The Personal Agent Protocol (PAP), announced October 6, 2026 by Meta and Sierra, sets the standard for how AI agents like Muse book, buy, and act on behalf of consumers at any business.
Ido Cohen · Published 2026-10-09 · AI for Service Business
Meta and Sierra just announced the first open standard that governs how AI agents — like Meta's Muse — sign in to your business, browse your services, and complete bookings or purchases on behalf of a real customer. If you run a service business and you're not thinking about this yet, you're already behind.
The Personal Agent Protocol (PAP) landed on October 6, 2026, and within 72 hours it had coverage from CNBC, TechCrunch, Yahoo Tech, Constellation Research, and a dozen marketing publications. Walmart, Shopify, and Stripe are already signed on as founding partners. The v0.1 specification isn't published yet — Sierra says it drops later this month — but the direction is unmistakable. Agentic commerce, where AI agents transact on behalf of humans, is no longer a future concept. It's being standardized right now, and whoever gets ready first wins.
PAP is a proposed open standard that defines exactly how a consumer's AI agent finds a business, authenticates itself, and takes action. Think of it as the HTTPS of agentic commerce: a universal handshake that any AI agent and any business can use to interact safely and predictably.
Before PAP existed, agents like Meta's Muse were doing what any unsophisticated bot does: scraping web pages, guessing at booking flows, and crashing into captcha walls. According to reporting from Common Thread Co., that fragmentation was "creating inconsistent experiences that reduced conversion rates for merchants." PAP fixes that by establishing a formal channel.
Here is how the protocol works in practice:
As Datafloq summarized on October 9, PAP "introduces an open standard focused on secure login and OAuth authentication, rather than immediate transaction capability." In other words, this release is about identity and access — payments and deeper permissions come in later extensions.
The founding lineup matters. Sierra (co-founded by Bret Taylor, former Salesforce CEO and Twitter board chair, and Clay Bavor, formerly of Google Labs) announced PAP at Sierra Summit in San Francisco. Meta is co-developing the standard. Genesys, Instinct, Rocket, Shopify, Stripe, and Walmart are named as founding partners.
Notably absent: Amazon, OpenAI, and Anthropic. Amazon has been actively blocking Meta's Muse agent from its retail site — Datafloq reported that the PAP announcement came "sixteen days after Amazon began blocking Meta's Muse agent." OpenAI and Anthropic were not part of the launch, according to CNBC's coverage cited by Techmeme.
That absence matters because it signals this is not a neutral industry body. PAP right now is the Meta/Sierra camp drawing a line. Whether Google's Universal Commerce Protocol (UCP), OpenAI's Agent Communication Protocol (ACP), or Visa's Trusted Agent Protocol consolidate around PAP or compete with it is still an open question. The v0.1 spec, due later this month, will start revealing whether PAP has the governance structure to become the real standard or whether it stays a long partner list.
Every article published about PAP this week framed it as an ecommerce or retail story. That framing misses something important for the roughly 30 million service businesses operating in the U.S.
Think about what an AI agent like Muse already does. According to CNBC's reporting from September 29, Meta already expanded Muse to small businesses with integrations including QuickBooks, Zoom, Shopify, Canva, Slack, and Stripe. The agent can "analyze sales, campaigns, and social activity, develop growth plans, manage cash flow and inventory, draft customer communications, and create ads," according to MarketingProfs.
Now extend that capability through PAP. A homeowner's Muse agent could:
1. Search for a licensed HVAC company in their area
2. Check availability for next-Tuesday service
3. Read the pricing page and compare three companies
4. Book the appointment with a deposit — without the homeowner lifting a finger
A dental patient's agent could check in-network status, confirm appointment slots, and fill out intake forms. A legal client's agent could verify a firm's practice areas, request a consultation, and submit the intake questionnaire. This is not science fiction — it's the logical extension of what Muse is already doing for travel and retail bookings, just applied to service businesses.
The businesses that have structured, machine-readable information about their services, pricing, and availability will get booked by agents. Businesses that have unstructured PDFs, buried phone numbers, and ancient booking widgets will not.
PAP establishes three levels of agent access to your business. Understanding them now — before the spec drops — lets you prepare your website and booking systems intelligently.
The business controls which of these channels it supports and which APIs it exposes. Consumers control which level of permission they grant their agent. That two-sided consent model is the core innovation here — it distinguishes PAP from a basic scraper or a bot attack.
Planned future extensions include payments without sharing card details, push notifications (agent tells the business when it's arriving), and finer-grained permissions. Those come after v0.1.
The most important thing to understand about PAP right now is that the spec is not published. As Datafloq put it bluntly on October 9, "PAP is a plan with a long partner list." No specification, no license, no governing body had been released at launch. Sierra's v0.1 arrives later in October, followed by design workshops and a reference implementation — but that timeline could slip.
Three questions will determine whether PAP becomes the real standard or a footnote:
1. Governance: Who controls the standard long-term — Meta and Sierra, or a neutral body like a foundation?
2. Agent identity: How does a business verify that an incoming agent is actually Muse and not a malicious impersonator?
3. Competition: Does Google's UCP, which overlaps significantly (Shopify and Stripe are in both), align with PAP or fragment the market further?
The overlap with UCP is not accidental. According to UCP Checker's analysis, Meta staff co-chair UCP's Bulk Product Discovery working group, and "the same companies are in the room." Whether these efforts converge or collide will be decided in the next 90 days.
For a service business owner, the practical implication is this: you don't need to implement PAP this week, because there's nothing to implement yet. But you absolutely need to start thinking about agent readiness right now, because the businesses with structured, accessible data will have a head start when the spec drops.
You can't implement PAP today — the spec isn't live. But you can take five actions this week that position you ahead of competitors when it does drop.
1. Audit your website for machine readability (30 minutes). Open your site and answer: Can an AI agent find your service area, your pricing range, and your booking link without reading three paragraphs of prose? If not, restructure your homepage and services pages. Clear headers, explicit service lists, and a visible phone number or booking button are the minimum.
2. Add or update your schema markup (1-2 hours with a developer). Schema markup (structured data built into your website's code) is how search engines and AI agents parse what your business does. LocalBusiness schema, Service schema, and OpeningHoursSpecification are the three you need. If you don't have them, this is the week to add them. This also helps your existing Google and AI Overview visibility.
3. Verify your Google Business Profile and booking integrations are current (15 minutes). PAP will likely work alongside, not replace, existing booking surfaces. If you're using a booking tool (Calendly, Acuity, OpenTable, Mindbody, etc.), confirm it's connected and that your availability is accurate.
4. Decide your agent access policy before someone decides it for you. The PAP framework puts a choice in front of every business: what can a guest agent read from your site, and what can an authenticated agent do? Talk to your team about where you want agent friction and where you want agent speed. "Any agent can book a free consultation; only we can confirm surgical scheduling" is an example policy. Think it through before it becomes urgent.
5. Watch for the v0.1 spec drop. Subscribe to Sierra's blog. When the spec publishes later this month, it will reveal whether PAP requires changes to your booking system or website API. Having your schema and booking infrastructure clean means you'll be able to respond quickly.
---
What is the Personal Agent Protocol (PAP)?
PAP is an open standard announced on October 6, 2026 by Sierra and Meta, with founding partners including Walmart, Shopify, and Stripe. It defines how a consumer's AI agent — such as Meta's Muse — finds a business, authenticates with OAuth, and takes action on the consumer's behalf, whether that means reading availability or booking an appointment. The v0.1 specification is due later in October 2026.
Does PAP affect service businesses like plumbers, dentists, or HVAC companies — or just online retailers?
It affects every business that consumers can find and book online, which includes virtually every service business. Once AI agents can reliably browse your services, check availability, and initiate bookings through a standardized protocol, any business without machine-readable information will simply be skipped. The ecommerce framing in early coverage understates how broadly this applies.
Can my business opt out of AI agent access under PAP?
The protocol is designed to be opt-in for the write-access (booking/purchasing) level, and consumers control which permissions they grant their agents. However, guest-level access — an agent reading your public website — is not something a standard protocol can block, any more than you can block a human from reading your website. The practical question is whether you shape the agent's experience deliberately or let it guess.
Is PAP the only AI-agent standard I need to know about?
No. Google's Universal Commerce Protocol (UCP), OpenAI's Agent Communication Protocol (ACP), and Visa's Trusted Agent Protocol are all competing or overlapping efforts. PAP and UCP have significant partner overlap (Shopify, Stripe, Meta). Whether these consolidate into one standard or remain fragmented is unresolved. For now, focus on the underlying readiness work — structured data, clean booking flows, clear service information — which will serve you regardless of which standard wins.
What is OAuth and why does PAP rely on it?
OAuth (Open Authorization) is the authentication standard already powering "Log in with Google," "Log in with Apple," and nearly every API integration in modern software. When PAP says an agent authenticates with OAuth, it means the consumer grants specific, revocable permissions to their agent through a secure, standardized process — without sharing their password or payment details directly with the agent. It's proven technology, which is one reason PAP's founders chose it.
---
Sources: