The front door: what Personal Agent Protocol answers, and what it cannot
Sources cited in this piece · Sierra announcement, 6 Oct 2026, quoted verbatim via Unite.AI (Sierra's own announcement page was not directly retrievable at publication time; quotes are attributed as the outlet carries them) · Meta statement via CMSWire reporting (quoted verbatim as carried) · partner quotes via Unite.AI (quoted verbatim) · v0.1 scope analysis via Beri. Secondary reporting labeled as such.
On 6 October 2026, Sierra introduced the Personal Agent Protocol — an open standard for how a consumer's AI agent signs in to a business — and it did not introduce it alone. The announcement names Meta, and industry partners at Genesys, Instinct, Rocket, Shopify, Stripe and Walmart, with a v0.1 specification planned for later in October 2026. The premise is disarmingly practical: “Most personal agents use websites and apps the way people do, loading pages and clicking through forms,” Sierra said, and when that fails, the agent falls back to the support line — “a process the company said can take a long time and can still end in failure. A direct connection, Sierra said, could complete the same task securely in seconds.”
1. What the door actually says
Read the announcement closely and two sentences carry the whole design. The first is the division of authority: “consumers decide what access to give their personal agents, and companies set parameters for what those agents can do.” The second is the channel continuity that makes the door worth having: “Sessions are built on OAuth, which Sierra described as an established standard for authorizing access, and they carry across channels, so a question asked before sign-in and an order change made afterward are part of the same visit.” Guest first, read if the customer grants it, write if the customer grants that — and the partner quotes converge on why anyone would build this. Genesys's chief executive called personal AI “a new front door to the enterprise” and said “brands need a trusted way to know whom an AI agent represents, what it is authorized to do, and what it intends.” Stripe's head of payments said the point is “a standard way to recognize their customers' agents.” Meta's own line, as carried by outlet reporting, is the sharpest of the batch: “Turning away a personal agent means turning away the customer behind it.”
Credit where due: this is the first time the consumer side of the agent economy has gotten a door with named institutions behind it. The routing design is honest about machinery, too — the agent completes tasks through “the company's regular web pages; its APIs, through interfaces built on standards such as MCP and OpenAPI; or the company's own agent.” Nothing here is exotic, and that is the point.
2. What a door can check — and what it structurally cannot
A door answers one question at one moment: who is knocking, and what did their principal authorize? OAuth is very good at exactly that. It is worth being precise about what the answer binds: an OAuth grant binds a session to a set of scopes, issued by the company's own identity system, for the lifetime of the session. What the door does not answer is any question with a time axis or a behavior axis. The grant says nothing about what the agent did yesterday under the same identity elsewhere. It says nothing about whether the agent that presents the credential is the agent that was granted it — credential presentation and credential possession come apart the moment credentials live in an agent framework. And it says nothing to the next door: each business re-runs the ceremony from zero, which is fine for doors and leaves the hallway — everything an agent does between two businesses — unwitnessed by design.
3. The v0.1 that is due any day — and the row it will not have
The v0.1 specification is “planned for later in October 2026”, and the early scope analysis is sober: identity and coarse read/write scope only, with detailed permissions, push notifications and payment extensions named as future directions — and, at announcement time, no published specification, license or governance body. That is not a criticism; it is a description of a v0.1. But it means the piece every door eventually needs is, again, the piece on nobody's roadmap: a statement that travels with the agent, that any party can check without asking the issuer, and that expires fast enough to mean something. In yesterday's piece the number on the desk was 99.1% of 46,303 public agents unable to present a verifiable identity. A front door does not move that number; the agents behind PAP sessions will still be uncheckable anywhere else.
Our own answer stays in its lane. RTTP(rttp://) names agents by derivation, so the thing standing in the hallway is addressable without renting a name from anyone. IQA(iqa://) attaches a signed, leased, locally verifiable statement to that name — standing as a property the visitor carries, not a judgment re-rendered per doorway. The front door is a real contribution, and the right reading of it is gratitude plus one stubborn question: a door knows who knocked. Who says the visitor is still the agent that was vouched for — and how would you check, if the network were gone? PAP will ship without answering that, because it is not PAP's question. Somebody's question, though, it had better be.