The buyer on your site may not be a person

On October 6, Sierra and Meta announced the Personal Agent Protocol, an open standard for how a person’s AI agent works with a business. Sierra is the AI customer service company co-founded by Bret Taylor and Clay Bavor. Sierra’s announcement names Genesys, Instinct, Rocket, Shopify, Stripe and Walmart as partners. Sierra says it is “open for anyone to implement.”

The timing matters. Two weeks earlier, on September 22, six banks published a principles paper titled “Building Trust in Agentic Commerce.” The six are ASB, Bank of America, Capital One, Commonwealth Bank of Australia, ING and NatWest. The paper asks for five things: transparency, safety, privacy and data, choice, and interoperability.

My call: if you sell anything online, plan on some of your customers arriving through software. The question used to be whether your site works for people. Now it is also whether an agent can find you, trust you and buy from you without breaking anything. You don’t need to build anything this month. You do need to get your house in order.

What the protocol actually does

Sierra describes the flow in plain terms. An agent starts on your website and discovers what you offer and how to reach you. It begins a session as a guest, which may be enough to check stock or read your return policy. When the task needs the customer’s account, the customer signs in on your page or uses credentials already set up with their agent. The customer decides whether the agent gets read-only or write access.

The session runs on OAuth, the same standard behind most “sign in with” buttons. From there the agent works through whatever route you allow: your regular web pages, your APIs (Sierra names MCP and OpenAPI), or your own customer service agent for jobs that need a conversation, like a warranty claim.

The principle, in Sierra’s words: “consumers decide what access to give their personal agents, and companies set parameters for what those agents can do.”

Taylor is also chairman of OpenAI. He told CNBC that “it is kind of chaos until such a standard exists.” He said the standard will let companies know when they are dealing with a personal agent rather than a person, so they don’t give access to “a random bot that isn’t acting on behalf of a person.” Meta’s David Singleton compared it to email: a shared standard everyone can use to talk to each other.

What it doesn’t do yet

Don’t overread a launch post. There is no specification yet. Sierra says it plans to publish the v0.1 specification “later this month,” hold design workshops, and release a reference implementation.

Payments are not solved either. Sierra lists payments as a possible future extension that “could let a personal agent complete a purchase without sharing credit card information.” That is a “could,” not a feature.

OpenAI and Anthropic are not on board. CNBC reports neither is participating for now, although Taylor said he expects them to join.

Not every big seller is letting agents in, either. CNBC reports that Amazon has blocked Meta’s agents, citing worries about website scraping.

Three nested brass keyrings with a blue accent on the inner ring, studio sweep
Permission tiers work like nested keyrings: guest, read, then write. You choose which ring an agent gets.

Why the banks care, and why you should

The banks’ paper is voluntary and high level, but it names the risks a seller will feel first. It says plainly that “merchants are concerned that disputes and chargebacks may increase for reasons outside their control.” According to CNBC’s summary, it also flags agents asking customers for card details and typing them straight into websites, and agents steering people toward payment methods with weaker protections.

Bank of America’s Mark Monaco listed what trust will take: “identity, authorization, fraud prevention, liability management and customer protection.” Notice that liability is on the list. Today, nobody has published who absorbs a chargeback when an authorized agent buys the wrong thing. Until that is settled, assume disputes from agent purchases land on you the same way card disputes do now.

A checklist for a small or mid-sized seller

None of this needs a developer this week. It needs an owner and an afternoon. If you have already audited your AI tool stack, add agent access to the same list.

  1. Make your product data clean and complete. Agents start on your website, so they read what is there. Every product needs a current price, availability, specs and a clear name. If a human has to call to get a straight answer, so will an agent, and the agent will go elsewhere first.
  2. Publish your policies in plain text. Returns, shipping times, warranty terms and cancellation rules should be on a page an agent can read without clicking through a pop-up. Guest-session agents will check these before they ever sign in.
  3. Decide what an agent may do before one asks. Write down three tiers: what a guest agent can see, what a signed-in agent can read, and what it can change. Cancel an order? Change a shipping address? Issue a refund? The protocol is built so you set those limits. You still have to choose them. It is the same deny-by-default thinking I argued for with a control plane for coding agents.
  4. Ask your platforms about support. Shopify and Stripe are named partners. Ask them when they expect to support the protocol once v0.1 ships, and what it will cost you to turn on.
  5. Treat agent orders as their own fraud segment. Tag them if you can, and watch return and dispute rates on that segment separately for the first 90 days. You can’t price a risk you don’t measure.
  6. Don’t block agents by default unless you have a reason. Amazon can afford to turn away agents. A 20-person shop that blocks them may simply disappear from its customers’ shortlists.

FAQ

What is the Personal Agent Protocol? An open standard, announced on October 6 by Sierra and Meta, for how a person’s AI agent works with a business. It covers discovery, guest sessions, OAuth sign-in and permissions that the customer and the company each set. Sierra names Genesys, Instinct, Rocket, Shopify, Stripe and Walmart as partners.

Can I implement it today? Not yet. There is no specification. Sierra says it plans to publish v0.1 later this month, hold design workshops and release a reference implementation.

Who pays when an agent’s purchase is disputed? Nobody has published an answer. The banks list liability management as unsolved, and neither the protocol post nor the banks’ paper assigns it. Assume disputes from agent purchases land on you the same way card disputes do now.

Are OpenAI and Anthropic part of it? Not for now, according to CNBC. Bret Taylor said he expects them to join.

Bottom line

The Personal Agent Protocol is a direction, not a finished standard. There is no spec yet, payments are still a “could,” and OpenAI and Anthropic aren’t in. But Meta, Walmart, Stripe, Shopify and Sierra agreeing on how agents should identify themselves and ask permission is a real signal. Six banks asking for the same thing two weeks earlier is another.

My advice: spend the next 60 days on clean product data, plain policies and a written list of permission tiers, then revisit when v0.1 ships. If you think agent shopping stays a niche for gadgets and plane tickets, I’d like to hear the case. I’m planning as if it won’t.

Sources

Written by

Ken Koo

Partner at Force Scaling

Partner at Force Scaling, helping CEOs and leadership teams turn ambition into operating discipline and results.

ADVERTISEMENT