Andy runs a five-person landscaping crew with no office manager. His AI agent handles the paperwork nobody on the crew has time for: It books equipment rentals, moves jobs when the weather forecast changes, and reorders soil and mulch before a job runs short.

Andy set the limits when he turned it on: The agent can book and reschedule on its own, but any orders over $500 wait for his OK. It can see his account at the rental shop, but it can't open a new one in his name.

On Tuesday, rain moves into Thursday's forecast, and Andy's agent calls the rental shop to push his excavator booking to Friday. The shop answers with an agent of its own. Two agents, no people, and no way for the store to tell whether this is really Andy's agent or confirm what that agent can do for their customer.

Andy set his limits. The shop has to answer the other half. That split, and where those permissions conflict, is one of the hottest debates in agentic commerce right now.

The standoff that started it

On Sept. 20, Amazon blocked Muse, the personal AI agent Meta had launched 12 days earlier, from shopping on Amazon.com. Amazon told GeekWire that Meta never gave notice that Muse would use its store, that the agent didn't identify itself while browsing, and that it appeared to capture and store customer credentials. Meta, for its part, said Muse never sees passwords or payment methods.

Each of Amazon's complaints traces back to the same gap Andy and the rental shop have: The store couldn't see who sent the agent or what it was cleared to do. When a business can't tell, the simplest move is to block every agent, and that also turns away customers like Andy who just want an order placed.

Two weeks later, Meta and Sierra announced the Personal Agent Protocol, an open standard for how a person's agent finds a business, signs in with that person's permission, and acts on their behalf. Walmart, Shopify, and Stripe are among the partners. A first draft of the specification went public Oct. 9.

The protocol splits the decision in two. The customer decides how much access the agent gets, down to whether it can only look at an account or also make changes. The business decides what the agent can do once it's on their site, as well as which route it takes: the regular website, an API, or the business's own agent when the task needs a conversation.

The Personal Agent Protocol has a few competing rulesets, though, that even their own advocates have endorsed. Visa backs a competing protocol from the Linux Foundation, and Stripe and Shopify have signed on to both. Whichever best practices win out, though, the split between what a customer tells their agent to do and a business allows will likely remain to limit legal liability on both sides if an agent goes rogue.

Agentic AI on websites is just the start

Most of the coverage of agentic commerce protocols has focused on websites. But personal agents won't stay there: They'll call phone lines and open chat windows, too, which is why contact center companies like Genesys also signed on for the Personal Agent Protocol.

Phone and chat systems were built on the assumption that a person is on the other end. That assumption, and the identifying measures that go with it – security questions, checking for speech patterns – makes it just about impossible for Andy’s agent to do the job he needs it to do. The shop needs another way to know who it's dealing with, and its own agent needs to know when to stop and get a person.

For the person sending the agent, the decisions look like this:

• Which businesses can the agent deal with?
• Where do I want the agent to stop, like a purchase over a set amount?
• What account information can it access or view?
• How do I see what it did, and how do I turn it off if I need to?

The businesses letting the agent in, regardless of what channel it’s coming from, have different priorities:

• Recognize when the customer is an agent, and confirm it's acting with that person's permission.
• Match permissions to the stakes: Checking an order’s status is different from cancelling one.
• Bring in a person for judgment calls. If Andy's agent asks the shop to waive a late fee, someone on staff should decide.
• Keep as strong a record of what Andy’s agent does as the business does of Andy himself. If Andy's agent calls Tuesday and he walks in Thursday, the shop should see one customer with one history.
• At the same time, delineate whether the agent or Andy was the source of a request for something, as well as what was approved and what was done.

The person sets the outer limits, and the business sets the rules inside its own doors. When both do their half, Andy's agent moves the booking, and the shop knows it’s doing right by its customer. 

The excavator shows up Friday, hassle-free.

Where agentic AI companies fit

The protocol names a business's own agent as one of the ways a personal agent gets things done. That agent is what companies like Napster build.

With the Napster API, a business can run an omniagent: one agent that works across its website, phone line, app, and store counter, with memory that carries between them. The businesses that keep customers like Andy need that kind of agent at the entrance to each part of their business, one that can tell who sent the visitor and what it's cleared to do, and then get the job done.

Napster will be showing off its Omniagents live at Microsoft Ignite, Booth 1754(R), from Nov. 17 to 20 in San Francisco. To learn more about getting an Omniagent for your business today, check out Napster Agent.

‍