Personal Agent Protocol: When AI Agents Visit Your Business

On October 6, 2026, Sierra and Meta announced the Personal Agent Protocol (PAP), an open standard for how personal AI agents sign in to a business and act for their users. Agents need a clear way to prove who they are and what they may do. For any organization that serves customers, it is an early hint that your next “visitor” could be software.

What the Personal Agent Protocol is

A personal AI agent is a digital assistant that works for one person. You hand it a task, such as checking whether an item is in stock or changing an order, and it goes to a business’s site or service to get it done. Until now, every business has had to guess: is this visitor a human, a scraper, or a legitimate agent?

PAP tries to settle that. According to The Next Web, the standard is meant to handle authentication and show companies what agents are doing on their sites. Sierra and Meta are developing it together, and the launch partners named in the announcement are Genesys, Instinct, Rocket, Shopify, Stripe, and Walmart.

One caveat up front: PAP is a proposal for now. Let’s Data Science points out that its usefulness depends on published technical details, real deployments by partners, and support from other agent providers. So this is not a rule in force. It is a direction worth watching.

How it works, from guest to full access

PAP sessions are built on OAuth, a sign-in standard many developers already know. Based on The Paypers and The Next Web, the flow looks like this. An agent can start as a guest, for example to check stock or read a returns policy. For anything tied to an account, the customer signs in first and then decides whether the agent gets read-only access or can also change data.

One more detail stands out: a session can continue across channels. A question asked before sign-in and an order change made afterward count as the same visit, so the business keeps its context.

The principle behind it comes from Sierra’s co-founders, Bret Taylor and Clay Bavor: consumers decide what access to give their personal agents. That matters. Permission sits with the customer, rather than being quietly assumed by the agent.

Three ways in for a business

PAP does not force a business to rebuild its services. Companies choose how agents connect, and there are three routes, summarized in the table below.

The first route uses the web pages that already exist. The second goes through APIs that follow standards such as MCP and OpenAPI, which are common ways for software to talk to software. The third uses the business’s own AI agent, which suits conversational tasks like warranty claims. The choice matters because organizations are at different stages. A school with a single parent portal is in a very different place from a retailer with dozens of APIs.

In Sierra’s announcement, Genesys CEO Tony Bates described the trend as “a new front door to the enterprise”. That door is not crowded yet, but its direction is already visible.

What is unfinished, and the rival standards

The PAP version 0.1 specification is due later in October 2026, followed by design workshops and a reference implementation for developers. According to CMSWire/VKTR, key pieces such as how agents convey their identity and how businesses steer them are still open. Planned extensions include finer-grained permissions, push notifications, and payments. Payments are deliberately left out of the first spec.

PAP is also not the only effort. The Next Web notes that Shopify and Stripe, two PAP partners, have also joined Visa’s Trusted Agent Protocol. Visa itself is not listed as a PAP partner. In other words, the agent world may end up with several competing standards for a while, much like the early days of many other technologies.

So it is reasonable not to rush into any single protocol. What pays off more is preparing the groundwork: tidy authentication, documented APIs, and activity logging. That groundwork will be useful whichever protocol wins.

What this means for your organization

In Indonesia, personal AI agents are not yet an everyday sight. Still, the questions PAP raises already apply, because widely used services, from school portals to public-service apps, are increasingly accessed through automation.

A few concrete examples. A school with a parent portal needs to think about whether a parent’s AI assistant may one day check a schedule or a bill, and with whose permission. A government office that handles permits needs to tell legitimate agents apart from data-scraping bots. A company with customer service needs to know when an incoming conversation comes from an agent rather than a person.

Practical steps that make sense without waiting for a final standard:

• Map what machines can reach. List the pages and APIs that are open today, including those without a login.
• Tidy up authentication. Use standards such as OAuth with scoped permissions instead of one master key.
• Separate read from write. PAP’s principle matches good security practice and can be applied today.
• Log activity. Clear logs let you tell ordinary users, agents, and attacks apart.
• Follow the v0.1 draft. A quick read of the summary is enough to judge whether it matters for your service.

Do not overlook the security side. An agent that can change data on a user’s behalf is as attractive a target as a human account. We have written about how the patch window is shrinking in the age of AI-powered attacks, and the logic is similar: the more automated the parties reaching your service, the more important disciplined access control becomes. Our cybersecurity services can help review authentication and activity logging. If you want to explore AI agents for your own services, take a look at our artificial intelligence services too.

A final thought on timing. Standards like this usually mature slowly, and early drafts change. That is a good reason to treat the next few months as a window for learning and housekeeping rather than for big purchases or rewrites.

Frequently asked questions

Can organizations use the Personal Agent Protocol yet?

Not fully. The announcement came on October 6, 2026, and the version 0.1 specification is due later in October. For now PAP is a proposed open standard with a handful of launch partners, not a widely deployed one.

Does PAP cover payments made by AI agents?

Not yet. Payments are described as a future extension rather than part of the first specification. According to The Paypers, that extension could eventually let an agent complete a purchase without sharing card details, but it is still a plan.

Should a small organization prepare now?

There is no need to rush into adopting the protocol. The basic habits are worth starting, though: tidy authentication, separate read and write permissions, and activity logs. They are useful with or without AI agents.

Closing thoughts

This news is no reason to panic, and it is not yet time to tear systems apart. What is clear is the direction: digital services will increasingly be reached by agents working for customers, and organizations that are already tidy about access and logging will handle it more calmly. If you would like to talk through how to prepare your organization’s digital services, our team is glad to hear from you on the contact page.

Sources

• The Next Web, “Sierra announces Personal Agent Protocol, an open standard for personal AI agents” (October 6, 2026): thenextweb.com
• CMSWire/VKTR, “Genesys joins Sierra, Meta on open standard for personal AI agents” (October 6, 2026): vktr.com
• The Paypers, “Meta and Sierra develop Personal Agent Protocol for AI agents” (October 9, 2026): thepaypers.com
• Let’s Data Science, “Meta and Sierra introduce Personal Agent Protocol for business interactions” (October 6, 2026): letsdatascience.com