On October 6, Meta and Sierra proposed an open standard for how a customer’s AI agent signs in to a business and acts on that customer’s behalf. Three days later, 35 more companies joined as design partners, among them OpenAI, Visa, Mastercard, PayPal, Bank of America, and Cloudflare. Walmart, Shopify, and Stripe were there from the start.
Meta summed up the stakes in one line: “Turning away a personal agent means turning away the customer behind it”.
Meta is right, but for most enterprises the harder question comes after the agent is let in. Can your customer data tell it who it represents, what it may do, and what it did? Most coverage so far has treated this as a payments or customer-experience story. We think it lands hardest on data strategy.
What Meta and Sierra Have Proposed
The Personal Agent Protocol works like a front door with a guest list. A company publishes a small file at a standard address on its website describing what agents may do there. An agent arrives, identifies itself, and starts as a guest; checking stock or a returns policy needs no login. For anything that touches an account, the customer signs in on the company’s own page and grants the agent read-only or write access. That one session then carries across the website, the company’s application programming interfaces (APIs), and its own service agent.
It’s early. The first draft appeared on October 9, and the 43 companies involved are partners in designing it rather than adopters. The draft defines only broad read and write permissions and doesn’t yet address audit or governance. Consumers are cautious too: in a Statista survey, 42% of Americans said they wouldn’t trust AI to make any purchase on their behalf.
None of this calls for a response this quarter, but the timelines don’t match. We expect the standards to settle within a year or two. Getting customer data to the point where an agent can safely act on it takes most enterprises longer than that, so the work has to start before anyone knows which protocol wins.
A Protocol Can’t Fix the Data Behind It
This standard joins a crowded field. In the past 13 months, OpenAI and Stripe launched the Agentic Commerce Protocol for checkout. Google launched the Agent Payments Protocol for payment authorization, then developed the Universal Commerce Protocol with Shopify, Etsy, Wayfair, Target, and Walmart to cover the journey from discovery to order management. Each solves a real plumbing problem, and the market will consolidate. For most enterprises, picking the winner matters less than what sits behind whichever door they open.
We already have a preview. In March, less than six months after launch, OpenAI scaled back ChatGPT’s Instant Checkout and began letting merchants use their own checkout instead. Shortly after launch, an executive at a large specialty retailer had listed what the feature would need, and most of the list was data: real-time inventory, promotions, customer data collection, and loyalty program integration. Walmart executive Daniel Danker said items bought inside the chatbot converted at a third of the rate of items where shoppers clicked through to Walmart’s own site.
What Changes When Agents Act for Customers
Each of these is a weakness most customer data teams already know about. Agents make them much harder to work around.
Behavioral Data Thins Out
A decade of personalization, testing, and attribution was built on observing people: what they clicked, where they lingered, what they abandoned. An agent arrives with intent already formed, skips the merchandising, and leaves little behavioral trail. Imperva found that bots already made up more than half of web traffic in 2025. As more of that traffic acts for real customers, the clickstream tells you less, and value shifts to what you know before the visit: identity, history, entitlements.
Consent Gains a Third Party
Most consent records describe one person making one choice. A customer who lets an agent read orders but not touch payments has created a third party with partial authority, and few customer data models can represent that. California already met this pattern for privacy requests: when an authorized agent asks to see, correct, or delete someone’s personal data, a business can require proof of the consumer’s signed permission and ask the consumer to confirm directly. Commercial transactions will need the same discipline at far greater volume.
The Permissions File Shows Where Systems Disagree
Under the draft, a company publishes what agents may do on its site. Writing that file forces precise answers: which customer, which accounts, which actions, through which channel. One session across web, API, and service agent assumes one customer behind it. Most enterprises have several versions of that customer in systems never designed to agree; MuleSoft’s survey of more than 1,000 IT leaders found that only 29% of the average enterprise’s applications are integrated. When a loyalty balance differs between the app and the call center, a person usually notices and asks. An agent will act on whichever number it’s given.
Five Questions Worth Asking Now
This lands first on consumer-facing businesses where customers hold accounts: retail, travel, banking, insurance, and telecom. For leadership teams there, these questions are worth asking while the answers are still cheap:
- If a third of your customer visits came through agents, what would your analytics stop telling you?
- Could you write down, in one public file, what a customer’s agent may do with you? Would your systems agree with it?
- When an agent acts with partial authority, whose consent record is it, and where does it live?
- Which parts of your advantage can an agent actually see? Brand and experience count for less with a buyer that never looks at the page.
- If a customer’s agent were turned away today, would you even know?
What Readiness Looks Like
An enterprise that’s ready for agents can answer three things about any one that arrives: which customer it represents, what that customer has allowed, and what it did. Each answer rests on work most data leaders already have on their list. The first needs a single customer record that the website, the APIs, and the service channel all resolve to. The second needs consent stored as data, with scope and an expiry, which most consent tools weren’t built to hold. The third needs an audit trail that ties every agent action back to a customer and the permission behind it.
The hard part is rarely the tooling. It’s agreeing who owns the customer record and who decides when two systems disagree, and that takes longer than adopting any standard. The protocols will be ready well before most enterprises are, so the window to close that gap is now, whichever one wins.
If these questions are already on your list, let’s compare notes on where to start.