Personal Agent Protocol explained: when AI assistants shop and book with your business

Soon, many customers will not visit your website or message you themselves. They will ask their own AI assistant to check your stock, book a slot or start a return, and the assistant will talk to your business for them. On 6 October 2026, Sierra and Meta announced the Personal Agent Protocol, an open standard for exactly that conversation. It is early, but the groundwork a business needs is the same groundwork that makes WhatsApp bots, marketplaces and today's chatbots work better.

What was announced

Sierra, the AI customer service company co-founded by Bret Taylor and Clay Bavor, announced the Personal Agent Protocol with Meta on 6 October 2026. It is described as an open standard for how personal AI agents authenticate with businesses and how businesses see what those agents are doing.

The partners named so far are Walmart, Shopify, Stripe, Genesys, Instinct and Rocket. Coverage says a v0.1 specification is due by the end of October, together with a reference implementation. At the time of writing, no specification or licence had been published, so treat the details below as the announced design rather than a finished standard.

How it works: three levels of access

The protocol is built on OAuth, the same sign-in system behind "Log in with Google". An agent's access grows in steps, and the customer stays in control:

• Guest. The agent can ask public questions without signing in, such as whether an item is in stock or what the returns policy says.
• Signed in, read only. The customer signs in and lets the agent see their orders or bookings.
• Signed in, can act. The customer gives permission for the agent to do things, such as start a return or change an order.

A session can span channels, so a question asked as a guest and an order change made later can belong to the same visit. Payments are listed as a future extension, not part of the first version, and push notifications and finer permissions are also future work.

Your business keeps control

The part that matters most for owners: each business decides how agents reach it. Agents can use your website, your APIs (through standards such as MCP or OpenAPI), or your own AI agent, which then talks to the customer's agent. You are not forced to rebuild anything to take part, but businesses with clean data and a proper API will give agents better answers than businesses an agent has to read like a person.

The catch: it is early, and there is a rival

This is an announcement, not a finished standard. There is no published specification yet, no named governing body and no licence. Visa runs a rival, the Trusted Agent Protocol, and Stripe and Shopify are members of both, so it is not yet clear which approach will win, or whether they will meet in the middle.

That is a reason to prepare rather than to wait. The groundwork below helps whichever standard wins, and most of it pays off today.

Five steps to an agent-ready business

• Clean product and stock data. An agent cannot sell what it cannot read. Keep prices, options and stock accurate in one system rather than in photos and PDFs.
• Plain-text policies. Write returns, delivery areas, hours and warranty terms clearly on your website. Agents, search engines and AI answers all read them.
• An API for actions. Orders, bookings and returns should go through an API, not through an agent clicking around your website.
• Sign-in with limits. Decide what a signed-in customer's agent may see and what it may change, and require permission for anything that writes.
• Logs and approvals. Record every action an agent takes, and keep a person approving refunds, large orders and anything unusual.

What we already see with clients

We do not build on the Personal Agent Protocol yet, because there is no specification to build on. But the pattern is familiar from our work. Our WhatsApp ordering system for a five-branch restaurant chain checks every price against the branch menu in code and sends confirmed orders straight into the POS, which is exactly the kind of clean, rule-checked action an outside agent would need. In a fleet system we built in Saudi Arabia, a bot prepares updates but nothing is written until a person presses Confirm. That is the "act with permission" level the protocol describes, built for staff instead of customers' agents.

If your business already exposes clean data and safe actions to your own bots, you will be ready for other people's.

What to do this month

• Check that your product, price and stock data lives in one system and is up to date.
• Put your returns, delivery and booking rules on your website in plain text.
• List the three actions customers ask for most, such as booking, order status and returns, and check whether each one has an API.
• Read our guide to AI agent security basics before you give any agent write access.

If you want help with the groundwork, see our business process automation, custom software and e-commerce services, or tell us what your customers ask for most.