In this article
On October 6, 2026, Meta and Sierra announced Personal Agent Protocol, an open standard for how an AI assistant acting for your customer enters your website or app, signs in on their behalf, and completes a task such as finding a product, tracking an order or checking out. Six companies joined from day one, including Walmart, Stripe and Shopify, and just 3 days later draft 0.1 was published along with 35 new partners, among them OpenAI, Visa, Mastercard and PayPal. The practical meaning for a store or service owner in Saudi Arabia: customers will arrive who do not browse themselves, and you decide what their assistant may see and do. Start this month by listing what can be done on your site without staff, and decide which actions need the customer's explicit approval.
What exactly was announced?
According to Sierra's announcement of October 6, 2026, Meta and Sierra are developing the standard with Genesys, Instinct, Rocket, Shopify, Stripe and Walmart. It covers three things: the assistant signing in on the customer's behalf, customer control over permissions (read-only or read and act), and the company's visibility into what the assistant does inside its systems. In its October 9 post, Sierra published the first draft, nicknamed Poppy, at personalagentprotocol.org and named 35 additional design partners from banking, retail, airlines and telecoms, including Bank of America, Wells Fargo, Target and United Airlines.
How does it work, in plain terms?
Today an AI assistant deals with your site in one of two bad ways: it takes the customer's password and pretends to be them, or it gets blocked entirely. The standard proposes a third path, according to the official introduction page:
- The assistant always identifies itself: you know you are dealing with an AI agent, not a person, and whom it works for.
- You set the level: for example, allow product search without sign-in, show orders after sign-in, and require the customer's approval before any payment.
- The customer decides what to grant: at sign-in they choose whether the assistant can only look or can also change and buy, and they can withdraw that permission later.
- 3 ways in: your normal web pages, programming interfaces (APIs) through known standards such as OpenAPI and MCP, or your company's own AI assistant.
The standard is built on existing technology such as OAuth, the same mechanism behind the familiar «Sign in with Google» button, so it does not require a new system from scratch.
Why does this matter for a business in Saudi Arabia?
Because the companies behind it own the channels to the customer: Meta through WhatsApp and Instagram, Shopify and Stripe through stores and payments, OpenAI through ChatGPT. If «reorder what I bought last month» becomes an instruction customers give their assistant, a store that the assistant cannot deal with safely will lose the order to one that it can. On the other hand, a store that opens everything without controls exposes itself to fake orders and refund disputes.
Many stores and services in the Kingdom already take orders through WhatsApp, Shopify stores or online payment gateways, the very channels whose owners are drafting the standard. Neither Meta nor any other partner has yet announced a date for switching the standard on inside its apps, so there is no reason to rush spending. But businesses that organize their data and permissions early will be ready when the first customer sends an assistant instead of browsing, and they will set the terms of engagement instead of having them imposed.
What to do now: 4 steps
- Know who visits you: ask your developer for a report on automated traffic in your site logs, since much of it today is AI assistants.
- Classify your actions: what is open to everyone (products and prices), what needs sign-in (orders and addresses), and what needs explicit approval (payment, cancellation and refunds).
- Clean up your data: accurate prices, stock and order status behind a clear interface, because an assistant reads data and is not impressed by design.
- Do not build on the draft yet: version 0.1 can change, and Sierra says it will run design workshops over the next month and publish a reference implementation for developers. Prepare the foundations and save the final commitment for the stable release.
The Origami view
We see this standard as a natural extension of what we already build for clients: a clear sign-in and permissions system, a clean API, and a log of every action. If your store or booking system already has those foundations, adding support for AI assistants later is weeks of work, not months. If it does not, now is a good time to sort it out before it becomes a necessity. Get in touch for a readiness review of your site, or see our services.
Conclusion
Personal Agent Protocol is still a draft, but a partner list that passed 40 organizations in 3 days says the way AI assistants deal with stores will be settled soon. The decision that cannot wait is yours: what you allow, and what needs the customer's approval.
Sources
Frequently asked questions
What is Personal Agent Protocol?
An open standard announced by Meta and Sierra on October 6, 2026 with Shopify, Stripe, Walmart and others. It defines how an AI assistant signs in to a company's site on a customer's behalf, what permissions the customer grants, and what the company can see of its activity.
Can a customer's AI assistant buy from my store without me knowing?
Under the standard, the assistant always identifies itself, and you decide what it may do: search only, view orders after sign-in, or buy with the customer's explicit approval.
Should I implement the standard in my store now?
Not yet. What is published is draft 0.1, which can change. The better move now is to set the foundations: clear sign-in and permissions, an API for product and order data, and a log of every action.
Which companies are involved?
It started with Meta and Sierra alongside Genesys, Instinct, Rocket, Shopify, Stripe and Walmart, and on October 9, 2026, 35 more partners were named, including OpenAI, Visa, Mastercard and PayPal.
Follow Origami in Google
Pin Origami as a preferred source and our articles will surface first for you in Google Search and Top Stories.
