What Is the Personal Agent Protocol? Meta and Sierra’s Plan Explained

The Personal Agent Protocol tries to fix an awkward problem. Personal AI agents can now shop, book and manage accounts. Yet most of them still work by pretending to be a person, clicking through web pages built for human eyes.

However, that approach is slow and fragile. It also makes it hard for a business to tell a helpful agent from a bad bot. As a result, some sites have started blocking agents outright. Amazon, for example, blocked Meta’s Muse agent from its shop, as we covered in Amazon blocks Meta Muse shopping.

So this explainer covers what the new standard proposes, who is behind it and what it could mean for you. It is based on the official announcement and reporting checked in October 2026. Because the specification is not yet published, some details may change.

What is the Personal Agent Protocol?

In short, it is a set of shared rules for a conversation between two parties. On one side sits your personal agent, the AI assistant that acts for you. On the other sits a company, such as a retailer, airline or insurer.

Sierra’s announcement, written by co-founders Bret Taylor and Clay Bavor, puts the goal in one line. Consumers decide what access to give their personal agents, and companies set the limits on what those agents can do.

Sierra is an enterprise AI start-up that builds agents for businesses. Meta, meanwhile, makes the Muse personal agent. So the two companies sit on opposite sides of the same exchange, which helps explain why they teamed up. Our explainer on Meta Muse covers that agent in more detail.

How does the Personal Agent Protocol work?

The announcement describes the flow in a few steps. However, the detailed technical rules will only arrive with the v0.1 specification.

1. Discovery. The process starts on the company’s website, where an agent can find out what the company offers and how to reach it.
2. Guest access. Next, the agent can begin as a guest. Sierra says that may be enough to check product availability or ask about a returns policy.
3. Sign-in. When the task needs your account, you either sign in on the company’s own page or use credentials already set up with your agent.
4. Permissions. Then access can stay read-only or include write permissions, such as changing a booking.
5. One continuous session. Finally, the session runs on OAuth, the standard behind many “sign in with” buttons. It carries across channels, so the time before and after sign-in counts as one visit.

That last point matters more than it sounds, because today an agent that switches from browsing to a support chat often starts from scratch. Under the proposal, the company would see one connected visit instead.

Which channels can agents use?

Companies would choose the routes they open to agents. Sierra’s post lists three:

• Websites, using ordinary web pages.
• APIs, built on existing standards such as the Model Context Protocol (MCP) and OpenAPI.
• Company agents, where your agent talks to the business’s own AI agent to get a task done.

In other words, the protocol does not replace MCP. Instead, it sits around it and handles who the agent is, who it acts for and what it may do. If MCP is new to you, start with our Model Context Protocol explainer.

Who is backing it, and who is missing?

Meta and Sierra say they are developing the protocol with Genesys, Instinct, Rocket, Shopify, Stripe and Walmart. That mix covers a large retailer, a major e-commerce platform, a payments company and contact-centre software.

Still, the gaps are just as notable. The announced list does not include Amazon, Google, OpenAI, Anthropic or Microsoft. Forkast called the absence of Amazon, OpenAI and Anthropic “the story of the week.” That matters, because a standard only becomes useful when both agents and websites adopt it.

There is also overlap with earlier efforts. For instance, The Next Web pointed out that Shopify and Stripe already back Visa’s Trusted Agent Protocol. So businesses may face several standards at once, at least for a while.

Personal Agent Protocol vs other agent standards

Meanwhile, several standards now tackle parts of the same problem. The table below compares them at a high level, based on each project’s own description.

Standard	Backed by	Main job	Status (October 2026)
Personal Agent Protocol	Sierra, Meta and partners	Agent sign-in, permissions and sessions with a business	Announced; v0.1 spec due later in October
Trusted Agent Protocol	Visa, with Cloudflare	Helping merchants recognise trusted shopping agents	Published October 2025 on GitHub and Visa’s developer site
Web Bot Auth	Cloudflare, based on IETF drafts	Cryptographic signatures proving which bot sent a request	Live for verified bots; some parts experimental
Model Context Protocol	Open standard used across many AI apps	Connecting AI assistants to tools and data	In use; supported by platforms such as WordPress and WooCommerce
Universal Commerce Protocol	Google and partners	AI shopping and checkout	Rolling out

Put simply, Web Bot Auth and Visa’s protocol focus on proving an agent is legitimate. By contrast, the Personal Agent Protocol focuses on the relationship after that: your consent, your account and the session. Our guides to AI agent payments and the Universal Commerce Protocol cover the payment side.

Why are websites blocking AI agents?

Indeed, the protocol arrives at a tense moment. In an October 6 report, TechCrunch described how hard it has become for agents to get through the door. It noted that Amazon blocked Muse in September, and that some companies’ terms restrict automated tools.

Businesses have fair reasons for caution. An agent that clicks through pages looks a lot like a scraper or a fraud bot. Also, companies lose control of the customer experience when a third party sits in the middle.

On the other hand, blocking every agent risks turning away real customers. That is the gap the Personal Agent Protocol aims to close: a way for a site to say yes to verified agents acting with a customer’s permission.

What does the Personal Agent Protocol mean for users?

For now, nothing changes. There is no app to install and no setting to turn on. The specification is still a draft, and no company has announced a consumer launch.

If the standard catches on, though, you could notice a few things:

• Your agent may show a sign-in screen from the company itself, much like “Sign in with Google” today.
• You may see clearer choices about read-only versus write access.
• Tasks that span browsing and a support chat could feel like one conversation.
• Fewer agent tasks may fail on CAPTCHAs or blocked pages.

For example, Sierra lists tasks such as scheduling appointments, booking flights and shopping for car insurance. Those are exactly the multi-step jobs where agents break down today.

Privacy and security questions to watch

A standard for agent sign-in is, by design, a standard for handing over account access. So the details deserve scrutiny once the specification appears.

First, look at how permissions are scoped. The announcement lists “granular permissions” as a future extension, which suggests the first version may be fairly broad. Second, check how you revoke access. OAuth normally lets you remove an app’s access later, but each company will implement that differently.

Third, consider credentials stored with your agent. Sierra says customers can use credentials already set up with their personal agent. That is convenient. Even so, it concentrates risk in one place, so a strong password and two-step verification on your agent account become even more important. Our guide to Sign in with ChatGPT covers similar trade-offs.

Finally, watch for scams that borrow the name. A new standard with a trustworthy-sounding title is an easy hook for fake “agent verification” messages. No legitimate service needs your password sent by email or text.

What comes next?

Sierra says it will publish the v0.1 specification later in October 2026. It also plans design workshops with interested parties and a reference implementation that developers can copy.

In addition, several extensions are already on the list. These include granular permissions, push notifications for events such as flight delays or shipping updates, and payments without sharing card details. Payments are notably not part of the first version, so settlement stays with existing systems for now.

Ultimately, the key test is adoption. If large retailers, airlines and the major AI assistants sign on, the Personal Agent Protocol could become the default handshake between agents and businesses. If not, it may remain one of several competing proposals.

Personal Agent Protocol: FAQs

Sources

• Sierra, “Introducing Personal Agent Protocol” (October 6, 2026)
• The Next Web, “Sierra announces Personal Agent Protocol, an open standard for personal AI agents” (October 6, 2026)
• TechCrunch, “The next hurdle for AI agents: getting websites to let them in” (October 6, 2026)
• Forkast, “Sierra and Meta’s Personal Agent Protocol gives commerce a common front door” (October 2026)
• Visa via Business Wire, “Visa Introduces Trusted Agent Protocol” (October 14, 2025)
• Cloudflare Docs, “Web Bot Auth” (accessed October 2026)