, and if that fails it falls back to phone support or web chat. Sierra's announcement describes exactly this and argues that a direct connection could finish the same task securely in seconds.[1]
That setup is awkward for everyone. The agent is brittle, because a redesigned page breaks it. The company cannot easily tell a helpful agent acting for a real customer from a scraper. And the customer has no clear way to say what the agent may and may not do. PAP is an attempt to give all three a shared vocabulary.
What PAP says it does
According to Sierra, the protocol covers authentication, consumer control, and company visibility into what agents are doing, whether the agent arrives through a website, an API, or a company's own agent. Anyone can implement it. The stated principle is that the consumer decides what access their agent gets and the company sets the limits on what the agent can do.[1][2]
The mechanics described so far:
- Guest first. An agent can start a session without an account, enough to check stock or ask about a returns policy.[1]
- Sign in when it matters. For anything touching an account, the customer signs in on the company's own page, or uses credentials already set up with their agent.[1]
- Read-only or write. The customer chooses whether the agent can only look or can also change things.[1]
- One session across channels. A question asked before signing in and an order change made afterward count as the same visit.[1]
- The company picks the door. Agents can be routed to the regular website, to APIs using standards such as MCP and OpenAPI, or to a conversational agent the company runs itself.[1]
Sessions are built on OAuth, which is a good sign. OAuth 2.0 is the long-established framework in which an owner lets another application receive a token with limited permissions and a limited lifetime, instead of handing over a password.[4] That is the same idea behind every "Sign in with…" button you have used, applied to agents.
Where it sits next to MCP
PAP is not a replacement for the Model Context Protocol. MCP is an open protocol for connecting language-model applications to external tools and data, and its specification already stresses user consent: users must explicitly consent to data access and tool use, and hosts must get consent before invoking a tool.[3] PAP treats MCP as one of the routes a company can offer. Think of MCP as a way to expose capabilities, and PAP as a proposal for the earlier questions: who is this agent, whom does it represent, and what did that person allow?
The rival camp
PAP is not the only protocol in this space. Visa announced its Trusted Agent Protocol on October 14, 2025, aimed at shopping. It lets merchants verify an agent using agent-specific cryptographic signatures, built on the HTTP Message Signature standard and aligned with Web Bot Auth, so merchants can tell legitimate agents from malicious bots with minimal changes to their sites.[5] Where PAP is about sessions and permissions across customer service and commerce, Visa's is about proving an agent is who it says it is, at checkout.
Reporting on PAP notes that Stripe and Shopify, both named PAP partners, were also early feedback providers on Visa's protocol.[2][5] That points to a likely outcome: the pieces may end up layered rather than competing, but nobody has shown that yet, and that is our reading, not a claim from either announcement.
What is not there yet
This is the part most coverage skips. As of October 20, 2026:
- No spec that we could find. Sierra said it plans to publish a v0.1 specification later in October, along with design workshops and a reference implementation.[1] We searched and did not find a published specification or repository, so everything above comes from the announcement, not from a document you could implement against.
- Key features are roadmap items. Finer-grained per-action permissions, push notifications (for example a flight delay or an order shipping) and payment extensions that would let an agent buy without sharing card details are all listed as future work.[1][2]
- The claims come from the people building it. The coverage we read relays the initiators' description and offers no independent assessment.[2] Partner quotes are enthusiasm, not evidence of deployment.
- Partner lists differ between reports. Sierra names Genesys, Instinct, Rocket, Shopify, Stripe and Walmart.[1] Some outlets list others; we only repeat what Sierra's own post says.
What it means for you
If you only use consumer AI assistants, nothing changes today, and you cannot switch PAP on. The practical effect, if it catches on, would be that "let my agent handle this return" becomes a sign-in screen where you pick read-only or write access, rather than a bot fumbling through a checkout page.
If you build agents or run a site, the useful move is to wait for the actual spec and read it with a skeptical eye. Questions worth asking when it lands:
- Who issues and revokes the agent's credentials, and can a customer see what an agent did afterward?
- What happens when an agent holds write access and gets manipulated by hostile content on a page?
- Is governance genuinely open, or does it sit with a few companies?
The second question is the one to hold on to. A token with write access is only as safe as the agent holding it, and protocols do not fix an agent that can be talked into things. Our explainer on what AI agents actually are covers why that failure mode keeps showing up.
Our take
Building on OAuth and treating the customer as the one who grants access is a sensible foundation, and a standard way for a company to say "talk to my API, not my checkout page" would be a real improvement over screen-scraping. But an announcement is not a standard. Until the specification, the reference code and a few independent implementations exist, treat PAP as a promising proposal, and judge it on the document when it appears.
Sources
- Sierra — Introducing the Personal Agent Protocol, accessed October 2026
- Techzine — Personal Agent Protocol introduced: visibility into what AI agents do, accessed October 2026
- Model Context Protocol — Specification, accessed October 2026
- IETF — RFC 6749: The OAuth 2.0 Authorization Framework, accessed October 2026
- Visa — Visa Introduces Trusted Agent Protocol: An Ecosystem-Led Framework for AI Commerce, accessed October 2026
Related: What AI agents actually are (and what they aren't) · Password managers vs passkeys: where we actually are