Every new agent protocol launch gets framed as a standard war. The reality is more interesting than that. On October 6, 2026, Meta and Sierra introduced the Personal Agent Protocol at the Sierra Summit in San Francisco, and the instinct was to slot it next to Visa TAP and OpenAI ACP as just another bid for the agentic commerce stack. But PAP is solving a different problem than those protocols — and understanding the distinction matters for anyone building or buying agent infrastructure.
Three Layers, Not Three Competitors
The agent commerce stack is crystallizing into three distinct layers, each solving a different piece of the same problem.
The execution layer — MCP for tool access, A2A for agent-to-agent communication — handles how agents actually do things. The payment layer — Visa TAP for cryptographic merchant visibility, OpenAI ACP for checkout, Google AP2 for payment authorization — handles how money moves. PAP sits between them as the identity and session layer: how an agent authenticates with a business, maintains state across interactions, and demonstrates what it is authorized to do on a verified user’s behalf.
Tony Bates, CEO of Genesys, put the gap plainly: “Personal AI is creating a new front door to the enterprise. Brands need a trusted way to know who an AI agent represents, what it’s authorized to do, its intent, and how to work with it securely.”
The protocol’s architecture reflects this positioning. A personal agent discovers what a business offers, initiates an OAuth-based session on the user’s behalf, and then executes tasks — browsing, purchasing, returning — through whichever channel the business makes available: its website, its APIs (including MCP and OpenAPI), or its own customer-facing agent. The consumer controls access scope: guest, signed-in read-only, or signed-in write. The session persists across channels.
Connecting to the Two-Gateway Stack
This layering maps directly to the two-gateway infrastructure stack we tracked last week. The first gateway handles LLM traffic — model routing, prompt safety, token budgeting. The second handles protocol traffic — MCP tool calls, A2A agent communication, and now PAP authentication.
PAP upgrades that second gateway by addressing two of the four pillars of runtime safety infrastructure: identity and authorization. A gateway that can parse PAP sessions alongside MCP tool calls and A2A messages has the full picture of what an agent is, who it represents, and what it is trying to do.
David Singleton, VP of Engineering at Meta Superintelligence Labs and former Stripe CTO, described the ambition in infrastructure terms: “We’re defining rails that we hope personal agents and business agents can run over for the future,” comparing the protocol’s function to email. That comparison is not accidental — email succeeded because it was a shared transport layer, not a product. PAP is betting the same structural move works for agent identity.
What the Launch Partners See
The founding coalition — Shopify, Stripe, Walmart, Genesys, Instinct, and Rocket — is heavy on commerce infrastructure. The quotes from their executives reveal what each side needs.
Mani Fazeli, VP of Product at Shopify, framed it as a merchant service problem: “As personal agents become part of everyday life, merchants have a new frontier for excellent customer service. From answering product questions to supporting purchases, returns, and exchanges, the ambition is to turn a buyer’s intent into an outcome that delights them. Personal Agent Protocol helps establish how agents and merchants can work together to make that happen.”
Kevin Miller, Head of Payments at Stripe, positioned it as customer-relationship infrastructure: “A customer relationship doesn’t start or end at checkout. When customers send an agent, they expect the same service they’d get themselves. We’re contributing to the Personal Agent Protocol to give businesses a standard way to recognize their customers’ agents, efficiently interact with them, and shape their customer relationships.”
Shawn Malhotra, CTO of Rocket Companies, described the consumer-agent continuity: “Our agentic technology, developed with Sierra, allows a Muse agent to move across our platform, from finding a home, to securing financing and beyond, all in real time.”
The Multi-Homing Reality
Shopify and Stripe are both founding PAP partners. They are also founding partners of Visa TAP. Stripe co-developed OpenAI ACP. Shopify co-developed Google’s Universal Commerce Protocol. This is not confusion — it is hedging. In an environment where Amazon blocked Meta’s Muse agent from its storefront on September 20, infrastructure providers cannot afford to bet on a single protocol winning.
The multi-homing strategy has a structural implication: the second gateway in the two-gateway stack will need to support PAP alongside MCP, A2A, Visa TAP, and potentially ACP. The gateway becomes a protocol multiplexer, not just a proxy. That is good news for gateway vendors and bad news for anyone hoping for a single-winner outcome.
The OpenAI and Anthropic Gap
The most significant constraint on PAP’s deployment is not technical. OpenAI and Anthropic — the two largest consumer-facing agent platforms — are not participating. Bret Taylor, Sierra co-founder and OpenAI board chairman, said he expects them to join. But until they do, PAP’s reach is limited to Meta’s Muse (which already has millions of US users) and agents built by the founding partners.
This creates a fork in the road. If OpenAI and Anthropic adopt PAP, the protocol becomes the de facto identity layer for the agent web. If they do not, the market fragments into at least two identity stacks — PAP-backed agents on one side, and whatever OpenAI and Anthropic build or adopt on the other. The gateway-as-enforcement-layer thesis survives either way, but the complexity of what that gateway must handle scales with fragmentation.
What to Watch
The v0.1 specification is expected later this month. That will reveal how PAP handles cross-domain session state, credential brokering, and interoperability with existing OAuth providers — details that determine whether the protocol becomes a universal utility or a coalition-specific standard. For now, the architecture is sound. Whether the market converges on it depends on whether the absent giants decide that identity is a layer worth sharing.
Verification note: PAP announcement date, partner list, technical architecture, and executive quotes sourced from the Sierra blog post (October 6, 2026). Meta’s Facebook Business News post returned a 400 error; its existence and content confirmed via secondary sources. OpenAI ACP scaleback details sourced from Stripe newsroom and Rye.com reporting. Visa TAP technical details sourced from Visa Developer Center and Cloudflare blog. Partner-list discrepancies between Sierra and Meta announcements noted: Sierra listed Instinct; Meta listed NiCE and Decagon.