Meta and Sierra launch Personal Agent Protocol - open standard for AI shopping agents

PAP is not a new payments rail or a new browser API - it is an open standard meant to dictate how AI agents interact with businesses, developed by Meta and Sierra together with Genesys, Instinct, Rocket, Shopify, Stripe, and Walmart^[1]. Structurally it's a permissioning layer bolted onto OAuth: a personal agent first shows up at a business as a guest with read-only access. Only once the human customer signs in does the agent get upgraded to write access, and that authenticated session is designed to persist across channels, whether the agent is hitting the company's website directly, calling it through MCP or OpenAPI, or routing through the company's own in-house agent^[2]. Meta frames this as deliberately unglamorous infrastructure rather than a product: Meta Superintelligence Labs VP David Singleton, a former Stripe CTO, described it as "rails that we hope personal agents and business agents can run over for the future"^[3]. The pitch is that businesses get an audit trail and an on/off switch for agent access, and agents get a consistent way to prove who they are acting for - the exact thing that was missing when Amazon caught Muse browsing without identifying itself.

The direct trigger for PAP sits twelve days earlier. Meta launched Muse on September 8, 2026, giving it the ability to open a browser, fill out forms, and complete checkout on a user's behalf^[4]. On September 20, Amazon began blocking Muse from shopping on its site, telling users the integration violated its Conditions of Use because Meta had never disclosed or sought authorization and the agent did not identify itself as AI while browsing^[4]. Amazon's own framing was that third-party agents making purchases "should operate openly and respect service provider decisions about whether or not to participate"^[6]. Amazon was far from alone - reporting around the same period found Yelp, eBay, Zillow, Pizza Hut, Adidas, United Airlines, and Delta all restricting or blocking automated agent traffic, turning a single platform fight into an industry-wide access problem^[5]. The stakes for Meta are not small: Citigroup estimates Muse could generate roughly $27 billion in revenue by 2030, split between transactions and subscriptions, and already counts 6.6 million cumulative downloads and 1.8 million daily active users^[7]. A standard that gets agents let back in the door is worth building fast.

The same day PAP was unveiled, Decagon open-sourced its own, overlapping Personal Agent Consent and Trust Protocol (PACT), co-developed with Instinct and also built on OAuth^[8]. That is not a coincidence so much as a signal: multiple companies are racing to be the ones whose identity and consent layer other agents end up authenticating through - and the reaction on X made that land-grab dynamic visible in real time, with both Bret Taylor's and Decagon's own announcement posts drawing strong engagement. PAP itself joins an already crowded field - Visa and Cloudflare back a rival Trusted Agent Protocol, Google has its own Universal Commerce Protocol, and OpenAI backs an Agentic Commerce Protocol built with Stripe - and Stripe and Shopify are each hedging by participating in several of these camps simultaneously^[9]. The handful of early YouTube explainers covering the launch made the same point, slotting PAP alongside several other agent-trust and agent-payments efforts that happened to launch the same week, including AgentMail's AgentID, Decagon's PACT, and HTTP 402 agent payments. Commentary around the launch put the underlying tension bluntly: whoever writes the authorization standard effectively decides who gets to walk through the door, even as every participant insists the layer is neutral. Constellation Research's Larry Dignan is skeptical the spec's ethical safeguards survive contact with agents that find it advantageous to route around them, and points out that no European retailer, bank, or payment company has joined PAP or its rivals yet^[10].

PAP is launching into a market that does not trust agentic commerce yet: only 3 percent of US adults say they trust AI agents to complete purchases, and about a third of active AI users say they would never allow an agent to buy anything for them^[6]. That skepticism shows up in public conversation too, though not quite where you'd expect: direct discussion of the protocol itself has been thin so far, and the broader Reddit conversation has centered less on PAP as a technical standard and more on its root cause, the Amazon/Muse dispute, with sentiment split between sympathy for Amazon's stated data-access concerns and skepticism that Amazon's real motive is competitive self-interest. A smaller, more analytical thread has gone further, framing the standoff as the first real-world test case for agent-permission conflicts and asking which layer - user, platform, or agent - ultimately gets final say. Banks got there first with caution rather than code - six major banks published voluntary trusted agentic commerce principles on September 22, with Bank of America's Mark Monaco warning that building confidence "will require thoughtful approaches to identity, authorization, fraud prevention, liability management and customer protection"^[11], while Crone Consulting's Richard Crone argues banks risk losing control of discovery and payment selection to AI agents and large language models if they move too slowly^[11]. PAP itself is further behind than the announcement suggests: there is no published v0.1 specification yet (promised later in October 2026), no license, no governing body, and no reference implementation, with payments and fine-grained permissions explicitly pushed to a later extension^[9]. The most pointed irony is that Sierra's Bret Taylor chairs OpenAI's board yet OpenAI has not joined PAP, instead backing its own Agentic Commerce Protocol with Stripe - Taylor has said he would be disappointed if OpenAI and Anthropic built around something else rather than adopting this standard^[6].