Meta and Sierra have proposed the Personal Agent Protocol, an open standard for how consumer AI agents deal with businesses. Genesys, Instinct, Rocket, Shopify, Stripe and Walmart are already participating. Sierra says it will publish a v0.1 spec and a reference implementation later this month.
It's early, and a proposal isn't a standard. But the list of names matters. When a payments company, a commerce platform and the biggest retailer in the US all show up for the same draft, you should assume the shape of it is going to stick.
What the protocol actually covers
From what's been published so far, the scope is narrow and practical. It handles three things.
- Agent identification. A business can tell that the thing knocking on the door is an agent, and whose agent it is.
- Authentication for account actions. OAuth-based, so an agent acting for a customer gets scoped access instead of a shared password.
- Read-only versus write access. Checking an order status is a different permission from cancelling one.
It's meant to work across websites, APIs built on MCP and OpenAPI, and company-run agents. Payments and push notifications are listed as possible later extensions, not part of v0.1.
That last point is worth sitting with. The first version is about identity and permissions, not checkout. Which tells you where the hard problem actually is.
Why this lands on your roadmap
Right now, most businesses handle agent traffic by accident. An agent hits your site, scrapes a page, maybe fills a form, and your bot detection either blocks it or doesn't. There's no policy. There's just whatever your WAF did that day.
A shared protocol changes that from an accident to a decision. Once agents can announce who they are, you have to answer questions you've been dodging:
- Which actions can an agent take on behalf of a logged-in customer without a human confirming?
- Which of those are read-only, and which can change money or data?
- How do you revoke an agent's access when the customer asks you to?
If you can't answer those today, you're not ready for v0.1, and neither is anyone else. Better to find out now.
What we'd do this month
Don't wait for the spec to be final. The work that makes you ready is work you'd want anyway.
Audit your write actions. List every endpoint that changes state: refunds, address changes, cancellations, plan upgrades. Mark which ones need a human in the loop no matter who is asking. Most teams find at least a few that were never designed to be called by anything but a browser session.
Get your OAuth scopes honest. If your API has one scope called all, an agent protocol will expose that fast. Split read from write. Split low-risk writes from money-moving ones.
Make your API spec the source of truth. Agents will read your OpenAPI file or your MCP server before they read your marketing page. If the spec is stale or missing, the agent guesses. Guessing agents are expensive to support.
Log agent traffic separately. You will want to know how many orders, refunds and support requests come through agents, and what the error rate looks like compared to humans. You can't tune what you can't see.
The Shopify angle
If you run a store, the participation of Shopify and Stripe is the signal to watch. Agent checkout is moving from experiment to default behavior on the platform side, and merchants are the ones who carry the risk when an agent does something odd. Clean product data, clear return policies in machine-readable form and sane permission boundaries will matter more than another storefront redesign.
None of this needs a new framework. It needs someone to sit down and decide what an agent is allowed to do in your product, then write it down in a form a machine can read.
The protocol will settle the format. You still have to supply the policy.
We're here to help founders and teams design and build digital products that are built to scale with you, not slow you down. If you're looking to build something, get in contact with us today!