Meta and Sierra want a standard for your personal AI agent. The spec is not written yet.

What Meta and Sierra actually announced

On 6 October 2026, Sierra co-founders Bret Taylor and Clay Bavor published a post announcing Personal Agent Protocol, an open standard they are building with Meta "along with industry partners at Genesys, Instinct, Rocket, Shopify, Stripe, and Walmart." The job it claims is narrow and genuinely unfilled: define how a personal AI agent proves whose errand it is running, and what that agent is allowed to do once a business lets it through the door.

The problem statement is the strongest part of the post. Right now an agent acting for you mostly does what you would do. It loads the page, clicks the form, and when that fails it opens the web chat or calls the support line. Sierra's argument is that this "can take a long time, and the agent might fail to complete the task," where a direct connection "could get the same task done securely in seconds." Anyone who has watched an agent lose a session halfway through a checkout flow will recognize it.

What did not arrive on 6 October is the standard. The post says the team plans to publish the v0.1 specification "later this month," then host design workshops and publish a reference implementation. Eight named companies, nothing yet to implement.

How the permission model is meant to work

The flow starts on a company's website, where the agent discovers what the company offers and how to reach it, then opens a session on its user's behalf. That session can begin as a guest, which Sierra says may be enough to check product availability or ask about a returns policy. When a task needs account access, the customer either signs in on the company's own page or uses credentials already held by their agent, and then decides whether the agent gets read-only or write access. The session is built on OAuth, and it carries across channels, so a question asked before sign-in and an order change made afterward count as one visit.

From there the agent takes whichever route the company chooses to open: the website itself, APIs built on standards such as MCP and OpenAPI, or the company's own agent for tasks that need conversation, such as a warranty claim.

That is a sensible design, and the guest and read-only tiers are the parts consumers should care about. Letting an agent check a returns policy without logging it into your account beats today's all-or-nothing reality.

Walmart, Shopify and Stripe have now endorsed three of these

Here is the context the announcement does not supply.

Google published the Universal Commerce Protocol on 11 January 2026, built "in collaboration with industry leaders including Shopify, Etsy, Wayfair, Target, and Walmart" and endorsed by more than 20 partners including Stripe, Visa, Mastercard, Adyen and American Express. Separately, Stripe and OpenAI maintain the Agentic Commerce Protocol, described on its own site as "an open standard for programmatic commerce flows between buyers, AI agents, and businesses," published under an Apache 2.0 license, with Stripe's Shared Payment Token as the first compatible payment method and ChatGPT as the first AI platform to implement it.

So Shopify, Walmart and Stripe are now named on Google's standard and on Meta's. Stripe co-wrote a third.

The charitable reading is that these are different layers. UCP covers discovery, cart and checkout and is built to work with the Agent Payments Protocol. ACP executes a payment inside an AI surface. Personal Agent Protocol covers identity, authorization and session continuity, with payments listed only as a possible future extension. On that reading a merchant could run all three.

The less charitable reading is that a supportive quote and a logo cost a large retailer almost nothing, and that backing every standard is what a company does when it does not know which one will win. Both readings are available because no spec has been published. That is the honest state of play.

What you are agreeing to when you grant write access

Write access is the part worth slowing down on, because the protocol is designed to make it easy.

Meta's own Muse announcement, dated 8 September 2026, says the agent "can open a browser, fill out forms, and negotiate on their behalf," and that it can check out using Link built by Stripe. Personal Agent Protocol would let an agent like that skip the browser entirely and talk to the business directly, with your account open on the other side.

That removes a bottleneck, and it also removes friction that was quietly doing some safety work. An agent with write access on an airline account can change a booking. An agent reading a page it did not write can be fed instructions hidden in that page, the failure mode we explained in prompt injection. A faster connection does nothing to improve the agent's judgment once connected, and Sierra's post is explicit that the permissions that would let a customer cap specific actions are future work.

What is real on 7 October 2026

Strip out the quotes and the list of logos, and here is the inventory: a design document, eight companies willing to be named in it, a stated OAuth foundation, and a commitment to publish v0.1 within the month. There is no published schema, no reference implementation, no deployment anyone can point at, and no date for the fine-grained permission model.

It is still worth watching, because the companies attached are the ones a standard like this needs. Walmart and Shopify carry serious retail volume, Genesys and Rocket bring the contact centers agents currently have to phone, and Stripe is in every version of this fight. But the gap between a protocol with those names on it and one merchants have actually wired up is the gap that has swallowed most agent promises so far, the one we traced in what an AI agent can and cannot finish.

Our take

The diagnosis is right and the design is reasonable. Agents screen-scraping their way through checkout pages is a bad equilibrium for everyone, and identity and consent are the correct place to start, ahead of payments. But this is an announcement of an intention to write a standard, published alongside quotes from companies that have already endorsed two competing ones this year. Judge it in a few weeks on the v0.1 spec, and specifically on whether read-only is an enforced boundary or a label. If you run a merchant stack, there is nothing to integrate yet. If you use a personal agent, the decision in front of you is the old one: read-only unless you have a reason.