Your customers are about to send software to your front door instead of walking through it themselves. The question is not whether AI agents will log in to your website, check an order or start a return on a customer's behalf. They already try. The question is whether you decide the rules, or the agents do.
On 6 October 2026, Meta and Sierra announced the Personal Agent Protocol, an open standard for exactly this moment, with Walmart, Shopify, Stripe, Genesys, Rocket and Instinct named as partners. The v0.1 specification is due later this month. There is nothing to install yet, but there is a policy decision every customer-facing business in Hong Kong can make this quarter.
What is the Personal Agent Protocol?
The Personal Agent Protocol (PAP) is a proposed open standard, announced by Meta and Sierra on 6 October 2026, that defines how a consumer's AI agent identifies itself to a business, signs in on the customer's behalf through OAuth, and receives guest, read-only or write access that the business and the customer both control.
In plain terms, it is a front-door etiquette for AI agents. Today a personal agent behaves like a very fast human: it loads your pages, fills in your forms and, when it gets stuck, phones your hotline. PAP replaces that guesswork with a formal handshake.
The agent announces that it is an agent, states who it represents, and receives a scoped permission. The business, not the agent vendor, decides which tasks are open to agents and through which channel.
Why did Meta and Sierra launch it now?
PAP arrived because personal agents moved from demos to mass adoption faster than businesses could respond. Meta's Muse agent reached the top of Apple's US free app chart within ten days of its September launch, and Amazon blocked it from shopping on Amazon.com on 20 September, citing missing notice and self-identification.
According to analysis in The Daily Brief drawing on Implicator's reporting, Amazon said Meta gave no notice that Muse would access its store, that the agent did not identify itself while browsing, and that it appeared to handle customer credentials. Meta disputed the credential claim. Neither side's account has been independently verified.
The dispute exposed the core problem. Without a standard, a business sees either an unexplained bot or a perfect imitation of a customer. Sierra co-founder Bret Taylor described the current state bluntly, as quoted by Implicator: "It is kind of chaos until such a standard exists."
PAP is Meta's attempt to turn that chaos into a consent screen: the customer signs in on your page, grants a scope, and your systems see an agent arriving as an agent.
How does the Personal Agent Protocol work?
PAP works in four steps: the agent discovers what your business offers on its website, opens a guest session, upgrades to a signed-in session through OAuth when the customer authorises it, and then completes the task through whichever route you allow, namely your web pages, your APIs or your own customer-service agent.
According to Sierra’s announcement, the session carries across channels. A question asked as a guest and an order change made after sign-in are treated as one visit, which matters for audit trails and customer-experience analytics.
The three routes a business can open
--- Website: the agent navigates your ordinary pages, which suits low-risk reads such as opening hours or product specifications.
--- APIs: the agent calls interfaces you expose through MCP or OpenAPI, which gives you per-call logs and tight scopes.
--- Your own agent: the outside agent talks to your customer-service agent for tasks that need judgment, such as a warranty claim.
Version 0.1 covers identity and coarse read or write access only. Payments, push notifications and finer-grained permissions are listed as future extensions, so an agent using the first version cannot pay you.
How does PAP compare with UCP, ACP and Visa's Trusted Agent Protocol?
PAP is one of four overlapping standards competing to govern how agents reach businesses. PAP focuses on agent sign-in and permission scope, Google's UCP covers discovery to checkout, OpenAI and Stripe's ACP handles in-agent payment, and Visa's Trusted Agent Protocol signs agent requests so merchants can verify them.
--- Personal Agent Protocol: Meta, Sierra and partners; announced 6 October 2026; no published specification yet.
--- Universal Commerce Protocol (UCP): Google and Shopify; launched January 2026; covers discovery, cart, checkout and post-purchase.
--- Agentic Commerce Protocol (ACP): OpenAI and Stripe; released September 2025; scoped payment tokens for checkout inside the agent.
--- Trusted Agent Protocol (TAP): Visa and Cloudflare; announced October 2025; cryptographically signed agent identity.
The overlap is the strategic signal. Stripe and Shopify, which process a large share of global online checkout, appear in several of these efforts at once. They are hedging, and a Hong Kong enterprise that bets on a single protocol today would be taking a position its own payment partners have declined to take.
The coalition also has gaps. The Next Web noted that OpenAI, Anthropic, Amazon and Google are not on the partner list, and no European retailers or banks are named.
What happens to enterprises that wait for the standard to settle?
Waiting for a final standard is reasonable for code, but not for policy. Agents are already reaching customer accounts by imitating humans, so a business without an agent-access policy carries the security risk of credential-handling bots and the service cost of agent calls today, whichever protocol eventually wins.
Three costs accumulate while a business waits. The first is security: an agent that types a customer's password into your login page looks identical to a credential-stuffing attack, and your fraud team cannot tell them apart.
The second is service load. When an agent cannot finish a task on the web, it falls back to your hotline or live chat. Genesys joined the PAP coalition precisely because contact centres are absorbing this traffic without knowing a machine is on the line.
The third is control. Whoever defines access first sets the defaults. A business that has already decided what a guest agent may read and what a signed-in agent may change can adopt any standard as a thin adapter. A business that has not decided will inherit someone else's defaults.
What should a Hong Kong enterprise decide before the v0.1 specification ships?
The decision that survives any standard is a four-tier permission matrix: what an unauthenticated agent may read, what a signed-in agent may read, which reversible actions it may take, and which irreversible actions stay closed. Written now, this matrix transfers to PAP, UCP or TAP with little rework.
The four-tier agent access matrix
--- Tier 1, guest read: opening hours, stock levels, published rates, return policies. Low risk, because most of this is already public.
--- Tier 2, signed-in read: order status, balances, appointment times. Moving this behind scoped OAuth is a security improvement over today's password-typing agents.
--- Tier 3, signed-in reversible write: reschedule a delivery, start a return, change a notification preference. Every action logged and undoable.
--- Tier 4, signed-in irreversible write: purchases, transfers, address or beneficiary changes. Keep closed until payment extensions mature, and require a step-up confirmation from the human even then.
Assign one named owner per tier, typically digital for tier 1, security for tier 2, operations for tier 3 and legal or risk for tier 4. The channel choice then follows naturally: tier 1 on the website, tiers 2 and 3 on APIs, and anything needing judgment routed to your own service agent.
The matrix is the outward-facing twin of internal agent governance. If your organisation has already worked on AI agent identity and access, the same least-privilege thinking applies here, pointed at your customers' agents instead of your own.
How does agent access play out in Hong Kong banking, retail and property?
The matrix looks different by sector. A bank must reconcile agent access with HKMA expectations on customer-facing AI, a retail chain must protect loyalty accounts from automated abuse, and a property manager must decide whether a tenant's agent may book facilities or raise repair tickets on the tenant's behalf.
A retail bank. The HKMA's August 2024 circular on generative AI expects customers to be able to opt out of AI interactions and request a human. A bank can map that logic directly: tier 1 and tier 2 open to agents, tier 3 limited to low-value servicing such as card replacement, and tier 4 permanently gated behind a human confirmation.
A retail chain with a loyalty programme. Points balances and member offers are prime targets for automated harvesting. The chain opens tier 1 for product and store queries, puts tier 2 behind OAuth so it can rate-limit agents separately from humans, and defers redemption until payment extensions arrive.
A property management company. Tenants increasingly ask assistants to book clubhouse facilities or chase repairs. The company exposes booking as a tier 3 API with full logs, while anything touching personal data follows the PCPD's 2026 agentic AI guidance on minimum necessary access, which UD has summarised separately.
What mistakes do enterprises make when preparing for personal agents?
The most common mistakes are blocking all agents by default, building protocol-specific code before a specification and licence exist, leaving the contact centre out of the plan, and treating agent access as an IT project rather than a customer-experience and risk decision that needs business ownership.
--- Blanket blocking. It feels safe, but customers who rely on agents will simply move to a competitor that accepts them. Blocking is a valid choice for tier 4, not for tier 1.
--- Building too early. Until the v0.1 text, a licence and a governing body exist, "open" is an intention. Build OAuth-scoped APIs first and treat any PAP integration as a thin adapter.
--- Forgetting the hotline. If your contact centre cannot distinguish an agent caller from a human one, that gap exists with or without PAP.
--- No baseline. Few organisations know how much of last month's traffic came from agents. Measure before you set a policy.
A useful test before any adoption decision is the one proposed by skeptical analysts: can a consumer agent not built by Meta complete authorised tasks with businesses that are not Sierra customers, without a sponsor-controlled allowlist? If not, the standard is not yet truly open.
Personal Agent Protocol: key facts at a glance
--- Announced: 6 October 2026 by Meta and Sierra.
--- Named partners: Walmart, Shopify, Stripe, Genesys, Rocket, Instinct.
--- Built on: OAuth; agent routes via website, MCP or OpenAPI APIs, or the company's own agent.
--- Access levels: guest; signed-in read-only; signed-in write, chosen by the customer within limits set by the business.
--- v0.1 specification: promised for later in October 2026, followed by design workshops and a reference implementation.
--- Not in v0.1: payments, push notifications, fine-grained permissions.
--- Competing standards: Google UCP, OpenAI and Stripe ACP, Visa Trusted Agent Protocol.
Conclusion: write the rules before the agents arrive
The Personal Agent Protocol may become the sign-in layer for consumer agents, or another standard may absorb its job. Either way, the businesses that come out ahead will be the ones that decided early what an agent may see, read and change, and treated each protocol as an adapter on top of that decision.
The work this quarter is a policy document, a traffic baseline and an OAuth-scoped API roadmap. None of it is wasted, whichever standard wins.
We understand AI. We understand you. With UD by your side, AI never feels cold.
Reviewed by the UD enterprise AI team. Protocol details verified against Sierra's announcement and the sources linked above on 13 October 2026. The specification was not yet published at the time of writing.
Find out what AI agents can read on your website today
Agents and AI assistants judge your business by what they can read on your site. Start with a free 30-second scan of your AI visibility, then let us help you turn the access matrix into a working plan. We'll walk you through every step, from the visibility audit to structured data, agent-ready APIs and ongoing monitoring.
