Personal Agent Protocol: Meta and Walmart Want to Write the Rules for Shopping Agents

Set Trending Topics as a preferred source on Google.

Whoever builds the door decides who gets through it: Meta and the A.I. start-up Sierra have just unveiled the Personal Agent Protocol (PAP), an open standard for how personal A.I. agents interact with businesses. Walmart, Shopify, Stripe, Genesys, Rocket and Instinct have signed on. Missing, however, are precisely the companies Meta has recently clashed with.

A Login for Agents

The protocol is meant to govern how an agent like Meta’s Muse signs in to an online store, a bank or a customer service desk, and what it is allowed to do there. Technically, PAP relies on OAuth, the principle behind the familiar “Sign in with” buttons. It provides for three access levels:

• Guest: Without signing in, the agent can retrieve public information such as opening hours, stock levels or return policies.
• Signed in, read only: With the user’s consent, the agent can see things like order history or account balances.
• Signed in, write: The agent can take action, such as starting a return or rescheduling an appointment.

Businesses can choose whether the agent operates their website, accesses interfaces such as MCP or OpenAPI, or talks directly to their own customer service agent. The session is meant to persist across all channels. Sierra was co-founded by the former Salesforce co-chief executive Bret Taylor and builds exactly these kinds of customer service agents for companies.

No Specification, No Payments Yet

The standard is still at a very early stage. According to an analysis by Beri, there is no published specification, license or independent governing body so far. Version 0.1 is due later this month, along with a reference implementation. For now, agents cannot pay via PAP: Payments, push notifications and fine-grained permissions are planned only as later extensions.

Amazon, Google and OpenAI Are Missing

What stands out is who is not on board. Just a few weeks ago, Amazon blocked Muse from its platform, arguing that the agent had accessed it without authorization. With PAP, Meta is now trying to help write the rules itself, and it has brought in Walmart, Amazon’s biggest rival. OpenAI, Anthropic and Google are also absent from the partner list, as are European retailers, banks and payment providers.

PAP is also far from the only attempt to bring order to agentic commerce. OpenAI developed the Agentic Commerce Protocol (ACP) with Stripe for purchases directly inside the chatbot, Google created the Universal Commerce Protocol (UCP) with Shopify, and Visa is working with Cloudflare on the Trusted Agent Protocol, which is meant to identify agents to merchants. Shopify and Stripe have a seat at the table in several of these initiatives.

Guest author Ting Wasner-Lian recently described, using China as an example, how platforms are likely to regulate access for A.I. agents. Her assessment: An agent that can shop everywhere will not arrive any time soon, and outsiders will get in only through negotiation. PAP is one such offer to negotiate. Whether it becomes a real standard depends on whether agents from other providers and merchants beyond Meta’s camp join in.