Sierra, Meta, and Walmart publish 'Personal Agent…

An open standard co-developed with Shopify, Stripe, Genesys, Rocket, and Instinct defines OAuth-based authentication for personal agents — a v0.1 specification is due later this month.

Sierra and Meta on Monday published the Personal Agent Protocol, an open standard for how AI agents authenticate with and transact against businesses, co-developed with Walmart, Shopify, Stripe, Genesys, Rocket, and Instinct, fresh off its $1B raise. A v0.1 specification is scheduled for release later this month.

The protocol’s design decision is the news. Instead of agents screen-scraping websites and clicking through forms on a user’s behalf, sessions are built on OAuth, the same authentication plumbing behind “Sign in with Google.” An agent can begin a session as a guest, the customer grants read-only or write access, and the session carries across channels. Businesses pick one of three routes for agent traffic: their website, their APIs (via MCP or OpenAPI), or a conversational agent of their own.

Sierra co-founder Bret Taylor, who also chairs OpenAI, told CNBC that without a shared standard, “it is kind of chaos until such a standard exists.” Meta’s David Singleton pointed to Muse, the personal agent that hit #1 on the App Store last month, now with millions of U.S. users signing kids up for classes and booking appointments on their behalf. Shopify’s Mani Fazeli framed the protocol as the layer merchants will use to handle product questions, purchases, returns, and exchanges with a customer’s agent rather than the customer directly.

Notably absent: OpenAI and Anthropic. Taylor said he expects both to join. Also notable: Stripe and Shopify are simultaneously signed on to Visa’s competing Trusted Agent Protocol, a reminder that payments rails and agent rails are being contested on parallel tracks.

What’s deferred to future versions tells its own story. Payments, push notifications, and granular permissions aren’t in v0.1. The founding consortium shipped the authentication primitive first and left monetization for later, which is roughly how OAuth itself propagated across the web in the late 2000s before the commerce layer caught up.

For small businesses, the practical question is whether their storefront is reachable by an agent at all, a problem now adjacent to measurable agentic-search visibility. The platforms are deciding; the sellers inherit the result.

Sierra, Meta, and Walmart publish 'Personal Agent Protocol' to govern how AI agents transact with businesses

Sources