The Personal Agent Protocol: Meta and Sierra Want One Login for Every AI Agent

On October 6, 2026, Sierra and Meta announced the Personal Agent Protocol (PAP), an open standard for how personal AI agents authenticate to and act inside business systems. It builds on OAuth - the same 'Sign in with...' idea you already use - and defines three levels of access. With Shopify, Stripe, Walmart, Genesys, Rocket and Instinct as early partners, PAP is an attempt to replace today's fragmented, defensive walls with one front door for agents.

PAP aims to standardize how agents authenticate to businesses

Why agentic commerce needed a handshake

Agents are good at researching and bad at buying, and the reason is not the model. It is that businesses have no reliable way to know who - or what - is at the door. When a personal agent like Meta's Muse tries to check out, a retailer cannot tell a legitimate delegated shopper from an automated scraper, so it either blocks everyone or trusts everyone. That friction is why agentic commerce research has run far ahead of agentic commerce spending. PAP is an attempt to fix the front door rather than argue about the hallway.

# Personal Agent Protocol, from the October 6, 2026 announcement.
# It is built on OAuth: agents identify themselves, declare intent,
# and act on a user's behalf within granted access.

PAP = {
    'announced': '2026-10-06',
    'authors': ['Sierra', 'Meta'],
    'based_on': 'OAuth',
    'partners': ['Shopify', 'Stripe', 'Walmart', 'Genesys', 'Rocket', 'Instinct'],
    'spec_v0_1': 'later in October 2026',
}

How PAP works

The protocol standardizes the moment an agent meets a business: how the agent identifies itself, declares its intent, and executes tasks on a user's behalf - all built on OAuth, the mechanism behind the 'Sign in with...' buttons you already use. It defines three access levels. Guest: without signing in, an agent may read public information such as opening hours, stock levels or return policies. Read-only: with the user's consent, it can view order history or account balances. Write: the agent may actually act - place an order, make a booking, submit a form.

# Three access levels define what an agent may do at a business.

class AccessLevel(Enum):
    GUEST = 'guest'              # public info only, no sign-in
    READ_ONLY = 'read_only'      # with user consent, read account data
    WRITE = 'write'              # agent can take action

# Guest: opening hours, stock levels, return policies.
# Read-only: order history, account balances.
# Write: place an order, make a booking, submit a form.

Early partners include Shopify, Stripe, Walmart and Genesys

Who is in, who is out

The early partner list - Shopify, Stripe, Walmart, Genesys, Rocket and Instinct - matters because a protocol is only as useful as its adoption. Notably absent are Amazon, OpenAI and Anthropic. That gap is the whole story: a shared standard works only if the largest platforms agree that a common front door beats a private, defensive one. Until then, expect a period of overlap, in which some agents and some businesses speak PAP while others keep their own walls - and integration cost lands on whoever has to bridge them.

# PAP maps onto OAuth scopes, so existing identity systems plug in.

PAP_SCOPE = {
    AccessLevel.GUEST:     ['catalog:read', 'store:read'],
    AccessLevel.READ_ONLY: ['orders:read', 'account:read'],
    AccessLevel.WRITE:     ['orders:write', 'account:write'],
}

def scopes_for(level):
    return PAP_SCOPE[level]

The three-layer stack

PAP is best understood as the third pillar of AI agent infrastructure. The first layer was tool interoperability, where MCP became the de facto answer for how agents call tools. The second was agent-to-agent communication. PAP adds the layer that was always going to be hardest: identity and authorization governance - the rules for who an agent is and what it is allowed to do. Identity, once standardized, becomes a powerful switchboard. It is also, not coincidentally, a place where lock-in can hide, which is why developers should read the specification closely when it lands.

# Consent is explicit and scoped: the user grants, the agent obeys.

def grant(user, agent, level):
    token = oauth.issue(
        subject=agent.id,
        actor=user.id,
        scopes=scopes_for(level),
        intent=agent.declared_intent,
    )
    return token   # revocable, auditable, time-bound

Write-level access is where permissions and liability collide

The risks: permissions and liability

Write access is where the promise meets the danger. An agent that can act on your behalf can also act wrongly on your behalf, and the hard question is not technical but legal: when an autonomous agent buys the wrong thing or shares the wrong data, who is liable? PAP's tiered consent model is a start - a user grants a specific level, and that grant is scopeable and revocable. But 'may act' and 'should act' are different questions. The teams that get this right will pair write-level access with explicit budgets and approval thresholds, not just a permission flag.

# Write access should come with a budget, not just a permission.

def act(agent, action, token):
    assert token.allows(action.scope), 'scope not granted'
    assert action.amount <= token.budget, 'over budget'
    return execute(action, on_behalf_of=token.actor)

# 'Can act' and 'may act' are different questions. Ask both.

What developers should do

Three things. One: watch for version 0.1 of the specification later this month and map its access levels onto the OAuth scopes you already issue. Two: design consent and budget as first-class concepts now, so your systems can express 'this agent, this intent, this limit' rather than a blunt yes-or-no. Three: instrument agent actions with a user ID from day one - if an agent is going to act on someone's behalf, you will want the trace when someone asks what happened. PAP is a bet that agents get a shared front door. Whether or not it wins, that is the direction the industry is walking.