Picture your AI assistant booking a flight for you. Now picture how it actually does it: loading the airline's website like a bleary-eyed traveler at 2 a.m., squinting at forms, clicking buttons, getting stuck on a bot check, and occasionally getting your account flagged for suspicious activity. For all their brilliance, today's AI agents interact with the commercial internet the way a tourist navigates a foreign city, by pointing at things and hoping.
On October 6, at Sierra Summit in San Francisco, Sierra co-founders Bret Taylor and Clay Bavor announced a plan to fix that. Working with Meta, they proposed the Personal Agent Protocol, or PAP, an open standard that defines how a personal AI agent introduces itself to a business, proves who it works for, and gets permission to act. Sierra calls it open for anyone to implement. If it catches on, it would give the agent economy something it has never had: a front door.
The problem: your agent shops like a tourist
Personal AI agents are no longer demos. People already use them to schedule appointments, book travel, compare insurance quotes, and reorder groceries. But under the hood, the machinery is primitive. Most agents do their business the way a person would, by driving a browser: loading pages, reading forms, clicking submit. When the page changes or a verification challenge appears, the plan falls apart.
Businesses have responded the way institutions always respond to strange visitors: with suspicion. Major platforms have suspended accounts over agent-driven activity, and retailers and service companies have written rules that prohibit unauthorized automated traffic outright. The result is a standoff that serves nobody. The customer arrives ready to spend money, and the store treats the customer's assistant like a shoplifter.
This is the gap the protocol is aimed at. There is no agreed way for an agent to say, truthfully and verifiably, that it is acting for a particular customer and that this customer allowed it to do specific things. Every company improvises its own answer, or simply says no.
How the handshake works
Enjoying this story?
Get the five most important stories in tech, every morning. Free.
The proposed session works like a well-run front desk. It starts on the company's own website, where the agent discovers what the business offers. A guest agent can handle light tasks without anyone logging in, things like checking whether an item is in stock or reading the returns policy. For anything tied to an account, the customer signs in and chooses what the agent may do: read-only access, or write access that can actually place orders and change things.
Three design choices matter. First, the session is built on OAuth, the same sign-in plumbing that already powers login buttons across the web, so companies are not being asked to adopt a brand-new identity system. Second, permissions carry across channels: a question asked before sign-in and an order changed after sign-in count as one continuous visit. Third, and most important, the company sets the limits. Each business decides which of its surfaces agents may touch, and what they may do there.
It is kind of chaos until such a standard exists.
That is Bret Taylor, Sierra's co-founder, speaking to CNBC about the announcement. He has a vantage point few can claim: in addition to running Sierra, Taylor serves as chairman of OpenAI, the company whose models power a large share of the agents this protocol is meant to govern.
Who is in, and who is not
Three Routes to the Front Door
How a business can meet a personal AI agent under the proposed protocol.
Note: Based on the announced protocol design; the v0.1 specification is pending.
The founding coalition is built for commerce. Sierra's announcement named Walmart, Shopify, Stripe, Rocket, Genesys, and Instinct. Meta's David Singleton posted the news with a slightly different list, swapping Instinct for NiCE and Decagon, which puts ten companies on the combined roster so far. The mix is deliberate: payments infrastructure, retail scale, and customer-service operations, the three things an agent needs to actually complete a purchase.
On October 9, Sierra followed up with a draft of the protocol, known by the codename Poppy, and named 35 additional design partners, including OpenAI, PayPal, Mastercard, Visa, Bank of America, and Cloudflare. The money, in other words, is paying attention.
Two names are conspicuously absent from the formal roster. According to CNBC, neither OpenAI nor Anthropic has signed on, though Taylor said he expects both to join. Their absence is the story inside the story: a standard for agents is far more valuable if the companies building the most-used agents bless it, and far easier to ignore if they do not.
The stack is filling in
PAP does not arrive into a vacuum. It lands as the third layer of an agent infrastructure stack that has been assembling all year. At the base sits the Model Context Protocol, which standardizes how agents connect to tools and data sources, and which by some counts now sees more than 500 million monthly SDK downloads. Above it sit agent-to-agent protocols, backed by more than 150 organizations, that let autonomous systems talk to each other.
What was missing was the layer that faces the customer: identity, authentication, and permission. That is the gap PAP is designed to fill. The stack now has a shape: tools at the bottom, agent chatter in the middle, and a governed front door on top.
What could go wrong
The honest caveat is that the standard does not exist yet, not really. Sierra has published a draft and promises a version 0.1 specification later in October, along with design workshops and a reference implementation. Payments and push notifications are listed only as possible extensions. What has been announced is an architecture and a coalition, not a finished spec.
History counsels skepticism. The tech industry has a long tradition of open standards that turn into turf wars, with rival versions, partial implementations, and a slow drift toward whoever holds the most leverage. "Open for anyone to implement" is a good slogan. It is also what every consortium says before the forking begins.
And then there is the demand side. A handshake requires two parties, and plenty of businesses currently prefer the wall. Companies that have spent years building bot defenses and writing terms of service against automated traffic will need a reason to open a door on purpose. The pitch is that the visitor on the other side is a customer with a wallet. Whether that pitch beats the fear of fraud, scraping, and lost control will decide how far this goes.
What to watch
The next milestone is concrete: the version 0.1 specification, expected later this month, and whether it arrives with the reference implementation Sierra has promised. After that, watch for who actually implements it. A protocol with Walmart and Shopify on the letterhead is interesting. A protocol with their checkout flows actually accepting agent sessions is transformative.
Watch, too, for the two missing signatures. If OpenAI and Anthropic join, PAP becomes the default grammar of agentic commerce. If they build their own, the chaos Taylor described gets a second dialect.
For now, the most important thing about the Personal Agent Protocol is that it exists as an idea with heavyweight backing. The agent economy has spent two years learning to think. This week, it started learning to knock.
186 Comments