Meta and Sierra are writing an open standard for how personal AI agents deal with businesses, and more than 40 companies have signed on to help shape it, including OpenAI, Visa, Mastercard, Bank of America and Target.

Sierra, the customer-service AI company led by Bret Taylor and Clay Bavor, announced Personal Agent Protocol on Oct. 6 at its Sierra Summit. It described the protocol as "an open standard Meta and Sierra are developing along with industry partners at Genesys, Instinct, Rocket, Shopify, Stripe, and Walmart that defines how personal agents interact with businesses."

The core rule, in Sierra's words: "consumers decide what access to give their personal agents, and companies set parameters for what those agents can do." An agent can start as a guest to check stock. When a customer signs in through OAuth, "The customer is always in control, deciding whether the agent has read-only or write access."

On Oct. 9 Sierra published a 0.1 draft, nicknamed Poppy, under an Apache 2.0 license. Companies post a discovery file on their website and choose whether agents use their web pages, their APIs through standards such as MCP and OpenAPI, or their own customer-service agent. Sierra also named 35 more design partners, including OpenAI, PayPal, Wells Fargo and United Airlines.

"When customers send an agent, they expect the same service they'd get themselves," Stripe payments head Kevin Miller said in Sierra's announcement. Genesys CEO Tony Bates said brands need "a trusted way to know who an AI agent represents, what it's authorized to do, its intent, and how to work with it securely."

Meta announced the effort in its own post on its Meta for Business site. David Singleton, a vice president at Meta Superintelligence Labs, told CNBC the companies are "defining rails that we hope personal agents and business agents can run over for the future," comparing it to email. At the summit, a Rocket executive used Meta's personal agent, Muse, to get a mortgage pre-approval through Rocket's agent, Sierra said. Payments are a planned extension, not part of the draft.

The draft's own site says that today "it is all or nothing" for agents at a company's door. If Poppy sticks, banks, airlines and retailers would decide what an AI agent may do with a customer's account, rather than blocking agents outright or letting them pose as the customer.