← Back to the Muse connector directory

The Personal Agent Protocol and PACT, Explained

Published October 6, 2026. This is a fast-moving story. Details below show what's confirmed as of announcement day.

On October 6, 2026, Meta and Sierra published the Personal Agent Protocol, an open standard for how personal AI agents deal with businesses. Days earlier, Decagon announced PACT, the Personal Agent Consent & Trust protocol, at its Dialogues event. Both announcements circle the same question: when your AI agent talks to a company for you, how does the company know who's behind it, and what that agent may do?

Here's what each protocol is, how they work, and what they mean if you connect apps to a personal agent like Meta's Muse.

What was announced

The Personal Agent Protocol sets out how personal AI agents interact with businesses. The problem it takes on: right now a business can't reliably tell whether it's dealing with a personal agent acting for a real customer or some random bot. The protocol gives businesses one consistent way to recognize personal agents and handle them. It uses OAuth-style sessions. You stay in control, choosing read access, write access, or nothing for the agent. The agent never sees your raw credentials.

PACT (Personal Agent Consent & Trust) comes from Decagon and approaches the same problem through consent. It builds on the Agent2Agent protocol, which covers how agents find each other and trade messages, and adds delegated authorization on top of OAuth 2.0. In plain terms, that's a signed, verifiable token proving this agent represents this person, and this person approved these specific actions. When your agent meets a business's agent, the business checks the token instead of guessing.

Who's behind it

Sierra leads the Personal Agent Protocol with Meta. Sierra is the enterprise AI company Bret Taylor co-founded after co-running Salesforce; Taylor also chairs OpenAI's board. Launch partners named in Sierra's announcement: Genesys, Instinct, Rocket, Shopify, Stripe, and Walmart. Taylor put the motivation bluntly to CNBC: "Companies will know when it's a personal agent versus an actual person… It is kind of chaos until such a standard exists."

PACT comes from Decagon, which builds AI customer-service agents for enterprises. Decagon introduced it alongside its Personal Agent Gateway, a product that spots personal agents contacting a business over chat and voice, then routes them to a dedicated channel run under separate procedures. Decagon says the PACT specification is published and that it's refining it with personal agent providers and enterprise customers.

How it works

Two mechanisms, in plain terms.

Sessions (Personal Agent Protocol). Picture signing into an app with Google, except it's your agent signing in. When your personal agent contacts a business, it opens a session identifying itself as your agent, acting for a verified customer. You set the session's scope: read-only for looking up an order status, write for changing a booking, or nothing at all. The session carries a grant of permission. Your passwords and payment details stay out of the agent's hands entirely.

Delegation tokens (PACT). Say your agent needs to work directly with a business's own agent, like your travel agent negotiating with an airline's support agent. PACT supplies a verifiable token that travels with the request. The token certifies which person the agent represents and exactly what that person authorized. Decagon's own example: a traveler lets their personal agent view flights but not rebook them. The airline's agent shares earlier flight options. It can't complete the change until the traveler approves rebooking. Permission sits in the token.

In both designs the person grants permission up front, and the business verifies a token before acting on it.

What it means for Muse connector permissions

This should sound familiar if you use Meta's Muse. Muse connectors already work on the same principles: OAuth-style connections, read-versus-write control per app, approval prompts before sensitive actions, credentials held in a secure store the agent can't read directly. Check the full list of Meta Muse connectors to see how each one is permissioned today.

These protocols stretch that model past the apps you've explicitly connected, out to every business your agent might contact. That matters because of what agents do today with no connector in place. Muse often drives a website in a browser, clicking around the way a person would. It's the most fragile way to connect. It's also the traffic Amazon blocked in September, citing scraping concerns. In a world where businesses adopt the Personal Agent Protocol, your agent identifies itself properly at checkout instead of tripping bot defenses. Connectors stop being per-app workarounds and turn into standard handshakes.

What v0.1 won't cover

  • No universal adoption. This is a shared proposal. Nobody has to follow it. Amazon, the highest-profile agent blocker, isn't part of either effort.
  • The specs are still moving. Decagon says the PACT specification is available and under refinement with partners. Expect details to shift before anything is final.
  • Nobody has described enforcement. Nothing compels a business to implement either protocol, or an agent provider to support them.
  • The hard edge cases stay open. Nobody has said what happens when the person can't be reached for approval mid-task. Token expiry, revocation, dispute resolution: none of that is public yet.

Why it matters

Personal agents went mainstream in about a month. Muse topped app store charts within days of launch. Businesses suddenly field support requests from software. Until now, almost every one of those interactions has been improvised. Agents drive browsers while posing as humans. On the other end, businesses guess who's calling. Anti-bot systems usually block first and ask questions later.

The Personal Agent Protocol and PACT are the first serious attempts at real infrastructure for this. They give agents a way to prove identity and attach the person's consent in machine-checkable form. If these stick, a new list starts to matter: which businesses speak the protocol. We'll track adoption here as it happens.

Sources

← Back to the Muse connector directory