Meta and Sierra Propose AI Agent Rules: Customers Grant Access, Businesses Set Limits

Meta and Sierra are developing shared rules for AI assistants acting on customers’ behalf, with authority split between the customer and the business. Announced October 6, 2026, the Personal Agent Protocol would let people authorize account access while companies decide what agents can do. The first specification is planned for later this month.

Genesys, Instinct, Rocket, Shopify, Stripe and Walmart are named partners. Sierra says the protocol will be open for anyone to implement, rather than reserved for the companies developing it. The announcement describes a proposed design, with the specification still to come.

Permission is a two-sided decision

Sierra’s design starts with an agent discovering what a company offers on its website and beginning a session for its user. A guest session could handle questions about product availability or returns. Account-specific tasks would require the customer to sign in or use credentials already configured with the personal agent.

The session would use OAuth, an established standard for authorizing access. Customers would choose read-only or write access. Businesses, meanwhile, would set the parameters for permitted actions and choose how agents connect. Customer authorization and business permission are separate parts of the proposed arrangement.

A direct connection instead of clicking through

Sierra describes today’s workflow as agents loading pages, clicking forms and sometimes turning to support calls or web chat. It argues that a direct connection could complete tasks securely in seconds, avoiding slow navigation and failed attempts. That is the developers’ proposed benefit, not a reported performance test.

Three proposed routes

• Website: the personal agent navigates the business’s regular pages.
• APIs: the agent connects through software interfaces built on standards such as MCP and OpenAPI.
• Business agent: the personal agent works through a conversation, such as handling a warranty claim.

The session is designed to continue across channels and sign-in. A question asked as a guest and an order change made after authentication would remain part of the same visit, rather than becoming disconnected interactions.

An open invitation, not universal participation

Sierra co-founder Bret Taylor told CNBC the standard should help businesses distinguish agents representing people from unauthorized bots and see what those agents do. He said OpenAI and Anthropic were not participating, although he expected them to join. That expectation is not a commitment from either company.

The partners plan to publish the v0.1 specification later in October, hold design workshops and release a reference implementation to help developers get started. Sierra also identifies possible extensions: finer limits on individual actions, notifications about flight delays or shipped orders, and purchases without sharing credit-card information. Those are future possibilities, not confirmed features of the first specification.