Meta and Sierra publish Personal Agent Protocol v0.1 with Walmart, Shopify and Stripe

The Personal Agent Protocol (PAP) v0.1 specification, co-published by Meta and customer-service agent company Sierra, defines how a user's personal agent authenticates to a business. It also defines how the agent declares what it is allowed to do on the user's behalf. The founding consortium spans retail and payments (Walmart, Shopify, Stripe), lending (Rocket) and contact centers (Genesys).

PAP builds on OAuth. A personal agent presents verifiable identity tied to its user, plus a scoped permission declaration: browse, buy up to a limit, or schedule, for example. The enterprise system can then accept or reject actions under explicit authorization rather than treating the agent as an anonymous scraper or a credential-stuffed browser session.

The strategic context is Meta's Muse personal agent, which has topped app charts for a month and which Zuckerberg calls the centerpiece of Meta's AI strategy. A standard that makes merchants agent-ready directly benefits Muse. It also competes with agent-commerce efforts from OpenAI, Google and payment networks, and with Alibaba's Sui-based agent payments. PAP complements, rather than replaces, tool protocols like MCP.

Caveats: this is v0.1 and is sourced mainly from aggregators. Trust is the hard part, as IDC's Meredith Whalen told CNBC: 'The real question is trust.' Apple is tightening macOS permissions after complaints that Muse accessed private messages, a claim Meta disputes. Watch whether Google, OpenAI or Amazon join, or counter with their own specs.