Sierra and Meta announced on Tuesday (6) the Personal Agent Protocol, an open standard to define how personal artificial intelligence agents identify themselves, receive permissions and interact with companies on behalf of consumers. The initiative is being developed with Genesys, Instinct, Rocket, Shopify, Stripe and Walmart.
The protocol seeks to solve a growing problem with agents capable of executing tasks on the internet. Today, many have to browse websites or use customer service channels like ordinary users, while companies have little visibility into who controls the agent and which actions it is authorized to perform.
With the new standard, a company will be able to recognize an agent authorized by the customer and define which resources will be available. In e-commerce, this can include checking products, accessing accounts or modifying orders, according to the permissions granted.
OAuth will be the basis of the protocol
Sessions will be built on OAuth, a technology widely used to authorize external services. The agent will be able to check public information without logging in and request authentication only when it needs to access protected data.
After authentication, the user will be able to limit access to reading or allow changes. Companies will also be able to choose whether agents will use the conventional website, APIs based on standards such as MCP and OpenAPI or agents maintained by the company itself.
Despite the participation of Stripe, Shopify and Walmart, payments are not yet part of the first specification. The possibility of agents making purchases without directly receiving the consumer's payment data is planned for future versions.
Sierra intends to publish the v0.1 specification as early as October, in addition to releasing a reference implementation. More detailed permissions, notifications and payment-related features are expected to be added later.
