Personal Agent Protocol: What It Means for Your Website

Sierra announced Personal Agent Protocol on October 6, 2026: an open standard it is developing with Meta for how personal AI agents deal with a business through its website, its APIs or its own agent. The v0.1 specification is planned for later this month. It matters to any business that serves customers online.

What we know

Who announced it: Sierra, in a blog post dated October 6, 2026 and signed by Bret Taylor and Clay Bavor.
Who is building it: Meta and Sierra, with Genesys, Instinct, Rocket, Shopify, Stripe and Walmart as industry partners, according to that post.
What it is: an open standard that defines how personal agents interact with businesses. The post says anyone can implement it.
The problem it targets: most personal agents today use websites and apps the way people do, loading pages and clicking through forms. When that is not enough, they call support or open web chat. Sierra says this is slow and the agent may fail.
Where it starts: on the company's website. There the agent discovers what the company offers and how to reach it, then opens a session on its user's behalf.
Guest or signed in: a session can start as a guest, which the post says may be enough to check product availability or ask about a returns policy. If the task needs the customer's account, the customer signs in on the company's page or uses credentials already set up with the agent. The customer decides whether the agent gets read-only or write access.
What it builds on: OAuth, an established authorization standard. The session carries across channels.
Three routes: the regular website, APIs (built on standards such as MCP and OpenAPI) and the company's own agent, for tasks that need conversation, such as a warranty claim. The company decides what it makes available.
What is still missing: the v0.1 specification, which the post plans to publish later this month. Design workshops and a reference implementation are also planned, with no date. More detailed permissions, push notifications and payments are described as possibilities, with no dates.
Who is not in: according to CNBC, OpenAI and Anthropic are not on board for now, and Taylor expects them to join. "It is kind of chaos until such a standard exists," he told CNBC.
The backdrop: CNBC reports that Meta launched its personal agent, Muse, in early September and that Amazon is among the companies that have blocked Meta's agents.

What changes and what doesn't

Nothing changes on your website today. There is no published specification, no reference implementation and nothing to install. This is the announcement of a standard in development: the features and the timeline are the ones in the post.

What changes is the direction. Companies from commerce, payments and AI agents are sitting down to define the same thing: how an agent presents itself to a business and what it may do for a customer.

The starting point does not change. The post says everything begins on the website, and one of the three routes is the ordinary website, with no API. Your site remains the place where an agent finds out what you offer.

Shopify's or Stripe's involvement does not mean a store built on them is already compatible. The post does not say so. That last point is an observation from this article.

How to prepare before the spec lands

There is nothing to install yet. What you can check today is useful with or without the protocol, because agents already visit websites the way a person would, according to Sierra's post:

Put the basics in plain view, as text. Prices, availability, opening hours, shipping and returns policy, on pages that can be read without signing in. That is the kind of question the post gives as a guest-session example.
Make forms easy to follow. A label on every field, buttons with text and clear error messages.
Run the task yourself. Book, buy or request a quote on your own site from a phone. Note where you get stuck: an agent is likely to get stuck at the same step.
If you have an API, document it. The post names OpenAPI and MCP as the basis for the API route. An API described with OpenAPI already points that way.
Look at your sign-in. The protocol builds on OAuth. Find out which login system your site or store uses and whether it supports OAuth. No need to change anything yet.
Decide where you stand. What would you let an agent do for a customer: look things up, book, change an order, pay? The protocol leaves that call to the business.
Come back at the end of the month. Once v0.1 is out, it will be clear what a website has to publish so an agent can discover it. Today's post does not spell that out.

These seven steps are advice from this article. Sierra's post gives no instructions for websites.

Sources

Updates: when the v0.1 specification or the reference implementation is published, it will be added here with a link.