On 6 October 2026 Sierra published a blog post by Bret Taylor and Clay Bavor announcing Personal Agent Protocol. The post calls it “an open standard Meta and Sierra are developing along with industry partners at Genesys, Instinct, Rocket, Shopify, Stripe, and Walmart that defines how personal agents interact with businesses.”
The post says the standard is designed to handle authentication and to give companies visibility into what personal agents do. It also says the specification is still to come: Sierra plans to publish a v0.1 specification later this month. We read Sierra’s post, its Summit recap and CNBC’s report of the same day. We did not read a specification.
Business Pill · WHEN THE SHOPPER IS AN AGENT
A one-minute explainer of the idea behind this story: agentic commerce, where an AI agent shops on a person’s behalf. It teaches the concept, not this story’s figures.
The key insight: Both sources describe one arrangement from two seats. Sierra’s post sets out a session built on OAuth in which the customer chooses read-only or write access and the company chooses whether the agent uses its website, its APIs or its own agent. CNBC adds the context around it: it says Muse has soared to the top of Apple’s App Store, that Amazon is among the companies that have blocked Meta’s agents, and that OpenAI and Anthropic aren’t on board now. Neither source we read includes the specification.
The post gives the principle behind the standard: “consumers decide what access to give their personal agents, and companies set parameters for what those agents can do.” It says the standard lets companies work with personal agents through their existing websites and APIs, or through an agent of their own.
The post says it is designed “to handle authentication, empower consumers and give companies visibility into what personal agents do through their websites, APIs or company agents.” It adds: “It’s open for anyone to implement.”
It says Instinct will also be “joining the effort.” The post names Meta and Sierra as the developers, and Genesys, Instinct, Rocket, Shopify, Stripe and Walmart as industry partners.
Sierra’s own description of how a personal-agent session starts (left) and the three routes a company can offer (right), from its 6 October 2026 post. Items are condensed from the post; the specification is not yet published.
The Problem the Post Describes
The post says most personal agents today use websites and apps the way people do, loading pages and clicking through forms. When that does not work, it says, the agent may call a company’s support line or open its web chat. “This can take a long time, and the agent might fail to complete the task.”
Its answer is that “a direct connection could get the same task done securely in seconds.” The post says that connection has to work for everyone involved. It lists what each party wants. Consumers want speed, dependability and trust. Brands want visibility and control. Companies building personal agents want efficiency and access.
How a Session Works, as Described
The post says the protocol starts on the company’s website, where a personal agent can discover what the company offers and how to reach it. The agent then begins a session on its user’s behalf. “It can start as a guest, which may be enough to check product availability or ask about a returns policy.”
When a task needs account access, the post says, the customer can sign in on the company’s page or use credentials already set up with their personal agent. “The customer is always in control, deciding whether the agent has read-only or write access.”
“The session is built on OAuth, an established standard for authorizing access.” The post says the session carries across channels, “so a question asked before sign-in and an order change made afterward are part of the same visit.”
The post then lists three routes a company can offer. Its website means navigating the company’s regular web pages. Its APIs means “connecting through interfaces built on standards such as MCP and OpenAPI.” Its agent means “working through tasks that need conversation, such as a warranty claim.” The post says the company decides which of these it makes available.
What CNBC Reports
CNBC’s report says Meta, Walmart, Stripe and a handful of other companies are publishing what they call a “personal agent protocol.” It says Taylor, who is chairman of OpenAI and co-founded Sierra, is leading the initiative. CNBC quotes him: “It is kind of chaos until such a standard exists.”
Taylor told CNBC that businesses will know when an agent is acting for a person: “Companies will know when it’s a personal agent versus an actual person.” CNBC says he compared the standard with logging into other websites with Google or Facebook credentials, technology he worked on when he was tech chief at Facebook.
CNBC says David Singleton, vice president of engineering and consumer products at Meta Superintelligence Labs and a former technology chief at Stripe, highlighted security. It quotes him: “We’re defining rails that we hope personal agents and business agents can run over for the future.” He compared it to email, which CNBC quotes him as calling “a standard that everyone can use to talk to each other.”
CNBC says Muse, Meta’s personal agent, has been on the market since early September and soared to the top of Apple’s App Store. It quotes Singleton saying Muse has millions of users in the U.S. and is “growing rapidly.” CNBC adds that Amazon is among the companies that have blocked Meta’s agents, citing worries of website scraping.
What the Partners Say
Sierra’s post carries four partner statements. Tony Bates of Genesys says: “Personal AI is creating a new front door to the enterprise.” Kevin Miller of Stripe says the company is contributing “to give businesses a standard way to recognize their customers’ agents.”
Mani Fazeli of Shopify says the protocol “helps establish how agents and merchants can work together.” Shawn Malhotra of Rocket describes Rocket’s own agentic technology, developed with Sierra, which he says allows a Muse agent to move across Rocket’s platform. His statement does not say whether that technology uses the protocol.
The post carries no statement from Walmart or Instinct, which it names as partners.
What Is Planned
The post says: “We welcome all partners and plan to publish the v0.1 specification later this month, host design workshops with interested parties, and publish a reference implementation to help developers get started.”
It also lists possible additions, each in conditional terms. “More detailed permissions could let customers and companies set limits on specific actions.” “Push notifications could let a company tell a personal agent the moment a flight is delayed or an order ships.” “Payments extensions could let a personal agent complete a purchase without sharing credit card information.”
Where the Two Sources Differ
Sierra’s post names Meta and Sierra as the developers and does not say who leads the effort. CNBC says Taylor is leading it. CNBC names Meta, Walmart, Stripe and a handful of other companies as publishing it, while Sierra’s post lists Genesys, Instinct, Rocket, Shopify, Stripe and Walmart as partners alongside Meta.
CNBC also reports that OpenAI and Anthropic “aren’t on board now.” It says Taylor expects them to take part and would be “really disappointed” if competitors did not use the standard. Sierra’s posts, as we read them, say nothing about either company.
The Structural Read
We read Sierra’s post as describing a handshake rather than a product. The agent discovers what a company offers, starts a session as a guest or a signed-in customer, and then reaches the company by one of three routes the company has chosen to make available. The post states this as the design. How it holds up once companies and agent builders implement it is not described in the sources we read.
CNBC puts the same idea in terms of identity. It says Taylor told it that companies will know when it’s a personal agent versus an actual person, and that he compared the standard with logging into websites with Google or Facebook credentials. Both sources frame the aim as giving companies visibility into what agents do. Neither says how an agent proves who it represents.
The posts we read leave one gap: the text of the standard. Sierra says the v0.1 specification, design workshops and a reference implementation are planned for later this month, so the sources give no detail on the mechanics, and none names a licence, a governing body or a company running the protocol in production.
Bret Taylor, quoted by CNBC
“It is kind of chaos until such a standard exists.”
Three Implications
AUTHENTICATION IS THE PROBLEM NAMED FIRST Sierra’s post says the standard is designed to handle authentication, and the Genesys statement in it says brands need a trusted way to know who an AI agent represents. CNBC says Taylor described the standard as helping businesses know whether they are dealing with a bot.
THE CUSTOMER SETS THE ACCESS LEVEL Sierra’s post says the customer decides whether an agent has read-only or write access, and that the company decides which routes it offers: its website, its APIs or its own agent. The post lists more detailed permissions as a possible later addition.
THE STANDARD IS ANNOUNCED AND ITS TEXT IS NOT Sierra says it plans to publish the v0.1 specification later this month. CNBC says OpenAI and Anthropic aren’t on board now and that Taylor expects them to take part. Neither source says that any company has put the protocol into production.
What Is Not Established
We did not see the specification, a licence, a governing body or a version number for the protocol beyond the planned v0.1. Neither source we read says that any company has put the protocol into production, and neither says how an agent proves who it represents.
We did not read a Meta announcement of its own, so Meta’s position here comes from CNBC’s interview with Singleton. The Muse figures are his statements as CNBC reports them, and we have not checked them. We did not use Muse, and we did not contact Meta, Sierra, CNBC or any partner.
The Map of AI places more than 200 companies across nine layers of the stack, from silicon to application. It shows where agent platforms and consumer applications sit relative to the models and infrastructure underneath.
On 6 October 2026 Sierra announced Personal Agent Protocol, an open standard it says Meta and Sierra are developing with Genesys, Instinct, Rocket, Shopify, Stripe and Walmart for how personal agents deal with businesses. Sierra says it is built on OAuth, lets the customer choose read-only or write access, and lets a company offer its website, its APIs or its own agent. The specification is planned for later this month.
A note on sourcing. This piece rests on Sierra’s blog post “Introducing Personal Agent Protocol” of 6 October 2026, the Personal Agent Protocol section of its Summit 2026 recap, and CNBC’s report of the same day, all read in full. We did not read a Meta announcement of its own, a specification, a repository or a licence, and we haven’t checked the companies’ statements independently.
We did not contact Meta, Sierra, CNBC or any partner. Nothing here is a forecast, and nothing here is financial or investment advice.
Gennaro is the creator of FourWeekMBA, which reached about four million business people, comprising C-level executives, investors, analysts, product managers, and aspiring digital entrepreneurs in 2022 alone | He is also Director of Sales for a high-tech scaleup in the AI Industry | In 2012, Gennaro earned an International MBA with emphasis on Corporate Finance and Business Strategy.
Scroll to Top
Discover more from FourWeekMBA
Subscribe now to keep reading and get access to the full archive.
