Sierra and Meta Announce the Personal Agent Protocol for Agent Commerce
Sierra and Meta announced the Personal Agent Protocol at Sierra Summit, an OAuth-based open standard for how consumer AI agents sign in to and act on behalf of users with businesses. Shopify, Stripe, Walmart, Genesys, and NiCE are launch supporters. Agents get guest-level access for simple questions and OAuth-authorized account access for deeper actions, with the business controlling permissions.
On this page
The authentication problem agents could not skip
Sierra and Meta announced the Personal Agent Protocol on 6 October at Sierra Summit: an open standard, built on OAuth, defining how a consumer's personal AI agent discovers a business, signs in, proves who it is acting for, and completes tasks on the user's behalf. The launch supporters are a retail-and-payments who's who: Shopify, Stripe, Walmart, Genesys, and NiCE, with Instinct and Rocket also listed.
The problem being standardized is the one every agent deployment has been solving with screen-scraping and workarounds. When an assistant books a flight or processes a return on your behalf, the merchant has no reliable way to know the agent is authorized, the user has no consistent way to limit what it may do, and the business cannot treat the interaction as anything better than suspicious traffic. PAP's answer is layered access: agents can act as guests for simple questions such as stock checks or return policies, and users authorize account access through OAuth for anything deeper, with the business deciding what an authenticated agent is permitted to do.
Who is in, who is out, and who is building a rival
The roster signals intent more than breadth. Stripe and Shopify own the payment rails; Walmart is the merchant scale; Genesys and NiCE own enterprise customer service, which is where agent-handled interactions will be accepted or rejected. Sierra, founded by Bret Taylor, brings the agent-platform layer, and Meta brings a consumer agent with distribution. Notably, around the same time Decagon open-sourced PACT, a competing protocol for the same problem, so agent commerce standards are now contested rather than settled.
The published specification is expected by the end of the month, which is when the design questions become answerable: how revocation works when a user fires their agent, how businesses express what guest agents may see, and how the OAuth grant maps to an agent that might act hours after the user last looked at a screen.
Why authorization is the privacy story of agent commerce
For this blog's audience, the significant part of PAP is not the commerce; it is that the protocol makes agent authority explicit and auditable. An OAuth grant names the user, scopes what the agent can reach, and creates a record the user can revoke. Compare that with the alternatives the industry has shipped: agents holding plaintext credentials, prompts that defer to household authority, and extraction attacks that read an agent's own instructions. A standard where the business and the user both see the grant is structurally safer than any of those.
The open questions are the ones OAuth itself has learned over twenty years: consent fatigue, scope creep, and what happens when the thing holding the grant is a system whose behavior changes with every model update. PAP does not answer those; it makes them answerable in one place instead of a thousand bespoke integrations. Whether agents get a trusted identity layer or a new generation of token-stealing attacks depends on the details that arrive with the spec, but the decision to route agent authority through the web's existing trust machinery is the right default.