Personal Agent Protocol: Meta and Walmart Want to Write the Rules for Shopping Agents

Meta and the A.I. start-up Sierra have put out the Personal Agent Protocol, or PAP, an open standard meant to define how personal A.I. agents deal with businesses. Walmart, Shopify, Stripe, Genesys, Rocket and Instinct are already backing it. The absences matter too: some of the biggest names Meta has recently fought with are nowhere on the list.

PAP is built around a simple idea: an agent needs a login rulebook. Using OAuth, the same basic system behind familiar “Sign in with” buttons, it sets three levels of access. Without signing in, an agent can only fetch public details such as opening hours, stock levels or return policies. With the user’s consent, it can read private information like order history or account balances. With broader permission, it can do things, including starting a return or moving an appointment.

Businesses get to decide how the agent connects. PAP allows a company to let the agent use its website, work through interfaces such as MCP or OpenAPI, or speak directly to its own customer service agent. The session is supposed to follow the user across channels. That fits Sierra’s business neatly: the company, co-founded by former Salesforce co-chief executive Bret Taylor, builds customer service agents for companies.

For now, though, PAP is still more promise than infrastructure. Beri’s analysis says there is no published specification, no license and no independent governing body yet. Version 0.1 is expected later this month, along with a reference implementation. Payments are not part of the protocol yet either. Push notifications and finer-grained permissions are only planned for later extensions.

The politics are the real story. A few weeks ago, Amazon blocked Meta’s Muse from its platform, saying it had accessed the service without authorization. Now Meta is trying to help write the rules instead, and it has brought Walmart along for the ride. OpenAI, Anthropic and Google are absent, as are European retailers, banks and payment providers. And PAP is only one of several competing attempts to sort out agentic commerce. OpenAI has its Agentic Commerce Protocol with Stripe, Google has the Universal Commerce Protocol with Shopify, and Visa is working with Cloudflare on the Trusted Agent Protocol.