On October 6, 2026, Meta and Sierra announced the Personal Agent Protocol, an open standard letting a customer's AI agent sign into a business's website or app, with Walmart, Shopify, Stripe, Genesys, Rocket, and Instinct as founding partners (Sierra, 2026). **It's the fourth competing standard for AI-agent authentication to surface this year, none of the four are finished, and for the large majority of small Northwest businesses, the right move right now is to do nothing and keep building a normal, well-run website.**
What Did Meta and Sierra Actually Announce?
The Personal Agent Protocol (PAP) defines how a personal AI agent — something like a consumer's own shopping or scheduling assistant — proves who it's acting for when it shows up on a business's site. Sessions start as a guest, the same as an anonymous visitor browsing for information. To do anything tied to an account, the agent has to authenticate through OAuth, the same login-authorization standard used by "Sign in with Google" buttons, and the customer decides whether to grant read-only access (check an order, see an appointment) or write access (change a booking, place an order) (Sierra, 2026). Sierra co-founder Bret Taylor — who also chairs OpenAI's board — put the motivation plainly: "It is kind of chaos until such a standard exists" (Implicator, 2026). The full v0.1 specification is due later in October 2026, alongside design workshops and a reference implementation (Sierra, 2026).
Why Are There Four Different AI Agent Login Standards at Once?
Because the biggest platform companies are placing separate bets rather than agreeing on one. Google and Shopify back the Universal Commerce Protocol (UCP), covering a purchase from discovery through post-sale support. OpenAI and Stripe built the Agentic Commerce Protocol (ACP), focused narrowly on checkout inside a chat agent. Visa runs the Trusted Agent Protocol (TAP), which signs an agent's requests and passes along verified consumer data. PAP is the newest, aimed at the broader relationship between a personal agent and a business, not just the moment of payment (beri.net, 2026). Shopify and Stripe show up as partners in more than one of these at once — a sign that even the companies writing the standards aren't betting on a single winner yet.
Four AI Agent Login Standards, Compared
| Standard | Backed by | What it covers | Status, Oct 2026 |
|---|---|---|---|
| Personal Agent Protocol (PAP) | Meta, Sierra, Walmart, Shopify, Stripe, Genesys, Rocket, Instinct | OAuth sign-in and ongoing account access across a whole customer relationship | Preview announced Oct 6; v0.1 spec due later in October (Sierra, 2026) |
| Universal Commerce Protocol (UCP) | Google, Shopify | Discovery through post-purchase support | Published spec available (beri.net, 2026) |
| Agentic Commerce Protocol (ACP) | OpenAI, Stripe | In-agent checkout with tokenized payment | Published spec, live in ChatGPT checkout (beri.net, 2026) |
| Trusted Agent Protocol (TAP) | Visa | Signing agent requests and passing verified consumer data | Published spec (beri.net, 2026) |
Does My Business Need to Do Anything About This Right Now?
No — and saying so plainly matters more than hyping it up. PAP has no published specification yet, only a preview announcement; there's nothing to implement until v0.1 ships later this month, at the earliest. The coalition backing it is narrower than the headline suggests, too: OpenAI, Anthropic, Amazon, and Google aren't on board, and Taylor himself said he'd be "really disappointed" if they didn't eventually join — meaning even Sierra isn't counting them in yet (beri.net, 2026). With four standards live or in preview and no indication which one (if any) wins, building custom integration work against any single one today is a bet on the wrong horse, not a readiness move. The honest analyst take on this exact announcement puts a real decision point no earlier than January 2027, once a published license and independent governance structure exist (beri.net, 2026). A single-location shop, clinic, or contractor in Kalispell or Spokane answering calls and booking jobs through a normal website has nothing to configure here today.
What Should a Growing Northwest Business Actually Do Today?
Build the thing that transfers no matter which standard wins: clean, scoped access to your own systems. That means a booking or CRM setup where a specific action — checking availability, confirming an appointment, pulling an order status — can be exposed through a defined API with real permission boundaries, instead of one shared login that can touch everything. That's exactly the kind of system boundary an OAuth-based standard like PAP, UCP, or ACP expects to plug into later, and it's useful today regardless, because it's also how a human employee or a different internal tool should be accessing your data. Montana retailers already running a Shopify storefront — ski shops in Whitefish, boutiques in Bigfork — get a head start without lifting a finger: Shopify is a named partner in three of the four standards above, so whichever one gains traction, their platform is likely to pick up support before most competitors' custom-built sites do.