AI

Meta and Shopify draft rules for AI shopping agents, minus OpenAI

Walmart, Stripe and Sierra also back the Personal Agent Protocol, whose v0.1 specification is due this month, leaving Australian merchants to decide how far agents may sign in and buy on their sites.

6 min read
Geometric illustration of a queue of birds carrying shopping bags being checked in at a shop door by an owl, dusty mauve ground
Illustration: Prompt the Market
James Dore
By James Dore · 2026-10-07

TLDR

Sierra launched the Personal Agent Protocol on 6 October 2026 with Meta, Shopify, Stripe, Walmart and four other partners, setting rules for how AI agents authenticate and transact with businesses. OpenAI, Anthropic, Google and Amazon are not in the coalition, and the v0.1 specification is due later in October.

KEY TAKEAWAYS

01Sierra announced the Personal Agent Protocol on 6 October 2026 alongside Meta, Shopify, Stripe, Walmart, Genesys, Instinct and Rocket.
02The protocol uses OAuth and supports MCP and OpenAPI, covering agent authentication, consumer permissions and business visibility.
03OpenAI, Anthropic, Google and Amazon are absent from the founding coalition, leaving major gaps in coverage.
04A v0.1 specification is due later in October 2026, with no confirmed roadmap beyond that date.
05Australian merchants on Shopify and Stripe must now decide whether to allow AI agents to sign in and transact on their sites.

Eight companies, one open standard

Sierra, the enterprise AI company co-founded by Bret Taylor, announced the Personal Agent Protocol on 6 October 2026 alongside seven partners: Meta, Shopify, Stripe, Walmart, Genesys, Instinct and Rocket.[1] Right now, when an AI agent tries to book a flight, buy a gift or cancel a subscription on your behalf, there are no agreed rules for how it identifies itself, what it can access, or how a business should treat it.

The protocol is built on OAuth and supports integration through a company's website, APIs including Model Context Protocol (MCP) and OpenAPI, or a company-run agent.[1] OAuth is the same authorisation framework that lets you log into a third-party app using your Google account. The protocol adds three layers on top: authentication, consumer control over what the agent can access, and visibility for businesses into agent activity.

Taylor described the current situation plainly. "It is kind of chaos until such a standard exists," he said.[4]

Who is in, and who is out

The founding partners cover significant ground. Shopify and Stripe bring merchant platforms and payments, Walmart brings direct retail scale, and Meta connects the protocol to the social and messaging surfaces where agent interactions are starting to appear.[1] Genesys chief executive Tony Bates said personal AI is creating a new front door to the enterprise, framing the protocol as infrastructure for customer service as much as commerce.[1]

Shopify VP Product Mani Fazeli said that as personal agents become part of everyday life, merchants have a new frontier for excellent customer service.[1] Stripe's Head of Payments Kevin Miller put it in direct terms: "A customer relationship doesn't start or end at checkout. When customers send an agent, they expect the same service they'd get themselves," he said.[1]

OpenAI, Anthropic, Google and Amazon are not launch partners of the Personal Agent Protocol. The agents most consumers currently use, ChatGPT, Claude and Gemini, are built by the companies that did not join. A standard that does not cover the dominant agents has a ceiling on its reach.

The protocol supports the Model Context Protocol, which Anthropic created, yet Anthropic is not among the launch partners.[2] The v0.1 specification is due later in October 2026, so the gap between announcement and a published, testable spec is measured in weeks.[1]

Why this month, and not last year

AI-driven commerce is already changing spending behaviour at scale. Adobe's US data, covered here this month, showed shoppers referred by AI tools spent 53 per cent more per visit, while Meta's Muse shopping agent logged 5.6 million requests.[5] When agent traffic carries a measurable dollar premium, the rules governing that traffic stop being theoretical.

Infrastructure pricing is moving in parallel. Cloudflare moved in the same period to bill AI agents per-request in closed beta, treating agent traffic as a distinct billing category separate from human browsing.[6] Agents that pay per request and convert at a higher rate give merchants and platforms a direct financial interest in agreeing on how those agents authenticate and what they can do once inside a site.

The decision for Australian merchants

Shoppers referred by AI tools spent 53 per cent more per visit in Adobe's US data.[5] For an Australian merchant running on Shopify or Stripe, both founding partners of the protocol, that figure makes this an immediate question: do you configure your site to accept agent sign-ins, and on what terms?

The protocol gives businesses visibility into agent activity, not just a mechanism to block it. An authenticated agent operating under a consumer's explicit permission is a different thing to a scraper, and the protocol is designed to make that distinction machine-readable.[1]

The practical answer for most Australian merchants will depend on which agents their customers actually use. Until OpenAI, Anthropic or Google join the coalition, the protocol covers a fraction of the agent market. The v0.1 specification is due later in October 2026.

FREQUENTLY ASKED QUESTIONS

What is the Personal Agent Protocol?
It is an open standard announced by Sierra and seven partners on 6 October 2026 that sets rules for how AI agents authenticate with businesses, what consumers can authorise them to access, and how companies can monitor agent activity. It is built on OAuth and supports MCP and OpenAPI.
Which companies are founding partners?
Sierra, Meta, Shopify, Stripe, Walmart, Genesys, Instinct and Rocket are the eight founding partners. OpenAI, Anthropic, Google and Amazon are not part of the launch coalition.
When will the specification be published?
A v0.1 specification is due later in October 2026. No timeline beyond that has been confirmed.
What does this mean for Australian merchants?
Merchants using Shopify or Stripe, both founding partners, will need to decide whether to allow AI agents to sign in and transact on their sites. The protocol gives them a framework to authenticate agents and control what they can access, but its reach is limited until the major agent providers join.
James Dore

James Dore

James Dore is Strategy Director at Bushnote, a leader in SEO and AEO in Australia. He writes on search, AI and the technology decisions shaping government and industry.

The prompt
Every weekday morning: the five stories moving marketing, media and money, with the number that matters in each.
Sending your link…
Check your inbox to confirm.
That didn't go through. Try again.
Related topics

Make us a preferred source on Google

Tap once and our reporting shows at the top of your Google search results and AI answers. You can change this at any time.

Add as a preferred source on Google
Subscribe, it's free