Right now, most AI agents browse the web like a raccoon in a trench coat: technically getting the job done, deeply unconvincing, and one CAPTCHA away from total collapse. They scrape pages, poke at forms, and pretend to be a person clicking buttons. A new open standard wants to retire the trench coat and hand those agents a proper ID badge instead.
A Handshake Protocol for Your Robot Butler
On October 6, Sierra and Meta published the Personal Agent Protocol, an open standard for how personal AI agents authenticate with businesses and show those businesses what they're actually doing. Founding partners include Walmart, Shopify, Stripe, Rocket, Genesys and Instinct, and a v0.1 specification is due later this month.
The mechanics are built on OAuth, the same plumbing behind every "Sign in with..." button you've ever clicked. An agent can start as a guest to check stock or look up a return policy, then get upgraded to read-only or write access once the customer actually signs in. The business decides whether the agent works through its website, through its APIs using standards like MCP and OpenAPI, or by talking to the company's own agent. Payments, push notifications and finer-grained permissions are slated for later versions rather than the first spec.
Your Website Is About to Get a Second Audience
For years, websites were designed for exactly one kind of visitor: a human with a thumb and a short attention span. Protocols like this one assume a second visitor is coming, an agent acting on someone's behalf, and that it should be able to say who it is, ask permission, and leave an audit trail. That's a big improvement over today's status quo, where businesses mostly find out about agents when their bot-detection dashboards light up like a Christmas tree.
The angle worth watching: this isn't the only standard in town. Visa announced its rival Trusted Agent Protocol in June, and Stripe and Shopify have signed on to both. That's the classic early-standards dance, where everyone RSVPs to every party until one of them turns out to be the party. It's also worth noting the founding roster leans heavily American, with no European retailers, banks or payment companies named so far. The good news is that the underlying building blocks, OAuth, clean APIs and MCP, are useful no matter which acronym wins.
The agents are coming either way; the only question is whether they knock at the front door or climb in through the forms. Sites with tidy APIs and sensible permissions are the ones that get to pick.
If you'd like your site to welcome well-behaved agents through a proper API instead of hoping they don't break your checkout form, our team can help you build that front door.
Source: The Next Web