Sierra and Meta’s Personal Agent Protocol covers who may act on your account. Not who you should meet

Published October 7, 2026 · Last reviewed October 16, 2026

Update, October 16, 2026. Dated note; the rest of this article reflects what we verified on October 7, 2026. On October 9, Sierra published the first draft of the protocol, version 0.1, nicknamed Poppy (Sierra, October 9, 2026, draft). A company publishes one file at /.well-known/poppy.json that tells personal agents how to interact with it, how customers sign in and what the agent may do. Sierra also named 35 more design partners, among them OpenAI, Visa, Mastercard, PayPal and Cloudflare, and said Rocket had shown Meta’s agent Muse finding Rocket’s agent through the protocol at Sierra Summit. We know of no production agent that reads the file yet. For what a business site can publish for visiting agents today, see the agentic website checklist.

A personal agent lands on a retailer’s site to ask whether a jacket is in stock. No account, no login, nothing at risk. Then the task changes: return the one bought in August. Now the agent needs the account, and someone has to decide how far in it gets.

Personal Agent Protocol, announced on October 6, 2026 by Sierra and Meta, is a proposal for that moment.¹² Sierra names Genesys, Instinct, Rocket, Shopify, Stripe and Walmart as partners; Meta’s own post lists NiCE and Decagon as well.¹² The v0.1 specification is due later this month. Nothing has shipped. It is a different thing from an individual Internet-Draft titled Principal Agent Protocol.³

It matters because it splits consent in two. The customer decides what their agent may do; the business decides what any agent may do. Both ride one OAuth session that carries from a guest visit into a signed-in one.¹ It is also narrower than its partner quotes: every mechanism that identifies the customer runs through an account they already have.

What Sierra and Meta announced on October 6

Sierra’s post, by co-founders Bret Taylor and Clay Bavor, presents Personal Agent Protocol as an open standard for how personal agents deal with businesses, covering authentication, consumer control, and what companies can see of the agents acting on their sites, APIs and company agents.¹

Read it next to the month Meta has had. Meta launched its Muse agent on September 8. On September 20 Amazon began blocking it, saying Muse arrived without notice, did not identify itself while browsing, and handled customer logins Amazon could not inspect.⁴⁵ That standoff is covered in Amazon blocked Meta’s Muse. Two weeks later Meta co-announces a standard that, in Sierra’s words, answers brands wanting “to know when a personal agent is acting for a customer.”¹ Meta’s post argues that blocking a personal agent also rejects the customer who sent it.² Amazon is not among the named partners, and neither are OpenAI or Anthropic.

The flow is ordinary enough to picture. It begins on the company’s own site, which tells an agent what is on offer and how to get in touch. The agent opens a session on its user’s behalf, as a guest at first, which may be enough to check stock or a returns policy. When the task needs the account, the customer signs in on the company’s page or uses credentials already set up with their agent, and chooses read-only or write access.¹

The business makes its own choice. It decides how agents get the job done: through its regular web pages, through APIs built on standards such as MCP and OpenAPI, or through an agent of its own for tasks that need conversation, such as a warranty claim.¹ The same business logic can sit behind three very different front doors.

Everything past v0.1 is conditional. Sierra says more detailed permissions could let both sides limit specific actions, push notifications could tell an agent when a flight is delayed, and payments extensions could let an agent buy without sharing card details.¹ Read it as a published intention with named partners, not a deployed standard.

Two permission decisions, one session

In Sierra’s framing, the customer picks how far an agent can go and the company bounds what any agent can do.¹ Those are two permissions, held by two parties, and keeping them apart is the most useful thing in the proposal.

The customer’s decision is scope over their own account. Read-only looks up an order; write starts the return. That is familiar territory: scoped OAuth consent for agent tools is a pattern Cloudflare opened to developers, covered in scoped consent for agentic tools. This applies it to the consumer side of a retail relationship.

The business’s decision is which actions exist at all. A retailer could, for example, offer returns and order lookup while keeping address changes or stored payment methods out of every agent’s reach, however much write access a customer granted. Without that layer, the customer’s generosity would set the ceiling on the merchant’s risk.

New, rather than borrowed, is the session: Sierra says it carries across channels, so a guest question and a later signed-in change are one visit.¹

Two caveats keep this honest. Nothing here can be tested yet, because the specification is not out, and two businesses could both claim conformance while one answers through its web pages and the other through MCP endpoints. And OAuth says what a token holder may do. It does not, on its own, say who is holding it.

Who an agent represents is a stated aim, not yet a mechanism

The partner quotes on Sierra’s page reach further than the mechanics. Tony Bates, Genesys’s chairman and CEO, says brands need “a trusted way to know who an AI agent represents.”¹ Meta says the protocol addresses how personal agents can securely convey user identity.² Stripe’s Kevin Miller is more precise: Stripe is contributing to give businesses “a standard way to recognize their customers’ agents.”¹

Miller’s version matches what has been described. In the announced flow, a business learns whom an agent represents when the customer signs in. Before that the agent is a guest, and nothing published says what a business may learn about a guest’s principal. The specification is not out, so that is a gap in the announcement, not a proven absence in the design. It is still the gap to watch on publication day.

The neighbouring work shows how hard it is. On the same day, Decagon, which Meta names as a partner, open-sourced PACT, the Personal Agent Consent & Trust Protocol, co-developed with Instinct. In PACT a personal agent signs a short-lived token, and the user is defined as the pair of that agent and a sub, an opaque identifier that must not contain personal data. The spec says what that token proves: a known personal agent is calling for someone, “Not that sub owns a Brand account.” Without linking an account, the business checks the user the way a chat widget does, by asking for an order number or an email.⁶ The person behind the agent is an opaque identifier defined by the personal agent, not a name another business could check.

The Universal Commerce Protocol, a commerce standard started by Google, handles the account side through OAuth identity linking. It says linking “upgrades the experience, it does not gate it,” and that a business should offer an account creation flow when the user has none.⁷ And Web Bot Auth, the IETF work on signed agent requests, draws the line in its own scope section: it “does not authenticate human users.”⁸ Which agent is calling is being standardized; see how Web Bot Auth tells real agents from spam. Which person it speaks for is answered, everywhere so far, by an account or by the customer proving it, as PACT does with an order number.

That leaves three questions outside the grant. Which person or company the agent represents, in a form another business could check. Whether standing travels: a customer in good order at one retailer starts from nothing at the next, and nothing announced describes standing carrying over. And whether two parties with no account between them want to deal at all.

A first introduction is a different consent question

Change one detail in the opening scene. The agent is not returning a jacket. It represents a founder looking for an immigration lawyer, or a supplier, or a hire, at a company it has never dealt with. There is no account to sign in to, and there never was.

Meta’s post describes the customer case this way: someone who asks Muse to book with you or reorder from you has, in Meta’s words, “chosen you.”² In a first introduction, nobody has chosen anyone yet. Consent there is not a scope list. Neither side is deciding how far into a stored profile the other may reach. They are deciding whether to become known to each other at all, and that decision has properties an OAuth grant does not.

It is two-sided. Account access runs one way, from the account holder outward. An introduction works only if both people agree, and either refusal ends it. We mapped those properties in the consent layer for the agentic web: bilateral, default-closed, and with a half-yes kept invisible so it never turns into pressure.

It is gated on both sides. In Tobira’s mutual reveal, each side flips its own consent flag and contact details move only when both are set. An open directory, by contrast, becomes a cold-outreach channel with extra steps.

It needs an address a person can read. Machine discovery routes an agent to an endpoint. Meta compares this moment to email, which it says spread because people agreed on how messages are addressed, sent and delivered.² Meta means agent traffic. A person deciding whether to be introduced needs the same thing at human scale: a name they can recognize, remember and look up first.

Personal Agent Protocol gives a company a clean way to serve agents of customers it already has. It says nothing yet about an agent acting for a stranger with a budget, whose destination today is usually a contact form.

Permissions inside a relationship are being standardized by serious parties. Among the standards reviewed here, entry into a relationship is still open ground.

How this connects to Tobira

Tobira works on the half the announcement does not address, and does not implement the protocol. Personal Agent Protocol governs what an agent may do once an account exists. Tobira’s @handle gives the person or company behind an agent an address a human can read and another agent can look up before any account is created. A Tobira Site Agent makes a company website agent-addressable and networked, so an agent representing a stranger can ask questions, be qualified and reach the owner instead of filling in a form. It also publishes the machine-readable files AI agents look for and gives them a live endpoint to ask and act, while your own robots.txt, markup, sitemaps and WebMCP tools remain separate layers on your domain, explained in agent-readable vs agent-addressable. Mutual reveal moves contact details only after both humans agree. Tobira does not grant agents access to any business’s customer accounts and sets no business’s permissions. The network had 729 agents per Tobira internal data, September 2026. As listed on tobira.ai/agentic-site/ on 16 October 2026, Tobira Site Agent has a free plan that runs on your own AI key and paid plans at $49, $169, $399 and $799 a month (USD, excluding taxes).

The v0.1 specification is due this month. When it lands, read what it says about an agent that has not signed in.

What to remember

• Sierra and Meta announced Personal Agent Protocol on October 6, 2026. Sierra names Genesys, Instinct, Rocket, Shopify, Stripe and Walmart; Meta’s post adds NiCE and Decagon. Amazon, OpenAI and Anthropic are not named.¹²
• It separates two permissions: what access the customer grants their agent, and what the company makes available to any agent.¹
• The session is built on OAuth and carries across channels, from a guest question to a signed-in action. Companies choose web pages, APIs on standards such as MCP and OpenAPI, or an agent of their own.¹
• The v0.1 specification, workshops and a reference implementation are planned for later in October. Finer permissions, notifications and payments are possible extensions.¹
• Partners say brands need to know who an agent represents. As announced, that answer comes from a customer signing in; the same-day PACT spec treats the person as an opaque identifier defined by the agent.¹⁶
• Two strangers agreeing to be introduced is a separate, two-sided consent that none of the standards reviewed here covers.

Frequently asked questions

What is Personal Agent Protocol?

An open standard Sierra and Meta announced on October 6, 2026 for how personal AI agents interact with businesses: how an agent starts a session, signs in to a customer account, and which routes a business offers it. Sierra names Genesys, Instinct, Rocket, Shopify, Stripe and Walmart as partners; Meta’s post also names NiCE and Decagon.¹²

Is Personal Agent Protocol available to use today?

Not yet. Sierra plans to publish the v0.1 specification later in October 2026, hold design workshops and release a reference implementation. Finer permissions, push notifications and payments are described as possible extensions, not part of the first version.¹

How do permissions work in it?

In two layers. The customer signs in on the company’s page or through credentials set up with their agent, then chooses read-only or write access. The company decides what it makes available and whether agents reach it through its website, through APIs on standards such as MCP and OpenAPI, or through an agent of its own. The session is built on OAuth and carries across channels.¹

Can an agent use a business without an account?

Yes, as a guest. Sierra describes an agent starting a session as a guest to check product availability or a returns policy, then signing in when a task needs the customer’s account.¹

Does it tell a business who the human behind an agent is?

That is a stated aim, not yet a published mechanism. Genesys’s CEO says brands need to know who an agent represents, and Meta says the protocol covers conveying user identity. As announced, the answer comes from the customer signing in. For an agent acting for someone with no account, and for two strangers agreeing to an introduction, nothing has been published.¹²

Sources

Coverage of the same announcement, all October 6, 2026: The Next Web, Unite.AI and CMSWire. Muse’s September 8 launch and Amazon’s September 20 block are covered in more detail in the earlier Tobira article.

Sierra’s post, Meta’s post, the PACT specification, the UCP specification and the Web Bot Auth draft were read directly on October 7, 2026. Nothing described as planned or as a possible extension is treated here as shipped.