I can instruct an AI assistant to reorder my dog’s food, and it will try. Whether the store lets it complete the order is another matter, and no one has decided who is responsible if the wrong bag arrives.
Sierra and Meta are addressing that issue through the Personal Agent Protocol, or PAP, an open standard outlining how personal AI agents should interact with companies. Walmart, Shopify and Stripe have signed up, and a first version of the specification is due by the end of October. Since I use AI assistants on a daily basis, I am optimistic about this one; it is about plumbing, and plumbing is what turns a clever demonstration into something people can actually rely on.
What PAP does
Today, most agents use a website the way a person would: they load the page, look for the button and click it, and they break whenever the retailer redesigns its checkout. PAP proposes a proper handshake instead. The agent should state its identity, the business then decides what the agent can do, and the customer decides how much freedom the agent is given.
The Next Web’s write-up describes the main pieces:
- The sessions use OAuth, which is the standard associated with ‘Sign in with Google’.
- An agent can start as a guest, without signing in, to check stock or read the returns policy.
- Once a customer signs in, they choose whether the agent gets read-only or write access.
- Sessions carry across channels, so a question asked before sign-in and an order changed afterward count as one visit.
- Businesses choose the entry point: their website, their APIs (the write-up mentions MCP and OpenAPI) or an agent of their own.
- Businesses can see what agents are doing on their sites.
That last point deserves more attention than it is getting. Retailers have spent twenty years trying to tell bots from real shoppers. If they can identify and log “an agent acting on behalf of a real customer” as its own category, fraud and customer service teams get something solid to work with.
Why the guest mode is clever
Most questions people ask a shopping assistant need no account. For example, is the jacket available in my size? How long is the return period? Does it ship to Canada? The assistant can answer all of them without a login and ask for one only when something personal comes up.
Developers will recognize this as the principle of least privilege applied to a new kind of client. For everyone else, it is a simple promise: your agent should not need the keys to your whole account to check a shipping date.
What is missing in version 0.1
The draft treats payments as a later extension, along with push notifications and more detailed permissions. That means the protocol can say who an agent is and what it may read or change, but it cannot yet say who approves a $400 purchase or what happens when the agent picks the wrong size.
That is a real gap, because agents already pay for things. Meta’s Muse agent, which launched in early September, pays with saved cards through Stripe’s Link. A startup called Hark has built an agent that buys groceries, books cars, and pays bills. The products are already out, and the rules around them are still being written.
There is already a rival
Visa runs its own Trusted Agent Protocol, which it connected to ChatGPT in June 2026. By Visa’s count, that gives agents access to about 175 million merchants. Microsoft, Stripe, Shopify and Worldpay joined early.
Yes, Stripe and Shopify appear on both lists. Large platforms tend to back both standards while two are forming, and I would not read much into it. We have seen this before: competing specifications, partners joining all of them, and in the end either one winner or a bridge between them. If you build for commerce, keep your agent layer thin enough to replace, because tying your architecture to one specification this early looks risky.
Europe has questions
The Next Web article raises a legal problem that the announcement left out. Under the EU’s PSD2 rules, online payments need strong customer authentication, and those rules assume a person approving a specific amount to a named payee. An agent that restocks something on a standing instruction doesn’t fit that picture, and as far as the article could tell, no exemption applies to software approving payments on a person’s behalf.
The article also points out that Stripe, which runs dual headquarters in San Francisco and Dublin, is the only named partner with a European headquarters. The article lists no European retailer, bank, or payment company as a participant. If PAP is meant to work outside the United States, somebody will need to bring regulators and European firms into the conversation. In the article’s words, the agents are arriving faster than the arrangements they will work under.
What to do with this
If you are a developer, keep an eye out for the v0.1 specification. A site that already offers an API through MCP or OpenAPI is closer to compatible than one that relies on scraping, and a useful first step is to list which actions an agent could safely read and which it could change.
If you run a store, decide how you want agents to reach you and what you want to log. PAP’s visibility feature suggests you can measure agent traffic.
Shoppers should expect permission screens much like the ones on a phone, with read-only access as the sensible default until you understand how refunds and disputes work.
If you manage a product, the question is no longer whether agents will buy things, because they already do. What matters is whether your product makes sense to a machine, with clear inventory data, policies it can read, and a checkout that behaves the same way every time.
Three things to watch
First, how quickly the payments extension arrives. Until it does, agents will keep relying on stored cards. The second is whether PAP and Visa’s protocol end up linked. The third, and the hardest, is who takes the blame when an agent makes a mistake. A specification can define permissions, but the courts and the card networks will decide who is at fault.
The partner list is growing quickly. Sierra has since published a draft and named 35 more design partners, including OpenAI, PayPal, Visa and Mastercard. Having both sides of the payments contest in the same group suggests that the industry would rather agree on a shared language now than argue about it after the first large chargeback caused by an agent.
When the v0.1 specification arrives, read it. If your customers might one day hand your product to an agent, it describes the front door you will need.
