Imagine a world where your personal AI assistant can buy your groceries, rebook a cancelled flight, process a warranty claim, and check your bank balance — all without you lifting a finger, and without any of those companies ever seeing your password. That world is closer than you think. On October 6, Meta and Sierra announced the Personal Agent Protocol (PAP), an open standard that could become the foundational infrastructure for AI-driven commerce — and the early signs suggest the stakes couldn’t be higher.
The Problem Nobody Was Talking About
For the past year, as AI agents have gone from demos to daily drivers, a quiet infrastructure crisis has been building. When your AI assistant tries to check your flight status, track a return, or reschedule a dentist appointment, it faces a fundamental problem: it’s pretending to be you.
Right now, most AI agents interact with business websites the same way a human does — they load pages, click buttons, fill forms. It works, barely, until it doesn’t. A CAPTCHA stops them cold. An unusual checkout flow confuses them. A two-factor authentication prompt requires a human to step in. And when something goes wrong — a duplicate order, an unauthorized change to an account — there’s no audit trail that shows an agent did it. The transaction looks like it came from you.
Sierra co-founder Bret Taylor described the current state bluntly: “It is kind of chaos until such a standard exists.”
That chaos has real numbers behind it. Adobe Analytics tracked a 4,700% increase in AI-driven traffic to U.S. retail websites in the single year ending October 2025. Gartner predicts that by 2028, 80% of organizations will see AI agents consuming the majority of their APIs. The plumbing for handling that traffic simply does not exist yet.
What the Personal Agent Protocol Actually Does
PAP is, at its core, a new way for an AI agent to introduce itself to a business and declare what it wants to do. It builds on OAuth — the same authentication layer that powers “Sign in with Google” across the web — but extends it to handle the specific needs of agent interactions.
The protocol defines three tiers of access:
Guest access requires no authentication. An agent can check product availability, read a returns policy, or look up store hours without ever logging in. This mirrors what any human visitor can do without creating an account.
Read-only authenticated access allows an agent to look at account-specific information — order history, loyalty points, upcoming reservations — after the user has granted permission. Critically, authentication happens on the business’s own page, meaning the agent receives a scoped OAuth token, not a password.
Write access unlocks the ability to take action: place orders, process returns, modify reservations. The user explicitly grants this capability, and the business sets the outer limits of what any agent can do.
Businesses can implement PAP through three routes: through their existing website (which any agent can navigate once it announces itself), through APIs built on MCP or OpenAPI standards, or by routing agent traffic to their own conversational customer service agent for complex tasks like warranty claims or complaint resolution.
The effect, if it works, is elegant: agents stop pretending to be humans, businesses know exactly who is acting on behalf of which customer, and every action is traceable to a specific agent with specific permissions.
Six Launch Partners and Thirty-Five More
When Sierra and Meta published the initial announcement, six companies signed on as launch partners: Shopify, Stripe, Walmart, Genesys, Rocket, and Instinct. By October 9, when Sierra published its draft v0.1 specification, that list had expanded dramatically — 35 additional design partners joined, including OpenAI, PayPal, Visa, and Mastercard.
That roster matters for several reasons. OpenAI’s participation is notable: Bret Taylor chairs the OpenAI board while co-founding Sierra, and there had been quiet speculation about whether model providers would rally around PAP or build competing approaches. PayPal, Visa, and Mastercard’s involvement suggests the payments layer — which PAP deliberately deferred for a future extension — is already being planned in parallel.
Genesys CEO Tony Bates framed the business case clearly: PAP gives merchants the ability to know who an agent represents, what it may do, and what its intent is before they let it interact with their systems. That’s information businesses currently have no reliable way to obtain.
Meta’s David Singleton set an even more ambitious frame, comparing PAP’s long-term ambition to email — a set of rails that both personal and business agents can run over, regardless of who built them.
The Missing Chairs
Not everyone came to the table. Amazon — one of the largest retail platforms in the world — is conspicuously absent. The omission is not accidental. Amazon has already moved to block Meta’s AI agents from accessing its platform, and in a separate legal action, sued Perplexity AI over content scraping that reportedly affected Amazon-affiliated publishers. Taylor has said he expects Amazon to eventually participate, but there is no timeline and no indication Amazon sees this as its problem to solve.
The absence of Anthropic is less surprising — it’s a model provider rather than a platform — but still noteworthy given how widely Claude is deployed as a personal agent across consumer and enterprise products.
A deeper problem may be adoption fragmentation. PAP is not the only protocol trying to solve this space. Visa has TAP (Transaction Agent Protocol), Google has UCP (Universal Commerce Protocol), and OpenAI has ACP (Agent Commerce Protocol) — a separate effort from PAP, despite OpenAI’s design partner status on PAP itself. Stripe and Shopify, both PAP launch partners, are also backing at least two of these competing standards simultaneously.
This isn’t necessarily fatal — TCP/IP itself emerged from a field of competing network protocols — but it means that merchants trying to build agent-ready infrastructure face a genuine dilemma about which standard to build for first.
The Trust Gap
The hardest number in this entire story has nothing to do with technology. A Wall Street Journal survey conducted earlier this year found that only 3% of U.S. adults trust an AI agent to complete a purchase on their behalf. About a third of active AI users said they would never allow an agent to buy for them under any circumstances.
That number puts the entire PAP architecture in an unusual position. The technical infrastructure is arriving before the social permission to use it. PAP can solve the “how does an agent authenticate” problem. It cannot solve the “do I actually want an AI spending my money” problem.
The protocol’s designers appear to understand this. The explicit tiering of access — from read-only to write, requiring explicit user grants at each level — is designed to build trust incrementally. You might let an agent check your order status long before you let it place one. And the design decision to keep authentication on the business’s own page, rather than delegating it to the agent, is a security choice that also carries a symbolic message: the human stays in control of the credential.
What Comes Next
The v0.1 specification is due later in October 2026, alongside reference implementations and design workshops. Payments — the feature that would make PAP most transformative for commerce — remain a future extension. So do finer-grained permissions, push notifications for shipment updates, and the identity-proof and token-revocation mechanics that security researchers have already flagged as gaps.
The governance question is also unresolved. Who owns this standard? Sierra and Meta co-developed it, but there’s no announced independent standards body, no open-source foundation stewardship, and no published license for the specification itself. Those details will matter enormously as the protocol either becomes infrastructure or becomes a Meta product with an open API.
What’s clear is that the infrastructure gap PAP addresses is real and growing. AI-driven retail traffic up 4,700% in a year is not a trend that stops because the plumbing hasn’t been built yet. It means millions of agents are currently hammering business websites with human-impersonating traffic that businesses can’t distinguish from bots, can’t route to appropriate systems, and can’t hold anyone accountable for.
The Personal Agent Protocol won’t solve all of that. But it’s the most credible public attempt to build the layer that makes AI-driven commerce legible — a way for machines to say who they are, what they want, and who sent them.
Whether that’s enough to become the TCP/IP of AI commerce, or just one more protocol in a fragmented field, will depend on whether Amazon builds a door — and whether users decide they trust what walks through it.
