Right now, an AI agent shopping on your behalf is like a stranger in a trench coat telling the store clerk "I'm here for my friend, trust me." Businesses have no idea who sent it, what it's allowed to do, or whether to let it in. Meta and Sierra want to give that agent a proper ID badge.
A Handshake Protocol for Personal Agents
On October 6, Sierra and Meta announced the Personal Agent Protocol (PAP), an open standard for how personal AI agents authenticate with businesses and act on behalf of consumers. The Next Web reports the launch partners include Genesys, Instinct, Rocket, Shopify, Stripe and Walmart. That's a lot of checkout counters to have on board from day one.
PAP is built on OAuth. An agent can start as a guest, for example to check stock or read a returns policy, and once the customer signs in, they decide whether it gets read-only or write access. Sessions carry context across channels, and each business chooses whether agents work through its website, through its APIs using standards like MCP and OpenAPI, or through the company's own agent. A v0.1 spec is due later this month, and payments are listed as a future extension rather than part of the first release.
Your Website's Newest Visitor Isn't Human
This matters because the "user" on your site is increasingly software acting for a human. Without a standard, businesses either block agents outright and lose sales, or let them scrape and click around blindly, which is a security and liability headache. PAP's real pitch is visibility: knowing which agent is acting, who it represents, and what it's allowed to do.
The angle people miss is that it starts with login, not payments. Identity and permissions are the boring plumbing everything else depends on, and that's the sensible place to begin. It's also worth noting that Stripe and Shopify have joined Visa's competing Trusted Agent Protocol too. The standards war is still open, so expect a few rounds before there's a winner.
Your next big customer might not have a pulse, so your website should know how to greet it properly.
If agent-ready APIs, MCP endpoints, or permission models for AI visitors are on your roadmap, we can help get your site ready for the agent era.
Source: The Next Web