Meta and Sierra propose an open standard for how shoppers' AI agents deal with merchants

Meta and the customer-service AI company Sierra published plans on 6 October 2026 for the Personal Agent Protocol, an open specification describing how a consumer's personal AI agent identifies itself to a business, what it is allowed to see and what it is allowed to change. Shopify, Stripe, Walmart, Genesys, Instinct and Rocket are named as partners in the work, and the trade press picked the announcement up through the rest of the week. The design leaves control split in two. The business decides which of its pages, APIs or in-house agents are exposed and what an outside agent may do there; the shopper decides whether their agent gets read-only or write access to their account. Sessions rest on OAuth, can begin as a guest visit for tasks such as checking stock or reading a returns policy, and carry over between channels, so a question asked before sign-in and an order change made later count as one visit. Payments are not in the first version. The partners list payments extensions, which would let an agent finish a purchase without handing over card details, only as a possible later addition, alongside finer-grained permissions and push notifications for events such as a shipped order. A v0.1 specification is due later in October, followed by design workshops and a reference implementation; no dates have been given beyond that. For online merchants the significance is who is in the room. With the largest commerce platform, a major processor and the biggest US retailer contributing, this joins the card networks' agent programmes and Shopify's own checkout tooling as a candidate for the default way agents are recognised at the storefront. Account access, order edits and returns are exactly the flows where merchants carry fraud and service cost, and the rules for them are being drafted now.