Quick answer
On October 6, 2026 Sierra and Meta announced the Personal Agent Protocol, an open standard for how a person's AI agent authenticates with a business and what it may do, with Walmart, Shopify, Stripe, Rocket, Genesys, and Instinct as partners. Sessions are built on OAuth: an agent can start as a guest to check stock or a returns policy, and once the customer signs in they choose read-only or write access. Businesses get visibility into what agents are doing. Payments are not in v0.1 and are listed as a future extension. A v0.1 specification is due later in October, followed by workshops and a reference implementation. Visa's Trusted Agent Protocol is a competing effort that Stripe and Shopify have also joined.
Always-on agents are shipping: Dots, Muse, Grok Bot, Gemini's coworker agents. The next question is what happens when one of them calls a shop. Today the answer is usually a bot blocker. The Personal Agent Protocol is an attempt to make the answer a customer session instead.
What it specifies
- Identity: the agent declares that it is an agent and whom it acts for
- Guest mode: public questions such as stock and policies without sign-in
- Sign-in: OAuth sessions in which the customer chooses read-only or write access
- Visibility: businesses can see what personal agents are doing on their behalf
- Not yet: payments, which are a planned extension, and the specification text itself, promised for later in October
Why the partner list matters
Walmart and Shopify bring the merchants; Stripe brings payments plumbing and says it is contributing so businesses can recognise their customers' agents; Genesys and Rocket bring contact centres and financial services; Meta brings Muse, a personal agent that already runs errands. Sierra, which sells customer-service agents to businesses, sits on the other side of the conversation. The gap is the payment networks: Visa runs its own protocol, Mastercard launched Agent Pay in September, and both Stripe and Shopify have joined Visa's effort too, so the standards war is not settled.
What it means for you
- Shoppers: expect "let my agent handle it" to become a real option on major retailers first
- Businesses: decide whether agent traffic is customers or bots; the protocol is the tooling for the first answer
- Developers: watch for the v0.1 spec and reference implementation; OAuth experience transfers directly
Related reading
Bottom line
A sensible, OAuth-shaped answer to a question every retailer will face within a year, backed by names big enough to matter and competing with a payments network. The spec is not published yet; judge it when it is.
