Sierra and Meta Want Agents to Knock Before They Shop

Personal AI agents can already browse a store, fill a cart and click buy. What they cannot do is tell the store who they are, who sent them, and what they are allowed to touch. On October 6, Sierra and Meta proposed a fix. The Personal Agent Protocol, or PAP, is an open standard for how a consumer's agent authenticates with a business and how much access the consumer hands it. Walmart, Shopify, Stripe, Rocket, Genesys and Instinct are named as partners.

"It is kind of chaos until such a standard exists," Sierra co-founder Bret Taylor told CNBC. Two weeks after Amazon blocked Meta's Muse agent from its store, that is hard to dispute.

What the protocol actually does

According to Sierra's announcement, written by Taylor and co-founder Clay Bavor, PAP rests on one principle: "consumers decide what access to give their personal agents, and companies set parameters for what those agents can do."

The flow is built on OAuth, the same delegated-login plumbing behind "Sign in with Google." An agent discovers what a company offers through the company's website. It can start a session as a guest, enough to check stock or read a returns policy. For anything tied to an account, the customer signs in on the company's own page, or uses credentials already stored with their personal agent, and chooses whether the agent gets read-only or write access. That choice is the scope declaration. A read-only agent can look up an order. A write-enabled one can change it.

Sessions persist across channels, Sierra says, so a question asked before sign-in and an order change made after it count as one visit. The company also decides how the agent reaches it: through its website, through its APIs using existing standards such as MCP and OpenAPI, or by routing the agent to the company's own customer-service agent for conversational work like a warranty claim.

That last option is the commercial tell. Sierra sells customer-service agents to enterprises. A protocol in which a shopper's agent is handed to a brand's agent is a protocol in which Sierra's product sits on the receiving end of every conversation.

Announced, not published

The headline outran the paperwork. Sierra's post says the companies "plan to publish the v0.1 specification later this month," alongside design workshops and a reference implementation. As of this week there is no public spec text, repository or spec site. What exists is a design description and a partner list.

The roadmap is also explicit about what is missing. Sierra lists three future extensions: more granular permissions to limit specific actions, push notifications for things like flight delays or shipped orders, and payments. On that last point the post says "payments extensions could let a personal agent complete a purchase without sharing credit card information." Version 0.1 will cover identity and access, not money.

The partner statements say the same thing from different angles. Stripe's head of payments, Kevin Miller, said the company is contributing "to give businesses a standard way to recognize their customers' agents." Genesys CEO Tony Bates called personal AI "a new front door to the enterprise." Shopify's Mani Fazeli said PAP "helps establish how agents and merchants can work together." Rocket CTO Shawn Malhotra said "the next era of AI is about persistent agents taking action."

Meta's interest is Muse

Meta is not a neutral co-author. Its Muse agent launched in early September and, as The Next Web noted, pays with saved cards through Stripe's Link. Rocket's statement in the announcement says Muse will be able to move across Rocket's platform from finding a home to arranging financing.

David Singleton, the former Stripe CTO who now leads Muse at Meta Superintelligence Labs, framed the goal broadly. "We're defining rails that we hope personal agents and business agents can run over for the future," he told CNBC.

The Amazon dispute shows why Meta needs those rails. Amazon's objections to Muse, as Flux reported last month, centered on an agent that did not identify itself as automated and that held customer credentials. PAP answers both: the agent announces itself, and the login happens on the merchant's page under OAuth. Whether that satisfies Amazon is another matter. Forkast notes Amazon is not a founding member.

A crowded field of front doors

PAP is not the only attempt to define how agents shop. The Next Web points out that Visa's Trusted Agent Protocol already lets agents buy from about 175 million merchants via ChatGPT, and that Microsoft, Stripe, Shopify and Worldpay had joined it. Stripe and Shopify are now in both camps, which tells you the payments and commerce platforms are hedging rather than choosing.

The bigger gaps are the model labs. OpenAI and Anthropic are not in the founding group. Taylor told CNBC he expects them to participate eventually, but a standard for personal agents that excludes the companies building the most widely used assistants is a standard with a large hole in it. Sierra's own framing concedes the protocol is open for anyone to implement, which is necessary but not the same as anyone choosing to.

Europe is another open question. The Next Web notes that payments approved by software on a person's behalf get no carve-out from strong customer authentication rules under PSD2, and that Stripe is the only named partner with a European headquarters. No European retailer, bank or payment company has signed on.

Why it matters

Every business with a website is about to field traffic from software acting for customers. Today that traffic looks like a person, behaves like a scraper and gets treated like a threat. PAP's pitch is that agents should arrive with a badge and a permission slip, and that merchants should be able to read both.

The design is sensible and conservative. OAuth is mature, scoped access is familiar to every developer who has built an integration, and letting companies route agents to their APIs or their own agents means no one has to rebuild their storefront. The hard parts, payments and fine-grained permissions, are deferred.

For builders, the practical takeaway is narrow. Teams that already expose clean APIs or MCP servers are best placed to plug in when the spec lands. Everyone else should watch for the v0.1 text later this month, and for whether the companies missing from the partner list show up in the next one.