Personal Agent Protocol
Personal Agent Protocol (PAP).
Personal Agent Protocol (PAP, "Poppy") is an open draft protocol from Meta and Sierra for how a consumer's personal AI agent discovers a company, signs the user in over OAuth, and acts within scopes the user grants.
PAP is the clearest attempt so far to replace the habit of handing an agent your password. Instead of logging in as the user, the agent asks the company for a session, the user signs in on the company's own page, and the company decides which scopes exist. That is ordinary delegated access, applied to consumer agents. The agent credential sharing entry covers the pattern it replaces.
For a CIAM team the work is familiar: publish discovery metadata, expose an OAuth authorization server, define scopes a person can understand, and record which agent holds which grant. The protocol adds the session concept on top, so one sign-in can cover API calls, conversations with the company's agent, and browsing. Sources: Sierra's launch post and the specification site.
Our reading. The draft is moving fast, with three numbered versions in five weeks, so pin to a published version rather than the latest draft. Scope design matters more than the protocol choice: a user granting "read orders" versus "place orders" is the agent-level consent decision, and it belongs in your consent records. For the wider pattern, see authorization patterns for agentic workflows.
Common questions
What is the Personal Agent Protocol?
Personal Agent Protocol (PAP), nicknamed Poppy, is an open draft protocol announced by Meta and Sierra on October 6, 2026. It defines how a consumer's personal AI agent finds a participating company, signs the user in through OAuth on the company's own page, and acts through APIs, web pages or the company's own agent within the scopes the user granted.
Is the Personal Agent Protocol built on OAuth?
Yes. Sierra's launch post says the session is built on OAuth, and draft 0.3 moved further toward standard OAuth, with company-defined scopes and a separate Session header. The user signs in at the company, not inside the agent, so the agent never handles the user's password.
Who is behind the Personal Agent Protocol?
Meta and Sierra are developing it. Sierra's October 6, 2026 announcement named Genesys, Instinct, Rocket, Shopify, Stripe and Walmart as industry partners. The specification is published at personalagentprotocol.org under Apache 2.0; it is not hosted by a standards body.
Is the Personal Agent Protocol final?
No. As of November 9, 2026, versions 0.1, 0.2 (October 24) and 0.3 (November 4) are published and frozen, and 0.4 is in progress. The project describes its work as a path to 1.0, and Sierra lists payments, push notifications and finer-grained permissions as later work.
Related terms
In the guides
Authentication for AI Agents: OAuth Patterns for Non-Human Identity
How AI agents authenticate in 2026. The on-behalf-of pattern, delegated agent identity, OAuth 2.1 Dynamic Client Registration, and where the patterns are still being invented.
Authorization Patterns for Agentic Workflows: Delegation, Constraints, and Just-in-Time Permissions
AI agents need authorization models that handle delegated permissions, multi-step workflows, and least-privilege at machine speed. The patterns that work and the ones being invented.
Token Management for AI Agents: Lifetimes, Rotation, and Revocation at Machine Speed
Agent tokens are stolen faster and used harder than human tokens. How to set lifetimes, rotate refresh tokens, scope per-tool, and detect anomalies in production agent deployments.