On October 6, Sierra and Meta announced Personal Agent Protocol (PAP), an open standard for how personal AI agents authenticate with businesses and what those businesses let them do, developed with Genesys, Instinct, Rocket, Shopify, Stripe, and Walmart. There's no spec yet — a v0.1 is promised later this month — but the shape is already clear. Sessions run on OAuth. An agent can start as a guest for low-stakes queries like checking stock or a return policy; once a customer signs in, they grant the agent either read-only or write access, and that session carries across channels, so a question asked before login and an order changed afterward belong to the same visit. Businesses pick the door the agent walks through: the regular website, APIs built on MCP or OpenAPI, or the company's own agent for anything requiring conversation. What makes this notable isn't the plumbing — OAuth is deliberately boring — it's who signed on and who didn't. Stripe, Shopify, and Walmart are PAP partners, but all three are also already committed to a rival agentic-commerce protocol run by Visa. Amazon, OpenAI, and Anthropic are absent from PAP entirely. The announcement also landed sixteen days after Amazon began blocking Meta's Muse agent from its retail site, which makes the timing read less like coincidence and more like a direct response to platforms closing their doors to outside agents. Meta's David Singleton, a former Stripe CTO now at Meta Superintelligence Labs, framed the ambition in email terms: the goal is rails personal agents and business agents can both run over. That's a real need — every company figuring out how to let outside agents transact creates its own bespoke rules otherwise. But a standard backed by companies simultaneously hedging on a competing standard isn't really a standard yet. It's a bid for one. Payments are explicitly left out of v0.1; Sierra lists them as a future extension rather than part of the initial release. So what ships this month is narrower than the pitch: authentication and session continuity, not the commerce layer everyone actually cares about. Whether PAP becomes the common handshake depends less on its technical design than on whether Stripe, Shopify, and Walmart eventually have to pick a side — PAP or Visa's protocol — instead of keeping a foot in both.