Personal-agent protocol: can a business consent to agent traffic on its own terms?

Question and answer, October 7, 2026. A Stratechery October 7 Update reads a proposed common interface for personal agents and businesses as a way to grow agent usefulness despite merchant opposition. Does it actually grant a business meaningful permission to choose its agent interactions? So far, Personal Agent Protocol is an announced design, not a published, validated standard or a measure of compliant transactions. A vendor’s permission design and a merchant’s decision to participate must be examined separately. The earlier Wikimedia external-owner boundary is not solved by a user asking an agent to visit a site.

Brief and source list. A good answer separates agent identity, customer delegation, business permissions, request volume, error/rollback and economic incentive, and distinguishes forecast from measured behavior. Searched (1) primary sponsors and scope; (2) specification and implementation; (3) Amazon’s position versus a cooperating merchant platform; (4) confirmation of reported Apple–LG devices. Read Taylor and Bavor’s October 6 Sierra announcement; Shopify’s merchant controls; Decagon’s separate October 6 PACT account and specification; and an October 2025 Amazon letter to Perplexity for an older, different dispute. The Apple/LG section in Thompson cites a Bloomberg report on planned devices; the forecast October 13 announcement had not occurred on October 7 and was not confirmed in the first-party Apple searches.

What the October 6 design actually commits to. Sierra and Meta are co-developing Personal Agent Protocol with Genesys, Instinct, Rocket, Shopify, Stripe and Walmart. The stated plan: an agent discovers a business’s offer on its website, starts a guest session or has the customer sign in, uses OAuth to distinguish read from write access, and proceeds on a route the business chooses: website, APIs or business agent. Sierra explicitly says the business sets parameters and the user decides agent access. Its announcement promises a v0.1 specification later in October, workshops and a reference implementation; specific-action permissions, push notifications and payments are framed as possible extensions. It gives no published deployment denominator, actual policy enforcement or same-customer follow-up. Do not silently equate partner endorsement with implementation or read/write scopes with control of crawl/query rate.

A distinct, more detailed draft, not Sierra’s published spec. Decagon and Instinct published PACT 1.0, which Decagon says it is taking into the Personal Agent Protocol working group; it is not the as-yet-unpublished Personal Agent Protocol v0.1. PACT describes business-discovered agent cards, signed caller JWTs distinct from delegated customer OAuth scopes, authorization step-up, provider-side scoping and signed action receipts. Its error contract permits provider rate limits with 429 and Retry-After. These are inspectable engineering proposals rather than evidence merchants deploy them, and PACT’s optional delegation mode and business-defined scope descriptions leave consumer understanding and monitoring outcomes unmeasured. They do show an implementable contrast between identifying an agent and authorizing its particular external action.

Already shipped controls complicate the ideal of consent. Shopify’s live help documentation says merchant “Allow Shopify to manage for me” is the default: available AI channels can see catalog data, direct checkout activates where supported and new channels are auto-enrolled. A store owner may turn off the default and choose channel access/checkout, but catalog withdrawal can take seven days and web crawling remains possible even after disabling Catalog access. These are narrower, platform-mediated settings, not proof that any specific merchant deliberately opted into the new protocol. They make the business-approval question practical: check defaults, revocation delay and what the agent can still do outside the preferred API. Amazon’s published 2025 letter objects to Perplexity’s masked shopping agent and disputed customer experience, not a first-party October 2026 statement on the new consortium or proof a paid Prime+ tier will appear. Thompson’s cited investor Mike Vernal advocates a proposed premium tier, with a disclosed board/investor interest in Instinct; his and Thompson’s own hotel anecdotes are firsthand trials, not success rates.

What changes if Thompson is right. Thompson argues that close Apple/LG second-party hardware integration may be the best smart home for users who do not want to rebuild device software; his own desired agent-coded home is a different customer segment. In commerce he thinks a common standard can reduce brittle browser automation, while absence of Amazon exposes tension between a general personal assistant and a site controlling its own distribution; he endorses a higher-paid, agent-friendly Amazon rather than relying on ad/lock-in rents. This is a strategic forecast. Test the same purchasing/support task with an enrolled and non-enrolled merchant: exact consent default, agent identity, requested grant, merchant rate/write guard, completion and reversal, direct and repeat contacts, third-party support minutes, economics to each party. A shared standard does not replace a business’s right to say no or make integration maintenance disappear.

Connection: agent interface versus sustained product, external-service boundary, supplier refusal, full cost ledger. If a later v0.1 spec or deployed merchant case arrives, re-check against actual access defaults and rate enforcement instead of taking the announcement as the case study.