Personal Agent Protocol Explained: How AI Agents Will Sign In to Shops and Banks

On 6 October 2026, Sierra announced a standard for the moment your AI agent reaches a company's website and has to say who it is.

Personal Agent Protocol, nicknamed Poppy, answers a problem that already exists. Agents such as Muse log in as their owners and click through pages built for humans. That works until a company blocks them. This guide covers what the draft says, who gains, who loses, and the step it leaves out: paying.

What changed between 6 and 9 October

Sierra's launch post, written by Bret Taylor and Clay Bavor, named Meta as co-developer and six partners: Genesys, Instinct, Rocket, Shopify, Stripe and Walmart. It promised a v0.1 specification "later this month". Three days later, on 9 October, Sierra published a first draft and added 35 design partners.

The new names are not all retailers. Visa, Mastercard, PayPal, Adyen, Bank of America, Wells Fargo, Target, United Airlines and GEICO sit on the list. So does OpenAI, which matters because its own agent, Dots, had launched on 29 September, according to PYMNTS.

The order is the story. Muse and Dots launched three weeks apart, a $10 billion valuation landed on Instinct in between, and the standard for how businesses should treat agents of this kind arrived only afterwards, in the first fortnight of the following month. Late, then. Meta said in its own announcement, as PYMNTS reported it, that the aim is to define the rails the way email was built, with many parties agreeing on them.

How a guest session becomes a signed-in one

Poppy's draft defines five building blocks. Here they are in the order an agent meets them:

1. Discovery. A file at /.well-known/poppy.json tells agents how to start and what is allowed.
2. Session. The agent opens one for its owner, as a guest, and must identify itself.
3. Sign-in. For account tasks, the person signs in on the company's page through OAuth.
4. One token. It covers the company's APIs, website and agent conversations.
5. The job, done over whichever channel the company offers.

A guest session is enough for small questions. Checking stock or asking about a returns policy needs no account. The agent only asks for a sign-in when it reaches something private, and the customer chooses read-only or write access.

Press coverage says Taylor likened this to logging in to websites with a Google or Facebook account. We could not trace that line to Sierra's own posts, so treat the comparison as ours, not his. The mechanics do match: OAuth, a sign-in on the company's page, and a token that carries only the access the person approved.

The draft adds one detail worth reading twice. If the company allows it, the agent can sign in for the user with the credentials the company asks for, such as an email and password. That is a concession to reality. It is also the weakest link in the design. Passwords leak.

Who sets the rules: from blocked to full access

The protocol's own site frames the problem as a false choice. Personal Agent Protocol's site says that today the company blocks the agent, or the agent signs in as the person and can do anything they can. Poppy adds steps in between, using a hotel as the example.

The company picks where each action sits on that ladder. A retailer might let any agent read a returns policy, let a signed-in agent start a return, and refuse to let it change payment details. That last case is the example Sierra's draft post itself gives.

The company also picks the route. Poppy lets it offer its website, its APIs through MCP or OpenAPI, or an agent of its own. The third route is where the live demo went. At Sierra Summit, Rocket's Alex McGillis asked Muse to get him pre-approved for a mortgage. Muse found Rocket's agent through Poppy, asked permission to connect, and the two agents produced a pre-approval letter after he signed in to share credit and income details.

Customer-service platforms such as Decagon and Ada sell the kind of company-side agent that third route would talk to. Whether their customers publish a Poppy file is not something any source we read has said.

Why ad-funded businesses resist agents and retailers welcome them

Start with the money, because it explains the sides. A retailer earns when a sale completes, so a faster path to the sale is good news. A marketplace that earns from attention has a different problem: an agent never looks at a banner.

The clearest evidence is a lawsuit. Amazon sued Perplexity in November 2025, accusing its Comet browser agent of covertly accessing customer accounts. A federal judge blocked Perplexity Comet on Amazon in March. In August, the 9th US Circuit overturned that order, holding that the users, not Perplexity, "accessed" Amazon, according to Reuters via AAP.

Two stories were told. Amazon said the agent posed security risks and ignored requests to stop. Perplexity answered that the case was a "bald attempt" to block users, because agents "don't have eyeballs" for Amazon's advertising. That is Perplexity's accusation, not a finding, and the report says Amazon had not responded to the appeals ruling when it ran.

Now the other side. Shopify's Mani Fazeli described the ambition as turning a buyer's intent into an outcome that delights them. Stripe's Kevin Miller said customers who send an agent expect the service they would get themselves, and that businesses want a standard way to recognise those agents. Walmart is a named partner, but the launch post carries no statement from it, so its motives are inference.

Notice who is missing. Amazon appears on neither partner list we read, and neither do Google, Anthropic or xAI. The draft's own text describes companies trying to detect agents while agents try to avoid detection, and says that cannot last. The firms with the most to lose from that standoff ending are the ones that profit from it.

Who it affects, and who it hurts

The beneficiaries are easy to list. Our reading of the draft:

• Customers get a sign-in on a page they recognise and a choice between read-only and write access.
• Agent builders such as Instinct get one integration instead of one per retailer.
• Mid-size retailers and banks can set limits instead of choosing between a ban and a free-for-all.
• Support teams see agent traffic as a labelled session, not as odd behaviour from one login.

The losers matter more, because the announcement posts skip them. Ad-supported sites lose the argument that every visit is a person. Small merchants carry a cost the big partners do not: someone must publish the discovery file, run OAuth correctly and decide the permission ladder. A shop on a hosted platform may get this done for free, but no source we read says so.

Agents outside the club also face a choice. Grok Bot and Gemini Spark are not named on either list. They can implement an open standard, but they cannot shape the next draft unless they join the process. Hermes Agent is absent too. That is a short list of absences.

Finally, the people who hand over a password. The draft lets a company allow agents to sign in with stored credentials. That is convenient and carries all the old risks of sharing a password, now with a robot holding it. Our guide to what personal agents may do without asking covers the approval settings worth turning on before any of this ships.

The payments gap: cost, data and what Stripe's wallet does today

Poppy, as drafted, cannot take your money. The gap is acknowledged. Sierra's launch post lists payments as a possible extension, one that could let an agent complete a purchase without sharing credit card information. Detailed permissions and push notifications, such as a flight-delay alert, sit in the same later bucket.

Today the gap is filled by Link Agent Wallet. Per Stripe's Link page, an agent files a spend request for one purchase, the person approves the amount in the Link app, and Link returns a one-time-use credential. Muse, Grok Bot and Instinct list Link as a payment option. The command-line client is reached through Claude Cowork and OpenClaw. Stripe's own list of features "coming soon" includes granular agent controls and more payment methods.

That arrangement shows the shape of the future split. Poppy would answer who the agent is and what it may touch. Link answers how it pays without holding a card number. The two meet only inside Stripe, which sits in both camps. Stripe and Shopify have also joined a rival effort run by Visa, TNW reported, and Visa now appears among Poppy's design partners too.

On cost, Sierra's posts name no price, fee or licence terms for Poppy. The expense lands on whoever implements it. For the money layer, see how much of it Stripe already owned before its OpenRouter deal.

Europe adds a wrinkle. TNW points out that strong customer authentication rules assume a person approves a payment to a named payee for a set amount, and a payment approved by software has no carve-out. Sierra has not said how a payments extension would square with that.

The turn: this may change less than it seems

The obvious objection is that none of this exists yet. On the pages we read, no personal agent is confirmed as supporting Poppy. We found no reference implementation either, though Sierra's 9 October post promises one over the next month. The full v0.1 specification was due in October, and a draft is not a standard.

Competing efforts also exist. Poppy's draft calls the Universal Commerce Protocol complementary, since that one covers shopping and Poppy covers identity and permission across any task. Visa's rival effort covers agent payments. A retailer that shrugs and waits for a winner is behaving sensibly.

There is a fair answer. Meta and OpenAI both appear on the lists, so two of the biggest consumer agent makers are at the table. Rocket and Muse have already shown a live end-to-end run. And the draft borrows OAuth, JWT, HTTPS, OpenAPI and MCP, so a company with APIs today is not starting from zero. Openness is a claim to test once the spec and code are public.

What to do about it if you run a store or build an agent

If you run a company's web presence, the move is cheap and reversible:

1. Read the draft and decide which rung of the ladder each action belongs on.
2. Log which agents already hit your site, since the protocol assumes you can see them.
3. Keep payment changes and address changes off the guest and signed-in rungs.
4. Plan where a discovery file would live, and who owns it.
5. Wait for the reference implementation before shipping anything customer-facing.

If you build an agent, the order differs. Support OAuth sign-in on the company's page first, treat stored passwords as a fallback, and show the user what the session token allows.

If you are only picking an agent for yourself, nothing here changes this month. Our personal agent picks and its cost breakdown still hold, and the head-to-head of Grok Bot, Muse and Dots covers the three that launched this autumn. When your stack decides the answer, Smart Match narrows it faster than a comparison table.

What to watch next: dates that prove or break it

Three checks will show whether Poppy is a standard or a slide deck.

• A reference implementation. Sierra's 9 October post says it arrives over the next month. If nothing is public by 30 November 2026, the schedule slipped.
• A second agent maker shipping support. Muse has the demo. A launch from OpenAI's ChatGPT Work or Cue would show the draft travelling beyond its authors.
• A payments extension. Sierra lists it as future work, and Link already works today.

Those are falsifiable. A fourth is not, but it is the one that decides the outcome: whether Amazon joins. Until the biggest marketplace names its position, the ladder from blocked to full access has a company at the first rung, and it is not on the list.

Circle 30 November 2026. If code and a v0.1 text are public by then, the ladder is real, and every agent in our agentic AI guide will be asked which rung its owner picked.

Frequently asked questions

What is Personal Agent Protocol?

It is a draft open standard that Sierra and Meta are developing with partners including Shopify, Stripe and Walmart. It tells a personal AI agent how to find a company, identify itself and request the access a customer approves. Sierra announced it on 6 October 2026 and published a first draft three days later.

How is it different from logging in with a password?

The customer signs in on the company's own page through OAuth, and the agent receives a token covering only what was approved. The company also learns that an agent is acting. The draft still lets a company permit stored credentials as a fallback, so passwords are not removed entirely.

Can an agent pay through Personal Agent Protocol?

Not in the draft. Sierra lists payments as a possible later extension. For now an agent that buys something needs a separate payment tool, such as Stripe's Link Agent Wallet, which issues a one-time-use credential after the person approves the amount.

Which companies are involved?

The launch post names Meta, Genesys, Instinct, Rocket, Shopify, Stripe and Walmart. On 9 October Sierra added 35 design partners, among them Visa, Mastercard, PayPal, OpenAI and Cloudflare. Amazon, Google, Anthropic and xAI do not appear on either list we read.

Does my agent support it today?

No source we read confirms that any personal agent ships with support. Meta's Muse took part in a live demonstration with Rocket, but a demonstration is not a release. Check Sierra's reference implementation, promised for about a month after 9 October, before assuming anything.

Covered in this guide

• Personal Agent Protocol: Open standard from Sierra and Meta, announced 6 October 2026 with six named partners, for how personal AI agents authenticate with businesses.
• Ada: Enterprise AI customer service platform that autonomously resolves support interactions across chat, voice, email, and social channels, built for large Zendesk and Salesforce deployments.
• Amazon: Amazon, founded in 1994, runs AWS, the cloud and retail company behind Bedrock, in-house Nova models and custom AI silicon.
• ChatGPT Work: OpenAI's ChatGPT Work agent plans and finishes multi-step projects across connected apps and files. It launched on 9 July 2026 and now reaches every ChatGPT plan, with limits.
• Perplexity Comet: Perplexity's Chromium-based AI browser with a built-in assistant, free on Mac, Windows, iOS and Android, with 7 headline features.
• Cue: Invite-only Manus app that gives each personal agent four things of its own: a phone line, an inbox, a wallet and a computer.
• Decagon: Decagon is a $4.5B-valued AI concierge that automates chat, voice, email and SMS support for enterprises, with contracts typically starting near $95K/year.
• Gemini Spark: Google's persistent AI agent, launched May 2026, that runs 24/7 on cloud VMs to manage Gmail, Calendar, and Docs inside Google's top-tier AI Ultra plan.
• Grok Bot: xAI's always-on AI agents that sign into your existing apps and finish multi-step jobs, included in xAI's joint Grok and Cursor bundle from the Premium tier up.
• Hermes Agent: Hermes Agent is Nous Research's MIT-licensed self-improving AI agent, past 250,000 GitHub stars by October 2026. Self-hosted, model-agnostic, with optional paid Nous Portal plans.
• Instinct: Invite-only AI agent from Instinct that books travel, orders groceries and makes calls by text or phone; it publishes no prices yet.
• Link Agent Wallet: Stripe's Link Agent Wallet lets an agent pay online with one-time-use credentials you approve, in three credential types, for US and Canadian customers.
• Meta: Meta AI ships open-weight Llama (1B+ downloads) and the closed Muse models, led by Muse Wonder with a 1M-token context window.
• Muse: Meta's AI agent runs tasks in its own cloud computer; since 29 Sept 2026 it connects Shopify, QuickBooks, Meta ads and more for small businesses in the US and Canada.
• OpenAI: OpenAI builds ChatGPT, the GPT-6 family (Astra, Sol, Luna), Codex and the OpenAI API. It reports 1.2B weekly ChatGPT users and an $852B valuation after its March 2026 round.
• Dots: OpenAI's always-on agent in ChatGPT runs on GPT-6 Astra with its own cloud computer, and asks approval before consequential actions.
• OpenClaw: OpenClaw is a free, MIT-licensed agent gateway: one self-hosted process connects your chat apps to the AI model you choose, with the OpenClaw Foundation as steward.
• Sierra: Enterprise AI agent platform from Bret Taylor valued at $15.8B in 2026, used by 40% of the Fortune 50 for customer service across chat, voice, and email.

Sources