On September 21, Amazon blocked Meta’s Muse shopping agent from its store and justified the move with a list of grievances that reads like an incident report: the agent had never asked permission, did not identify itself while browsing, and, in Amazon’s telling, appeared to “capture and store customer credentials” (The Register). Two and a half weeks later, on October 6, Meta and Sierra published the Personal Agent Protocol, an open standard built for precisely the handshake Amazon said was missing (PYMNTS).
Those two events are the same story told from opposite ends, and most of the coverage missed it. One camp ran the consumer version (“your AI agent can shop for you now”). Another ran the business drama (“Amazon versus Meta”). The version that matters to anyone deploying or receiving agents is neither. Agentic commerce just resolved into two incompatible answers to a single question: how does a business decide what an AI agent is allowed to do on its systems? And the answer that will actually govern your exposure is not which model the agent runs on. It is the authentication regime each storefront chooses at its own door.
Two answers to one question, published the same day
The Personal Agent Protocol is an OAuth-based standard. An agent arrives as a guest and can do guest things, check stock or look up a return policy; after the customer signs in and authorizes it, the agent can be granted read-only access, and only then write access that lets it actually place an order (Forkast). Businesses plug it in through their existing websites, through APIs like MCP or OpenAPI, or by routing the visiting agent to a proprietary agent of their own. The founding group includes Sierra, Meta, Walmart, Shopify, Stripe, Genesys, Rocket, and Instinct, with a v0.1 specification and a reference implementation due by the end of October (PYMNTS). Sierra co-founder Bret Taylor summarized the motivation plainly: “It is kind of chaos until such a standard exists.”
The other answer is a wall. The same week the protocol shipped, every large retailer had effectively built a decision gate, and most of them are binary. QVC and HSN let agents complete purchases outright. Walmart surfaces products through Google’s Gemini and then hands checkout to its own Sparky assistant. Tapestry, the owner of Coach and Kate Spade, sells through Google’s AI tools but requires explicit approval on every order and keeps agents off its own checkout entirely. Amazon, Kohl’s, Delta, and United keep outside agents out, and Amazon is building its own platform in the space it cleared (PYMNTS, TechCrunch).
This is landing on top of an infrastructure default that already says no. On September 15, Cloudflare flipped its defaults to block agent-category crawlers on ad-supported pages unless a site opts them back in (TechCrunch). So the open web’s baseline answer to an arriving agent is now “denied,” and the storefront question is being decided one gate at a time on top of that baseline.
The standard is missing the rooms that decide it
A handshake protocol is only worth as much as the counterparties willing to shake. The Personal Agent Protocol launched without three of them, and they are not minor: Amazon, OpenAI, and Anthropic are all absent from the founding group (Forkast). That is the two largest agent makers and the single largest place agents actually transact. PYMNTS Intelligence found that 59.7% of recent AI-assisted purchases still closed on Amazon even when product discovery happened somewhere else (PYMNTS). A universal commerce standard that the dominant commerce destination and the dominant model vendors have not signed is aspirational, not universal.
The site has watched this exact fracture form twice before in a month, in other venues. When the frontier labs took competing governance blueprints to the UN Security Council, the news was not any single proposal; it was that no two of the parties who would have to agree actually did. When NVIDIA stood up an agent-safety control plane, the two labs with the deepest independent silicon sat it out. The pattern repeats here: the standard is real, the engineering is sound, and the rooms that decide whether it governs anything are not in it.
Amazon’s objection is an authentication complaint wearing a competition suit
It is easy to read Amazon’s block as pure turf defense, and competition plainly motivates it. But look at what Amazon actually said. Its complaint was that Muse “had neither informed it that Muse would access the store nor obtained authorization,” that the agent “fails to identify itself while browsing,” and that it appeared to capture and store customer credentials (The Register). Strip the branding off those sentences and they are an identity-and-secrets-handling objection: an unidentified non-human process is acting on a customer’s account with credentials nobody at Amazon authorized or can audit.
Meta’s rebuttal was the design claim you would expect, that Muse “cannot see users’ passwords or payment methods” and that credentials are “held in secure storage and made available for authentication without being exposed to the model” (The Register). That is a reasonable architecture. It is also a sentence to verify in a specification, not accept in a press statement. The whole dispute is about whether a business can trust what an agent is, what it holds, and who it answers to. Genesys chairman Tony Bates framed the protocol’s job in exactly those terms: brands “need a trusted way to know who an AI agent represents, what it’s authorized to do, its intent, and how to work with it securely” (Forkast). That is not a shopping problem. It is an access-control problem.
This is the service-account problem arriving at the storefront
Running IT operations at a large telecom for two decades, I spent a meaningful fraction of that time governing exactly this situation under a different name. We called them service accounts: non-human identities that act with delegated authority on behalf of a system or a person. The rules we enforced were not exotic. Every service account had to identify itself. It got the narrowest scope that let it do its job and nothing wider. Its grants were logged on our side, never taken on trust from the account’s own report of what it did. And we kept the ability to revoke it instantly, because an identity you cannot revoke is not an identity you control.
An AI shopping agent is a service account with initiative and a consumer attached. Everything Amazon objected to maps cleanly onto a service-account review that would have failed: no identification, unknown credential handling, no authorization on file, no audit path. And the reason the Personal Agent Protocol’s OAuth ladder (guest, then read-only, then write) looks correct is that it is the pattern that already works for delegated non-human access. The protocol did not invent a new security model. It is carrying a mature one into a place, consumer commerce, where the controls around it are nowhere near mature yet.
What a business should actually do when an agent knocks
Treat an inbound personal agent the way a disciplined IT shop treats any third-party service account requesting delegated access, and most of the hard questions answer themselves. Default to deny. Grant guest and read-only scope (browse the catalog, check a return) well before you grant write scope (place an order against a real account). Require the agent to identify both itself and the principal it acts for, and refuse the ones that will not. Log every action the agent takes on your infrastructure, independent of whatever the agent reports back, because a record the counterparty controls is not evidence. Keep revocation in your own hands. None of that depends on which protocol wins or which model the customer happens to run.
That framing also exposes why the binary gate most retailers built this month is the wrong shape. “Block everything” forfeits the 59.7% of agent-assisted demand that is coming whether you like it or not, and “allow everything” is the posture that got Muse accused of harvesting credentials. The right shape is the scoped, revocable, logged grant the protocol gestures at, and you own enforcing it regardless of whose standard is printed on the handshake. It is the same lesson that applies when you connect an always-on agent to your own apps and the same one the new operator-liability framework is about to make a matter of record: the governance question is no longer who can log in, it is which agent, acting for whom, holds which scope, and whether you can prove it later.
The model your customer’s agent runs on is not your decision and not your risk. The scope you grant it is both. Agentic commerce did not arrive as a shopping feature. It arrived as an access-control decision, and the businesses treating it as identity governance rather than a bot-blocking arms race are the only ones who will be able to say yes without regretting it.