Meta and Sierra Want a Standard Front Door for AI Agents — Decide What Your Customers' Bots Can Touch Before They Knock

Meta and Sierra Want a Standard Front Door for AI Agents — Decide What Your Customers' Bots Can Touch Before They Knock

2026-10-08

On October 6, 2026, Sierra, the enterprise AI startup co-founded by former Salesforce co-CEO Bret Taylor, announced the Personal Agent Protocol (PAP) with Meta. The partner list includes Genesys, Instinct, Rocket, Shopify, Stripe, and Walmart (Sierra, October 6, 2026). The goal is shared rules for how personal agents (AI assistants that act for one consumer, like booking an appointment or changing an order) deal with businesses.

The same day, Decagon, which builds AI agents for customer-service teams, open-sourced a related protocol called PACT (Decagon, October 6, 2026).

The takeaway for operators: your customers’ AI agents are already knocking. You don’t have to pick the winning standard this month. You do have to decide what an agent may see and do on a customer’s behalf, before a bot decides for you.

What PAP actually is (and isn’t yet)

Here’s what the announcement, written by Sierra co-founders Bret Taylor and Clay Bavor, describes (Sierra):

  • Discovery starts on your website. An agent learns what the company offers and how to reach it.
  • Guest first. An agent can start without logging in, enough to check stock or ask about a returns policy.
  • The customer controls access. When a task needs the account, the customer signs in on the company’s own page (or uses credentials already set up with their agent) and chooses read-only or write access.
  • It’s built on OAuth. OAuth is the standard behind “Sign in with Google”: the business issues a limited, revocable token instead of the agent holding a password.
  • You pick the door. Agents can work through your website, your APIs (using standards like OpenAPI or MCP, the Model Context Protocol, a common way for AI tools to plug into software), or your own AI agent.

What’s missing is the actual specification. Sierra says a v0.1 spec, design workshops, and a reference implementation are coming “later this month,” and lists payments, push notifications, and finer-grained permissions as future work. Cobus Greyling, who writes about AI agents on his Substack, tried to build a prototype on October 7 and found no schema, endpoint list, or token format published yet (Cobus Greyling, October 7, 2026). Translation: this is a direction, not something you can install.

Why the rush

Meta launched Muse, its personal agent, on September 8, 2026. A week later it was the No. 1 free app in Apple’s U.S. App Store (GeekWire, September 20, 2026). When a service has no API, Meta says Muse can use it through a browser “the way you would.”

That’s where it got messy. Amazon blocked Muse from shopping in its online store, saying Meta never asked, the agent doesn’t identify itself, and it appears to capture and store customer credentials. Meta has said Muse has no visibility into passwords or payment methods and keeps credentials in secure storage (GeekWire).

Taylor, who is also chairman of OpenAI, told CNBC: “It is kind of chaos until such a standard exists.” David Singleton, vice president of engineering and consumer products at Meta Superintelligence Labs, compared the goal to email, a standard everyone can use to talk to each other. OpenAI and Anthropic haven’t joined yet, though Taylor said he expects them to (CNBC, October 6, 2026).

PAP isn’t the only standard in the room

  • PACT (Personal Agent Consent & Trust Protocol) from Decagon and Instinct already has a published spec and code. It builds on OAuth 2.0 and A2A (Agent2Agent, an open protocol for AI agents to message each other). It keeps which agent is calling separate from what the customer allowed it to do, lets each business define permissions like orders:read or orders:cancel, and returns signed receipts of actions taken. Decagon says it’s also joining the PAP working group (Decagon).
  • Visa’s Trusted Agent Protocol, announced October 14, 2025, helps merchants verify AI agents and tell them apart from malicious bots (Visa, October 14, 2025). The Next Web notes that Stripe and Shopify now back both Visa’s effort and PAP (The Next Web, October 6, 2026).

Overlapping standards are normal early on. Betting your roadmap on just one of them is not.

How to get agent-ready without picking a winner

  1. Find out who’s already visiting. Check analytics, bot logs, and support transcripts. If some “customers” finish a 12-field form in two seconds, you already have agent traffic.
  2. Write a permission menu. List what a guest agent can do (hours, stock, policies), what needs read access (order status, balances), and what needs write access (cancel, rebook, refund). Both PAP and PACT assume the business sets these limits, so this work carries over whichever standard wins.
  3. Make your API the front door. Bots clicking through web pages is slow and brittle. A clean, documented API for your top five customer tasks is the most standard-proof investment you can make.
  4. Stop relying on shared passwords. If the only path is “give the bot your login,” you inherit Amazon’s problem. Plan for token-based access you can scope and revoke.
  5. Label and log agent actions. When an agent cancels the wrong booking, you’ll want a record of which agent acted, for whom, and with what permission. PACT’s signed receipts are a good model.
  6. Give it an owner. This sits between product, security, and customer service, which is how things fall through cracks. Not sure who should own it? Our CIO vs. CTO vs. CISO breakdown can help.

Soft next step

PAP doesn’t have a spec yet, and PACT and Visa’s protocol are already in the mix. The businesses that come out ahead won’t be the ones that guessed the right acronym. They’ll be the ones that already know what an agent may see and do, and have the API and logs to enforce it.

Yellow Coop helps owners and operators map customer journeys for agent access, clean up APIs, and set AI policy — fractional CTO judgment before the bots knock. See the API and integration work in our track record, or start at contact.

Internal links: Secure, What We Do, How We Engage, CIO vs CTO vs CISO, Track Record, Insights.

Sources