One Login for Every Store: Meta and Sierra Publish the Personal Agent Protocol

The most boring-sounding AI announcement of the week may also be the most consequential. On October 6, 2026, Sierra and Meta published a joint proposal called the Personal Agent Protocol (PAP): an open standard that defines how personal AI agents authenticate with businesses — and what those businesses allow them to do once inside. The founding partner list reads like a commerce supply chain in miniature: Walmart, Shopify, Stripe, Rocket, Genesys and Instinct. A v0.1 specification is due before the end of October.

If that sounds like plumbing, it is. But it is the same kind of plumbing that made the consumer web usable. Before OAuth, every app wanted your email password. Before TLS-everywhere, checkout pages leaked card numbers. The industry is now confronting the equivalent gap for agents: when your AI assistant walks into Walmart’s website on your behalf, how does Walmart know it is really acting for you — and how much should it be allowed to touch?

What the protocol actually specifies

The Personal Agent Protocol is built on OAuth, the same delegated-authorization framework that lets you “Sign in with Apple” without handing Apple your password. The design is deliberately tiered:

• Guest access. An agent can start unauthenticated — checking stock availability or reading a returns policy, the way an anonymous browser session works today.
• Authenticated, read-only. Once the customer signs in, they decide whether the agent gets read-only visibility (order history, tracking status) or write access (changing an order, starting a return).
• Write access. The highest tier, granted explicitly, letting the agent act rather than merely look.

Two design choices stand out. First, sessions carry across channels: a question asked before login and an order modified after login belong to a single visit, so the business and the agent share one continuous thread of context rather than a fragmented trail. Second, the company chooses the integration surface. As the Sierra announcement by Bret Taylor and Clay Bavor puts it, the business decides “whether the agent works through its website, through its APIs using standards such as MCP and OpenAPI, or through an agent of its own.” That is a quiet but important concession — PAP does not force anyone to expose an API; a scraped website session is a first-class citizen too.

The people behind it

The protocol’s lineage matters. Bret Taylor — Sierra’s co-founder and, in a striking dual role, chairman of OpenAI’s board — is leading the initiative alongside Clay Bavor, his Sierra co-founder. That ties agent-commerce standardization directly to OpenAI’s platform interests, the same company whose ChatGPT agents are among the most likely clients of such a protocol. Meta brings Muse, its personal agent that launched roughly four weeks ago and already pays for things using saved cards through Stripe’s Link. Rocket’s statement around the launch describes Muse moving across its platform “from finding a home to arranging the financing” — presumably the exact user journey PAP is built to make routine.

Sierra’s commercial stake is equally clear: the company sells conversational agents to enterprises, and personal agents that stall at login screens are a ceiling on that market. If your customers’ agents cannot authenticate into your support and commerce stack, Sierra cannot sell you the other half of the conversation.

Visa is not going away

The awkward detail: this is the second agent-commerce standard to court the same partners inside four months, and the rival got there first. Visa’s Trusted Agent Protocol, launched in June 2026, already lets agents buy from roughly 175 million merchants, with Microsoft, Stripe, Shopify and Worldpay signed on. Stripe and Shopify are now in both camps — a hedge that suggests the payment rails expect this to settle into a multi-standard world, or are simply unwilling to pick a winner before one emerges.

The Sierra roadmap is explicit that payments are not in v0.1. Push notifications and more granular permissions are also deferred to future extensions. That omission is less a gap than a sequencing choice: authentication is the prerequisite layer, and bolting payments onto an unverified identity model would repeat the card-not-present fraud problems of the 1990s internet. There is also a regulatory wall: in Europe, a payment approved by software on someone’s behalf has no carve-out from strong customer authentication rules, which were written for a person approving a transaction tied to a named payee and an amount. Notably, no European retailer, bank or payment company has been named among the founding partners — Stripe, with its dual San Francisco–Dublin headquarters, is the closest thing to European representation.

The race nobody planned

Perhaps the sharpest observation comes from the early reporting: agents are arriving faster than the arrangements they will operate under. On the same morning the protocol was announced, Hark released an agent that buys groceries, books cars and pays bills — a full year before its hardware is due to ship. Meanwhile, TechCrunch’s reporting shows Cloudflare’s September 15 crawler-default changes are already breaking personal agents at Walmart, eBay, Delta and Yelp, before the protocol has any enforcement mechanism at all. The near-term battle is not retailers deliberately refusing agents; it is infrastructure accidentally rejecting them.

That is the real problem PAP is positioned to solve. A personal agent that identifies itself as a rogue crawler gets blocked at the edge. A personal agent that presents a verifiable, user-consented OAuth session is a customer — with all the rights and auditability that implies. The standard, in other words, is not just a convenience. It is the difference between agents being treated as traffic to filter and traffic to serve.

What to watch

The v0.1 spec lands later in October, and three things will tell you whether PAP becomes infrastructure or slide-ware. First, whether the OAuth tiers survive contact with real compliance teams — write access for an agent at a regulated merchant is a harder sell than a returns-policy lookup. Second, whether the payments extension arrives with bank partners or gets leapfrogged by Visa’s incumbent rails. Third, whether Cloudflare and the other edge providers build PAP awareness into their bot-management products; without edge-level recognition, the protocol is a contract nobody at the network layer can read.

For now, the direction is unmistakable. The industry that spent two decades teaching humans to log in is now writing the login for software — and the companies that own that layer will own a meaningful slice of agent commerce. Meta and Sierra just made the first serious, open bid for it.