Can a protocol split agent access from agent incentives?

Sierra, writing jointly with Meta, announces Personal Agent Protocol, "an open standard Meta and Sierra are developing along with industry partners at Genesys, Instinct, Rocket, Shopify, Stripe, and Walmart that defines how personal agents interact with businesses." The post states the protocol's governing division: "consumers decide what access to give their personal agents, and companies set parameters for what those agents can do." Sierra frames this as a replacement for the current default, where "most personal agents use websites and apps the way people do — loading pages and clicking through forms," which "can take a long time" and may still fail to complete the task.

The mechanism Sierra describes: a session "built on OAuth" that starts on the company's website, where an agent can begin as a guest — enough to check availability or a returns policy — and escalate to signed-in access when a task needs the customer's account, with the customer choosing "read-only or write access." The session "carries across channels," so a pre-signin question and a post-signin order change count as one visit. Once authorized, the agent can act through three routes the company chooses among: its website, its APIs ("built on standards such as MCP and OpenAPI"), or its own conversational agent for tasks "that need conversation, such as a warranty claim." Sierra says v0.1 of the spec and a reference implementation are still forthcoming, with granular permissions, push notifications, and a payments extension (completing a purchase "without sharing credit card information") named as future extensions, not present features.

Against Can an AI agent serve both merchant and user interests fairly?, PAP's consumer-grants/company-caps model addresses who may act, not what an agent is incentivized to recommend — a merchant-paid agent could still hold a valid OAuth grant while steering purchases for its own referral fee, since the protocol governs access, not incentive conflicts. Against Why do agents fail at identity verification and authorization?, PAP is an industry-authored answer to the same identity-and-authorization gap, arriving by commercial design rather than by a standards body generalizing from red-team failures. Against Why do protocol-based tool integrations fail in production workflows?, Sierra names MCP as one of PAP's own API channels, which assumes a reliability that note found MCP routinely lacked in production use. Against What must auditors reconstruct to verify agentic workflows?, PAP promises companies "visibility into what personal agents do," but the excerpt does not say whether an OAuth session produces the durable, cross-party record that auditing requires.

The excerpt is a pre-launch announcement: the v0.1 specification had not yet been published at the time of writing, so session semantics, permission granularity, and dispute handling are stated as design intent, not implemented or tested behavior. It is also written by the protocol's own commercial sponsors, with no independent assessment of whether it reduces disputed-access incidents in practice. The excerpt establishes that major platforms and retailers are moving to standardize agent-business authorization — it does not establish that the standard, once specified, resolves the trust and incentive problems raised elsewhere in this library.