On October 6, Meta and the customer-service AI company Sierra announced the Personal Agent Protocol, an open standard for how a person’s AI agent deals with a business. Genesys, Instinct, NiCE, Rocket, Shopify, Stripe and Walmart are helping build it. Sierra published a draft of the specification, called Poppy, on October 9.
Sixteen days earlier, Amazon had blocked Muse, Meta’s personal agent, from shopping on Amazon.com. I wrote about that standoff the next morning. Amazon’s stated objections were specific. Meta never told Amazon that Muse was coming, the agent did not identify itself while it browsed, and it appeared to capture and store customer credentials, according to Amazon’s statement to Adweek.
On paper, the new protocol answers each of those objections. An agent arriving at a company’s website announces itself and can start as a guest, which is enough to check whether a product is in stock or read a returns policy. When a task needs the customer’s account, the business asks the customer to sign in and authorize a session token. The token gives the agent read-only or write access to specified resources. Sessions run on OAuth, the authorization standard behind “Sign in with Google” buttons. Each company sets the limits on what agents can do.
In September, Amazon could block Muse and call it security, and the argument held: an unidentified bot that logs into customer accounts and may be storing their passwords is a real risk. Once an agent can prove whom it represents and what it has permission to touch, a company that still refuses it is making a commercial decision. Its CEO should make that call openly and take it to the board.
Amazon’s four conditions
Amazon has already said what it wants from agents. A spokesperson told Adweek that its position applies to every operator: agents should be transparent, offer a way to opt out, provide “a mutual value exchange” and improve the customer experience. Sierra’s design covers transparency and opt-out. What remains are terms of trade.
In the same statement, Amazon described the trade. An agent shopping for a customer, it told Adweek, skips the personalization built into Amazon’s store, so the customer misses recommendations and the product discovery Amazon’s systems are designed to produce. That is a business argument, and an honest one. As I wrote last month, an agent finds the item, checks the price and leaves, and a store that sells advertising against shoppers’ attention has every reason to dislike a shopper who never browses.
Its spokesperson also compared shopping agents to food delivery apps, delivery services and online travel agencies, all of which work with restaurants, stores and airlines that chose to take part. I think the comparison is fair. Each of those arrangements runs on a negotiated deal, usually with a commission attached.
Amazon is asking agent makers for a deal.
A standards race with no referee
Google launched the Universal Commerce Protocol (UCP) in January, co-developed with Shopify, Etsy, Wayfair, Target and Walmart. Stripe co-built the Agentic Commerce Protocol (ACP) with OpenAI for purchases inside ChatGPT. Now Meta and Sierra have added a third. OpenAI joined as a design partner on October 9, when Sierra published the Poppy draft and announced 35 additional design partners. Bank of America, Target and United Airlines also joined. Amazon and Anthropic are still absent from Sierra’s published partner list. Bret Taylor, Sierra’s co-founder, described the current state of agent access as “kind of chaos.”
Walmart and Shopify sit in more than one camp, which keeps their catalogs reachable by whichever agent a customer happens to use. Amazon has taken the opposite position and, Adweek reported, has also moved against shopping agents built by Google and OpenAI.
Amazon’s best argument is its size. A store that large sets terms for anyone who wants its customers, and agent makers will be no exception. That holds only as long as shoppers begin at Amazon. At Microsoft I oversaw the 2023 launch of GPT-4 in Bing, and from that seat I watched people begin moving their questions from the search box to the chat window. Muse is the shopping version of that move: Meta’s David Singleton told CNBC that it already had millions of U.S. users within a month of its September 8 launch. A purchase started through Muse begins somewhere other than Amazon’s search bar. Walmart, reachable from every camp, made the better bet.
The same decision is coming for every company with a customer login
Rocket Companies, the mortgage lender, says its system built with Sierra already lets a Muse agent move from finding a home to getting mortgage pre-approval. Sierra’s announcement lists booking flights and shopping for car insurance among the things people already ask their agents to do. Banks, insurers, airlines and telecom carriers all hold accounts that a customer’s agent will want to open, and most of them will face Amazon’s decision at a smaller scale.
Sierra’s own examples show how granular the decision gets: a question asked as a guest, an order changed after sign-in, a warranty claim handled through the company’s agent. Someone has to decide, action by action, whether a verified agent may check a balance, change a delivery address, file a warranty claim, return an order or apply for a loan. Each answer carries fraud exposure, refund cost, regulatory risk and revenue. Sierra plans to release a reference implementation for developers, and in most companies the developers who pick it up will end up making those calls by default.
Kevin Miller, Stripe’s head of payments, said in Sierra’s announcement that a customer relationship “doesn’t start or end at checkout.” He is right, and it means the permissions a company grants to agents will shape its customer relationships for years. Management can own the individual permissions. The board should require a written policy on agent access and one named executive accountable for it, the same way I argued boards need stop authority over AI agents.
Is your board ready to set a policy on AI agents?
The free Board AI Scorecard is an 18-question check on how your board oversees AI, including agents acting for customers.
Questions for management this quarter
- Which customer actions will we allow a verified agent to take, and which will still require the customer in person?
- If we block agents, what is the commercial reason, and would we be comfortable stating it publicly?
- When an agent buys something the customer did not intend, who absorbs the cost, and does our refund policy say so?
- Which executive owns our position on agent access, and which of the competing standards are we tracking?
The Poppy draft is now available. Sierra says it will hold design workshops over the next month and publish a reference implementation. A company that wants to shape what agents may do on its systems can read the draft and join that process.
Frequently asked questions
What is the Personal Agent Protocol?
The Personal Agent Protocol is an open standard, announced by Meta and Sierra on October 6, 2026, that defines how a person’s AI agent identifies itself to a business and what it is allowed to do there. Customers decide what access their agent gets, including read-only or write access, and businesses decide which actions agents may perform. Sessions use OAuth for authorization.
Which companies are behind the Personal Agent Protocol?
Meta and Sierra are developing it with Genesys, Instinct, NiCE, Rocket, Shopify, Stripe and Walmart. Sierra added 35 design partners on October 9, including OpenAI, Bank of America, Target and United Airlines. Amazon and Anthropic are not on Sierra’s published partner list.
Why did Amazon block Meta’s Muse agent?
Amazon blocked Muse on September 20, 2026, saying Meta had not told it Muse would access its store, that the agent did not identify itself while browsing, and that it appeared to capture and store customer credentials. Meta says Muse cannot see users’ passwords or payment details.
How is the Personal Agent Protocol different from Google’s Universal Commerce Protocol (UCP) and the Agentic Commerce Protocol (ACP)?
UCP, launched by Google in January 2026, covers shopping from product discovery through cart and checkout. ACP, developed by Stripe, OpenAI and Meta, handles agent purchases, including checkout inside ChatGPT. The Personal Agent Protocol covers any interaction between a personal agent and a business, including account access and customer service, and is not limited to shopping.
What should a board ask about AI agents acting for customers?
A board should ask which customer actions verified agents may take, what the commercial reason is for any block, who pays when an agent makes an unwanted purchase, and which executive owns the company’s position on agent access.
Related reading
- The AIO Playbook: How to Get Your Brand into AI Answers
- Your Agent Can’t Shop at Amazon. Amazon’s Agents Shop Everywhere.
- How a board keeps control when AI agents run in the background
Sources
https://sierra.ai/blog/introducing-personal-agent-protocol | https://www.adweek.com/commerce/amazon-locks-out-metas-muse-in-agentic-shopping-standoff/ | https://www.channelinsider.com/ai/news-meta-walmart-shopify-stripe-ai-agent-standard/ | https://www.cnbc.com/2026/10/06/meta-joins-companies-to-tame-chaos-of-doing-business-with-ai-bots.html | https://www.shopifreaks.com/google-and-shopify-launch-universal-commerce-protocol/ | https://cryptobriefing.com/stripe-meta-walmart-personal-agent-protocol/ | https://shellypalmer.com/2026/09/amazon-blocks-metas-muse/
