The Personal Agent Protocol: your agent gets a front door. We build what is behind it

We build personal agents for a living. Haico, our AI for real-world experiences, takes a sentence like “four of us tonight, house, not too crowded”, turns it into a plan with its reasons shown, and moves no money, sends no invite and publishes nothing until its owner approves — that is the whole design. So when Sierra and Meta announced the Personal Agent Protocol on 6 October, we read it the way a builder reads a new building code: with professional interest, and a certain relief. PAP is an open standard for the other half of our problem — how a personal agent presents itself to a business. It is built on OAuth, the same mechanism behind “sign in with Google”; it lets an agent authenticate as itself, declare what it has come to do, and receive permissions its owner scopes from read-only up to write; and it launches with real retail weight behind it — Shopify, Stripe, Walmart, Genesys, Rocket and Instinct among the partners, with a v0.1 specification promised within the month. The agent your customers send is getting a front door. The question the spec does not answer is what should happen behind it.

What the Personal Agent Protocol actually standardises

Until now, a personal agent visiting a business has had exactly one costume: its owner. It drives a headless browser, carries the owner’s cookies, fills the owner’s forms — and from the business’s side of the counter it is indistinguishable from the bot traffic every security team spends money repelling. The result is a lose-lose at the gate: block the agent and you turn away a paying customer’s emissary; let it in and you have admitted something you cannot see, rate-limit or reason about. PAP replaces the costume with a passport. The agent opens a session of its own — the business knows it is an agent, whose agent, and what it came to do — and the business chooses its own door: the existing website, a machine interface like MCP or OpenAPI, or a conversation with the business’s own agent. Permissions persist across channels and are scoped by the human: a reading agent can compare prices, a writing agent can place the order. None of this is exotic engineering, and that is precisely its virtue — it is the boring, battle-tested plumbing of OAuth pointed at the newest actor on the web. Notably absent from the launch list: Amazon, OpenAI and Anthropic — which is a reminder that “open standard” and “the standard” are different claims, and this one still has a standards war to survive.

What a handshake cannot fix

A protocol like this fixes legibility, and legibility matters: it converts adversarial scraping into consented commerce, gives businesses a surface they can meter and audit, and gives users a permission screen instead of a leap of faith. But three problems walk straight through the new front door. First, identity is not judgment: an agent that signs in impeccably can still have misunderstood its owner — scoped write access is still money moving on an inference. Second, the receipt problem: when the agent has been and gone, what record does its owner hold of what it understood, what it chose and why? OAuth logs that a session happened, not whether it should have. Third, the standard governs the agent-to-business half of the conversation and is silent on the agent-to-owner half — and that silence is where trust actually lives. We have spent the year writing about exactly this gap from the enterprise side: agents reaching tools through a governed path, completion that demands evidence. The consumer version of the same argument is simpler and more personal. Your agent’s passport is between it and the shop. Its promises are between it and you.

Where we stand: the house behind the door

Our products are, in effect, the other half of the protocol — the owner’s half. Haico shows what it understood as checkable chips before it acts, puts a reason on every recommendation, and holds payment, invitations and publishing behind explicit approval: the front door can be as standard as the industry likes, and the lira still does not move until the human says so. Qevron is the same conviction for organisations — one governed, metered, logged path for whatever your software calls, so an agent’s reach is a catalogue you curate rather than an internet it discovers. And Kimene writes the record PAP never sees: which account, which machine, which route ran the work, every alternative that was rejected and why, and a completion state that cannot be self-declared. A legible agent at the door, a reasoned plan before the act, an immutable record after it — that is the full chain, and a handshake is only its first link.

• Identity at the door: the agent signs in as itself, with declared intent — what PAP standardises
• Reasoning before the act: understood intent shown and checkable — how Haico is built
• Approval before money: payment, invites and publishing behind the owner’s explicit yes
• A governed path for reach: tools and calls through one metered, logged gateway — Qevron
• A record after the act: routes, rejections and evidence-gated completion — Kimene

What we will not claim

Three honest limits. First, we are not a PAP launch partner and this is not an endorsement from inside — it is a builder’s read of a public announcement, written because the design questions are ones we answer daily. Second, PAP is an announcement with a v0.1 promised, not a deployed standard: specifications slip, partners drift, and the absence of Amazon, OpenAI and Anthropic means the agent web could yet speak several dialects — adopt the idea before you bet the roadmap on the acronym. Third, no protocol makes an agent right. PAP makes agents legible to businesses, and that is genuine progress; whether the agent understood its human, and whether anything irreversible waits on that human’s approval, is decided in product design — and will stay there.

An agent that signs in as itself is legible. An agent that shows its reasoning and waits for your approval is trustworthy. The protocol delivers the first; the second has to be built.

For readers in Türkiye the timing is not accidental: agent checkout rails are already live, agent traffic is already at every business’s gate, and the KVKK-era reflexes — least privilege, explicit consent, auditability — map almost one-to-one onto PAP’s scoped sessions. If the standard lands, the web gets a door policy for agents; what your agent does with its key is still a product decision. Ours are on the record: Haico asks before it spends, Qevron meters what software calls, Kimene writes down what the workforce did — from Arpanet Bilişim A.Ş., built so that when your agent knocks on the world’s new front doors, you remain the one who decides what it signs.