Personal Agent Protocol: PACT and Poppy Draft Show Early Split

A standard arrives, and a parallel spec arrives with it

The effort to standardize how consumer AI agents deal with businesses has gained momentum quickly, and it has also started to splinter. On October 6, 2026, Meta and Sierra announced the Personal Agent Protocol (PAP). It is an open standard for how a person's AI agent locates a business, authenticates through OAuth, and completes a task through the company's website, its APIs, or its own agent. 25 Three days later Sierra published a draft of the protocol, nicknamed "Poppy," and named 35 additional design partners, including OpenAI. 2

In roughly the same window, Decagon open-sourced a separate specification. It is called the Personal Agent Consent & Trust Protocol (PACT), and Decagon built it with Instinct. Decagon also said it is joining the PAP working group to help shape an industry standard. 1 That combination is the interesting part. PACT is not a hostile fork. It is a fully specified alternative from a company that also says it wants a seat at the PAP table.

What PAP is trying to fix

Sierra frames the problem in practical terms. Today a personal agent that needs to buy something or resolve an issue often has to log in as the customer and click through pages designed for humans. Businesses have no standard way to guide that agent. 3 PAP's answer is to give consumers choice and control while letting companies know when an agent is acting and on whose behalf. 3

The draft relies on existing infrastructure: OAuth, JSON Web Tokens, HTTPS, OpenAPI and MCP. Its core is designed to be extended so that individual industries can add their own layers. 3 It also lets agents carry context across channels and reach a business through its website, through MCP/OpenAPI, or through a company-owned agent. 5

Even the launch had some loose edges. Sierra's announcement listed Genesys, Instinct, Rocket, Shopify, Stripe and Walmart as partners. Meta's David Singleton posted a different list that included NiCE and Decagon. 2 By the time of the October 9 draft post, Sierra's own roster included NiCE. 3 None of this is a scandal, but it shows a coalition still settling who is in it.

Where PACT diverges

PACT's design choices overlap with PAP in spirit but differ in specifics. Decagon says requests should be routed through the business's agent. The personal agent states what the customer wants, and the business's agent operates the underlying tools under company policy. 1 PACT is built on Google-originated A2A for agent-to-agent communication plus OAuth for authorization. It also explicitly separates identity, meaning which agent is calling, from authority, meaning what the customer has allowed it to do. 1

By contrast, PAP treats the company agent as one option among several channels and leans on MCP and OpenAPI. 35 Both specs agree on OAuth. They differ on the messaging layer and on how central the business-side agent should be. Decagon's stated rationale is the same one PAP's backers give: without a shared spec, developers must reconcile how each provider identifies agents, obtains consent and carries authorization. 1

The security question nobody has settled

A developer post on DEV Community points to how much PAP leaves undefined. It notes that the protocol standardizes the "front door" but leaves what sits behind it to each company. 4 The authors prototyped one approach. In their design, the company agent talks and proposes actions but holds no credentials. A deterministic gateway makes the decision and issues a single-use grant tied to the exact input. 4 They are candid about the limits. The design caps the damage a manipulated agent can do at whatever policy permits, but it cannot stop the agent from being tricked into proposing something policy allows. It also has had no independent review. 4

That concern sits in a broader context of agent-driven risk. The same week, CloudSEK warned that AI coding agents that auto-accept dependency suggestions could speed exposure to npm supply-chain attacks such as the 14-month MALFEX campaign. 5

The reading

This looks like ordinary early-standards jostling rather than a format war, at least for now. Decagon joining the PAP working group suggests that PACT is meant to influence the standard, not replace it. 1 The real divergences are A2A versus MCP/OpenAPI, and whether the business's agent should be the mandatory gateway. Those are exactly the issues a working group exists to resolve.

The risk is that both specs get implemented before they converge, which would leave businesses supporting two front doors. PAP holds the stronger hand: it has Meta, a large and growing partner list, and OpenAI among the design partners. 2 The more durable contribution may come from the edges, though. PACT's identity-versus-authority split and the community's gateway experiments address how much an agent should be trusted once it is inside, a question PAP has so far left open.