Nine months after Walmart put its name on Google's Universal Commerce Protocol, its name showed up on the competing one.
On Monday, Meta and Sierra announced the Personal Agent Protocol — an open standard for how consumer AI agents interact with businesses, developed with Genesys, Instinct, Rocket, Shopify, Stripe, and Walmart. Nine months earlier, Google launched UCP with an ecosystem list that also included Walmart, alongside Target, Best Buy, Visa, and Mastercard. The largest retailer in the world is hedging both sides of a standards fight. That tells you more about where this is going than either press release does.
Most commentary will frame this as "a new protocol for agentic commerce." That undersells it. What actually happened this week is that the protocol wars — the ones everyone declared finished when MCP and A2A consolidated under the Linux Foundation — restarted one layer up. The infrastructure stack settled. The front door did not.
What Actually Shipped
Strip away the launch-page language and the Personal Agent Protocol is a set of concrete design decisions, which is more than most standards announcements can say:
- Sessions, built on OAuth. A personal agent starts as a guest on a company's site — enough to check availability or a returns policy — and escalates to authenticated access only when the task requires it, with the customer deciding between read-only and write access.
- Sessions that survive channel changes. A question asked before sign-in and an order change made after are part of the same visit. That's an agent-native session concept, not a scrape of human browser behavior.
- Three routes into the company. The agent can work through the company's website, through its APIs (explicitly built on MCP and OpenAPI), or through the company's own agent for conversational tasks like warranty claims.
- A published timeline. The v0.1 specification lands later this month, followed by design workshops and a reference implementation.
Bret Taylor's framing of the problem is unusually direct: consumers want agents that get the job done right the first time, brands want visibility and control over what agents do on their properties, and agent builders want a consistent way in. "We're designing it to handle authentication, empower consumers and give companies visibility into what personal agents do through their websites, APIs or company agents."
He told CNBC there "will be chaos until such a standard exists." Given what the chaos looks like right now, he's not exaggerating.
The Stack Didn't Settle. It Grew a Floor.
In May I argued the protocol wars were over: MCP won the tool layer with 200+ server implementations, A2A won the agent layer with 150+ supporting organizations, IBM's ACP merged in rather than fight, and both protocols landed under multi-vendor governance at the Linux Foundation's Agentic AI Foundation. That analysis was correct — for the layer it covered.
What it never covered is the boundary nobody was fighting over yet: what happens when a consumer's personal agent knocks on a company's door. MCP governs how your agent reaches your tools. A2A governs how your agents talk to each other. Neither governs how a customer's agent — one you've never seen, running software you don't control, holding delegated authority you didn't grant — transacts with your business.
That layer is now fragmenting in a precise replay of 2025, and the lineup is crowded:
- PAP — Meta, Sierra, Shopify, Stripe, Walmart, Genesys, Instinct, Rocket. OAuth sessions, three integration routes, v0.1 this month.
- UCP — Google's Universal Commerce Protocol, live since January 2026, with Walmart, Target, Best Buy, Visa, and Mastercard in its ecosystem. TikTok's new Shopping Assistant and Buy Direct checkout, announced October 5 at Advertising Week, run on it.
- The banks. Six major banks including Bank of America and Capital One published a paper in September demanding standards built on five principles: transparency, safety, privacy and data, choice, interoperability. PAP is, in part, a direct response to that paper.
- The card networks. Visa TAP and Mastercard Agent Pay already exist as agent-payment signaling specs. Amex shipped Agent Purchase Protection in April 2026.
Notice the pattern, because it's the actual lesson here: every settlement at one layer seeds a war at the next. Consolidation in protocols isn't global; it's local. The industry standardized agent-to-tool, then agent-to-agent, and the moment that finished, the same companies started drawing battle lines over agent-to-business. If you're building an agent company and waiting for "the protocols to settle" before committing, you will be waiting forever. The settling is a treadmill.
The Smartest Thing About PAP Is That It's Boring
Here's the contrarian take: the most important technical decision in the Personal Agent Protocol is that it contains no new cryptography, no new handshake, and no new token format. The session is OAuth. Plain, unglamorous, fifteen-years-of-enterprise-audit-trail OAuth.
That's not laziness — it's the entire lesson of the last protocol cycle compressed into one decision. The specs that won in 2025 and 2026 were the ones that reused boring, widely deployed primitives. MCP rode JSON-RPC over standard transports. The specs that died trying to be clever. A consumer-commerce standard that required every retailer on earth to implement a novel identity scheme would be dead on arrival; one that rides the same OAuth flows their security teams already review annually has a fighting chance of surviving procurement.
The second smart decision: PAP explicitly builds its API route on MCP and OpenAPI instead of inventing a rival interface. It treats the settled infrastructure layer as a given and composes on top of it. That's what a healthy stack looks like — new floors reference the floors below them rather than replacing them.
So if you're scoring at home: agent-to-tool is MCP, agent-to-agent is A2A, and agent-to-business-session is increasingly OAuth-with-semantics across both PAP and UCP. The fragmentation everyone is alarm-tweeting about is real at the governance level — two rival alliances, overlapping membership, competing press cycles — but much thinner at the mechanical level. Both proposals are session-plus-scope over HTTP. Both will be implementable behind a thin adapter. Walmart knows this. That's why it can afford to sign both.
What PAP Deliberately Doesn't Solve
Now the uncomfortable part. Read the PAP announcement closely and notice the boundary of what it standardizes: authentication, consumer control, and company visibility. What it does not touch is who pays when an agent gets it wrong.
The numbers around that gap are stark. PYMNTS Intelligence data from September 2026 found that 93% of merchants believe AI providers should bear the financial loss when an agent makes an error. Meanwhile, the payment infrastructure has no clean reason code for "agent error," no standardized dispute framework, and the existing network offerings — Visa TAP, Mastercard Agent Pay — provide signaling without reallocating liability. Amex's Agent Purchase Protection is the closest thing to an answer, and its cart-context specifications are still under development.
The week's news supplies the cautionary tales that make this concrete. Meta's Muse agent, launched last month and already among the most-downloaded apps in the App Store, was banned from Amazon after its agents failed to identify themselves on the retail platform — precisely the visibility problem PAP's session model is built to fix. Wired reported that Muse builds profiles for people who never signed up for it. 404 Media reported engineers raced to patch multiple serious security vulnerabilities just to hit the launch date. And TikTok's agentic checkout launched this week with the liability question explicitly unresolved — the technical rails ready, the financial responsibility for errors unassigned.
This omission isn't an oversight. It's structural. Liability allocation is a business negotiation cosplaying as a technical spec. No consortium of competitors can ship it, because it's a zero-sum question — someone's P&L absorbs the loss, and every party at the table is trying to make sure it isn't theirs. Protocols can standardize the hello; only markets, courts, and regulators will standardize the harm. Expect the real fight of 2027 to be about reason codes and dispute flows, not handshakes.
Why the Front Door Is Worth $27 Billion
Strip the sociology away and ask the crude question: why are Meta, Google, Sierra, the banks, and the card networks all burning protocol effort on consumer-agent boundaries?
Citi published the answer this week: Muse alone could generate upwards of $27 billion in revenue for Meta by the end of the decade by becoming the "front door" to online shopping. That's what this is about. Whoever owns the agent session owns the customer relationship. The merchant doesn't get displaced, but it gets backended — queried through an API, negotiated with by a proxy, chosen or skipped by software the customer trusts more than your landing page.
The merchant postures already span the full spectrum: QVC welcoming agents, Kate Spade letting them browse but blocking checkout, Amazon blocking outright. These aren't ideological positions — they're negotiations over that $27 billion conducted through robots.txt.
Here's the harness-engineering lens on it, because this is where it gets practical. From the merchant's side of the counter, a personal agent is a harness you don't control, operated on your customer's behalf, whose permission model determines what your interface means. Its read/write scoping, its session persistence, its escalation to a human — those are the same design problems you solve internally when you give a coding agent access to a repo, just pointed inbound instead of outbound. Companies that have already done this thinking internally will find PAP-style sessions obvious. Companies that haven't will discover their API surface is now a negotiation with software they've never met.
What to Do This Week
- Treat agent traffic as a first-class client, starting now. Your access logs already contain agents pretending to be browsers. Segment them, name them, and decide policy before volume forces the decision on you. The gap between platform readiness and merchant readiness is enormous — by one September estimate, only 11% of SMBs are agent-ready, even though Shopify flipped agent-readiness on by default for its merchants almost a year ago.
- Expose read-only before write. PAP's own escalation model — guest, then authenticated read, then write — is the right template for your own surface. Availability data, order status, and returns policy are safe wins. Checkout and account mutation come after you trust your own audit trail.
- Instrument per-session, not per-IP. OAuth-based agent sessions give you an accountability record that scraping never will. If an agent misbehaves, you want a session to point at — that's also your future evidence in a liability dispute.
- Don't pick a winner. Pick an adapter. PAP and UCP overlap heavily in mechanics. Implement the shared core — session, scopes, an MCP or OpenAPI description of your capabilities — and keep the standards-specific bits in a thin layer you can rewrite. The v0.1 PAP spec drops this month; read it, but don't marry it.
- Watch the liability fight, not the handshake fight. The specs will converge or interoperate eventually; they always do. The reason codes won't exist until someone loses money in court. Whichever side of the counter you're on, your contracts should already be assigning agent-error responsibility explicitly, because no protocol is coming to do it for you.
The move from "which agent framework" to "which front-door protocol" took about eighteen months. The next move — from protocol semantics to liability assignment — is already visible in the gap between this week's announcements and this week's numbers. Build for the session model. Budget for the courtroom.
The permission boundary between an agent and the world it acts on is harness design, whether the agent lives in your terminal or your customer's pocket — it's one of the core topics in Harness Engineering: The Complete Guide to Agent-First Software Development.