What Is the Personal Agent Protocol (PAP)? Plain-Language Guide (2026)

TL;DR. The Personal Agent Protocol (PAP) is an open standard Sierra and Meta announced on October 6, 2026. It defines how a customer’s personal AI agent signs in to a business and what it may do there, with sessions built on OAuth. A v0.1 spec was promised for late October 2026, so it remains a proposal.

Last reviewed: 2026-10-12

If you’ve watched an AI assistant try to change a flight or check an order, you’ve seen the problem the Personal Agent Protocol is meant to fix. Today most agents work like a person with a mouse: they load a page, find the form, click through, and hope nothing changed since last week. When that breaks, the agent falls back to a chat window or a phone call, which is slow and doesn’t always finish the job. The Personal Agent Protocol, usually shortened to PAP, is the first serious attempt by a major set of companies to replace that guesswork with a shared set of rules.

The Personal Agent Protocol is a proposed open standard for the relationship between a customer’s personal AI agent and a business. It covers how the agent identifies itself, how a session starts, what the customer allows it to do, and how the business sees and controls what the agent is doing. In plain terms: it’s a front door and a visitor log for AI agents. This page is FindSkill.ai’s plain-language reference, and I’ve kept to what the announcement coverage actually confirms, because the details are still moving.

What the Personal Agent Protocol actually is

The Personal Agent Protocol is an open standard being developed by Sierra and Meta with industry partners, announced on October 6, 2026. It defines how personal agents interact with businesses, and it is built around authentication and permissions rather than around payments or shopping features. A business that supports it can recognize which agent is calling, whom the agent represents and what that agent is allowed to do.

Per coverage of the announcement, Sierra described PAP as “an open standard designed to define how personal AI agents interact with businesses.” It is being developed with partners that Sierra names as Genesys, Instinct, Rocket, Shopify, Stripe and Walmart. Anyone can implement it. Sierra is the customer-service AI company co-founded by Bret Taylor, and the announcement post was reported as written by Taylor and Clay Bavor.

Here is the mechanism, in the order a customer would experience it:

The agent finds the business. It discovers a company’s offerings and how to reach it from its website.
It starts as a guest. Without signing in, an agent might check product availability or read a returns policy.
The customer signs in when the task needs an account. That can happen on the company’s own page or with credentials the customer has already set up with their agent.
The customer picks the access level. Read-only (look but don’t change anything) or write (the agent may act).
The session runs on OAuth, the same authorization standard behind “Sign in with Google.” Coverage says sessions persist across channels, so a question asked before login and an order change made after belong to the same visit.
The business decides how the agent is served: through its normal website, through APIs built on standards such as MCP and OpenAPI, or through an agent of its own.

One sentence from the Techzine write-up sums up the split of power: “The consumer chooses what access an agent receives, while the company determines what that agent is allowed to do.”

How a PAP session is described to work

Agent finds the business from the company's website

Guest session stock, returns policy, hours

Customer signs in on the company page or via saved credentials

Customer sets access read-only or write

Business sets limits website, MCP/OpenAPI, or its own agent

Source: coverage of the Sierra and Meta announcement (The Next Web, Unite.AI, Techzine), October 2026. Details may change in the published spec.

Why the Personal Agent Protocol matters now

The Personal Agent Protocol matters because AI agents are starting to act inside customer accounts, and businesses have no reliable way to tell a legitimate agent from a scraper or an attacker. A shared standard gives companies a way to say “yes, this agent, for this customer, for these actions.” It also gives customers a way to limit what an agent can do before it does it.

Three pieces of context explain the timing:

Agents are already out there. Our guide to agentic commerce covers the assistants that now research, compare and in some cases buy for shoppers. Amazon said its Rufus assistant helped over 300 million customers in 2025 (Amazon, May 2026), and the same assistant is the subject of our Amazon Rufus explainer.
Businesses want visibility. Genesys CEO Tony Bates, whose company is a named partner, called personal AI “a new front door to the enterprise,” and said brands need a reliable way to identify who an agent represents and what it is authorized to do.
Standards are crowding in. Google’s Agent Payments Protocol (AP2) handles how agents pay under rules you set. MCP handles how AI systems call tools. Coverage also notes a rival effort led by Visa, with Stripe and Shopify participating in both camps. PAP’s niche is the identity-and-permissions layer between a customer’s agent and a business, which is why it describes payments as a later extension, not a first-version feature.

What is confirmed, and what is not

The Personal Agent Protocol is new enough that the honest answer to many questions about it is “not decided yet.” The table below separates what the announcement coverage supports, such as the date, the partners and the OAuth design, from what I could not confirm, such as a published spec or OpenAI’s involvement.

Question	Status as of October 12, 2026
Who announced it, and when?	Confirmed. Sierra and Meta, October 6, 2026
Is it open?	Confirmed in coverage. Described as an open standard anyone can implement
Sessions built on OAuth?	Confirmed across multiple reports
Founding partners	Mostly consistent. Sierra names Genesys, Instinct, Rocket, Shopify, Stripe, Walmart; some outlets add NiCE and Decagon; Instinct reportedly joined later
Is a spec published?	Not at the time of writing. v0.1 was planned for later in October 2026, with design workshops and a reference implementation to follow
Payments, push notifications, per-action permissions	Future extensions, not v0.1
Is OpenAI involved?	Unconfirmed. Reports conflict; one source says additional design partners including OpenAI were named on October 9, others say OpenAI and Anthropic are not partners so far. I could not confirm this with a second source
Is it a consumer product you can turn on?	No. It is a standard for businesses and agent developers

If any of those rows matter to a decision you’re making, check the published v0.1 spec and the companies’ own posts before relying on this page. FindSkill.ai will update the review date when the spec lands.

What the Personal Agent Protocol is not

The Personal Agent Protocol is not an AI assistant, a payments system, a replacement for MCP or a safety guarantee. It is easy to misread because it shares a news cycle with agent products that look similar, so four short corrections follow, each with the reason it matters.

It is not an AI assistant you can download. PAP is a set of rules for how agents and businesses talk. It doesn’t ship an agent. Meta has its own consumer and business agents, such as the Meta Business Agent, but those are separate products.

It is not a payments system. The first version is about sign-in and permissions. Payments are listed as a future extension, described in coverage as a way to complete purchases without sharing card details. If you want the payments side today, read about AP2.

It is not a replacement for MCP. The Techzine report mentions MCP and OpenAPI only as standards a business might use for its API route. They sit underneath or beside PAP rather than competing with it.

PAP is not a guarantee of safety. A standard defines how permissions are expressed. It doesn’t stop an agent from being tricked. Prompt injection, where hidden instructions on a page steer an agent, remains a separate risk for any agent that reads untrusted content.

What this means for your profession

The Personal Agent Protocol doesn’t require anything from most professionals today. What it does is signal where customer-facing work is heading: a growing share of the “customers” contacting a business will be agents acting for a person. Here is how that lands for five groups, with a first action each.

What this means for small business owners

For a small business, the practical effect is that your public information becomes your product. Agents that arrive as guests will read your returns policy, hours, stock and delivery terms. If they’re out of date, an agent will repeat the old answer to a customer. First action: audit the five facts customers ask most (hours, returns, delivery times, pricing, contact route) and make sure each appears in plain text on your site. Our Agentic Commerce for Business course walks through what to prepare, and the AI business automation course covers the workflows behind it.

What this means for online sellers and marketers

For sellers, PAP is one more reason that structured, accurate product and policy information matters more than clever copy. The standard says nothing about ranking, and nobody should sell you a “PAP optimization” service before a spec exists. First action: keep your catalog, returns and shipping information consistent across your site and marketplaces, which also helps the assistants that exist today. See our Amazon Rufus guide for the marketplace version of the same discipline.

What this means for customer support teams

Support is where Sierra’s roots are, and the protocol’s visibility idea matters most here. A team that can see “this contact is a personal agent acting for this customer with read-only access” can route and respond differently than to an anonymous chat. First action: decide now which actions your team would allow an agent to take (status checks, address changes, cancellations) and which always need a human. The Customer Service Excellence with AI course covers building those boundaries.

What this means for developers

If you build customer-facing systems, PAP is a spec to watch rather than ship. Coverage describes an OAuth-based design and a business-chosen service route (website, MCP/OpenAPI APIs, or your own agent), with a reference implementation promised after v0.1. First action: if you already run OAuth and expose APIs, note where per-action permissions would map onto your existing scopes, and read the v0.1 spec when it appears. The MCP Tools Mastery course and AI Agent Security course cover the adjacent skills.

What this means for freelancers and consultants

If you advise small businesses, expect questions like “do I need to do something about AI agents?” and be ready with an honest answer: nothing is required yet, and the useful work is cleaning up public information and writing a short agent-access policy. First action: build a one-page checklist for clients covering public facts, which actions are safe for an agent, and who reviews unusual requests. Our AI Agents Deep Dive course gives you the vocabulary.

Common misconceptions

“PAP means AI agents can now buy anything from any store.”

Not at this stage. The first version is about authentication and permissions, and payments are a planned extension. Agents buying things today rely on other mechanisms, such as the assistant-specific integrations covered in our agentic commerce guide.

“It’s Meta’s standard, so it only works with Meta’s AI.”

The announcement describes an open standard that anyone can implement, developed by Sierra and Meta with a range of partners. Whether it becomes widely adopted is a separate question that depends on who implements it. As of this writing, the OpenAI and Anthropic positions are unconfirmed.

“It will make AI agents safe.”

A permissions standard makes it possible to express limits and to see what an agent did. It doesn’t prevent mistakes, manipulated agents or a customer granting too much access. Treat it as plumbing for control, not as a safety guarantee.

“I need to implement it now.”

There is no published specification at the time of writing, so nothing can be implemented yet, and the roadmap lists several features as later extensions. Wait for v0.1, then check what your platform provider (Shopify, Stripe and others are named partners) plans to support.

The bottom line

The Personal Agent Protocol is an early, open attempt to give AI agents a proper front door to businesses, with the customer choosing what the agent may access and the business choosing what it may do. It is worth knowing about because the companies behind it are large and because the problem it targets is real. It is not yet a finished standard, a product or a reason to change your systems. Learn the vocabulary now, keep your public information accurate, and revisit this page after the v0.1 spec is published. If you want structured learning on the surrounding topics, the Agentic Commerce for Business course is a good starting point.

FAQ

What is the Personal Agent Protocol in simple terms? The Personal Agent Protocol (PAP) is a proposed shared rulebook for how a customer’s personal AI agent proves who it is to a business, starts a session, and gets read-only or write access to the customer’s account. Sierra and Meta announced it on October 6, 2026.

Who created the Personal Agent Protocol? Sierra and Meta are developing it together with industry partners. Sierra’s announcement names Genesys, Instinct, Rocket, Shopify, Stripe and Walmart; some outlets also list NiCE and Decagon.

Is the Personal Agent Protocol live yet? Not as a finished standard. At announcement, Sierra said a v0.1 specification was planned for later in October 2026, followed by design workshops and a reference implementation for developers. Check the published spec before building on it.

Does the Personal Agent Protocol handle payments? Not in the first version. Payments, push notifications and finer-grained per-action permissions are listed as future extensions.

How is PAP different from MCP? MCP is a way for AI systems to call tools and data sources. PAP is about the relationship between a customer’s agent and a business: identity, sessions and permissions. Coverage says a business can serve PAP agents through its website, through APIs built on standards such as MCP and OpenAPI, or through its own agent.

Do small businesses need to do anything about PAP now? No action is required today. Keep your returns policy, hours, stock and order-status information accurate and easy to find, and watch for the v0.1 spec and for your commerce platform’s announcements.

What Is the Personal Agent Protocol (PAP)? Plain-Language Guide (2026)

Table of Contents