Your AI Agent Is the New Customer, and It Never Sees Your Homepage

On October 6, 2026, Sierra and Meta announced the Personal Agent Protocol, an open standard for how a person’s AI agent signs in to a business and what it may do once inside. Walmart, Shopify, Stripe and Genesys are among the named partners. Sessions run on OAuth, the same machinery behind every “Sign in with” button you have ever clicked, and the first version of the spec is due later this month.

That answers the plumbing question. It leaves the business question wide open. When your customer stops visiting and sends a delegate instead, do you open the door or lock it?

We don’t know yet. The early signals point both ways, and the companies with the most at stake are still deciding. What we can do is follow one errand closely, see what a business gains and loses when an agent runs it, and work out what each choice costs.

One pair of boots, returned without a single page view

Maya bought hiking boots in size 8. They pinch. She types one line to her agent: return the boots and swap them for a 9 if it’s in stock, same color. Then she goes back to her afternoon.

Two minutes of Maya’s attention, and a retailer completed an exchange for a customer who never saw its homepage, its seasonal banner, its “customers also bought” row or its cheerful post-return survey. Every one of those surfaces was built for a person. None of them reached her.

The steps follow the access pattern the protocol describes. An agent can arrive as a guest to check stock or a returns policy. It only gets into the account when the customer signs in, and the customer decides whether that access is read-only or read and write.

The two-customer model

Here is the model the rest of this piece uses. Every business now serves two customers: the person, who reads and can be persuaded, and the person’s agent, which calls and can only be permitted. The person sees what you designed. The agent sees what you declared.

The agent is not a worse customer. It is a stricter one. It reads the policy you actually wrote rather than the one your banner implies, and it will notice when the two disagree. It has no feelings about your brand voice, and it can’t be charmed by a nicer button.

So the decision in front of every business is how much of the bottom panel to expose. There are three broad answers, and they run from most closed to most open.

Scenario 1: The wall

The most closed answer treats every agent as a bot and blocks it. Amazon has spent the past year testing how far that goes in court.

Amazon sued Perplexity in November 2025, arguing that its Comet browser agent was getting into shoppers’ accounts without Amazon’s authorization. Judge Maxine Chesney granted a preliminary injunction in March 2026. On August 4, 2026, a Ninth Circuit panel vacated it, finding Amazon unlikely to win its anti-hacking claim because it was Perplexity’s users who accessed the site. The case itself continues.

That reasoning is the problem for every wall. If the customer is the one knocking, blocking the agent starts to look like blocking the customer.

The wall still makes sense in one condition: your customer needs you more than they need the errand done. A marketplace with unique inventory can hold that line for a while. A boot retailer with competitors one search away cannot, because Maya’s agent will simply take the exchange, or the next purchase, somewhere that lets it in.

Scenario 2: The lobby

The middle answer lets agents in as guests. They can look. They can’t touch.

The protocol supports this tier directly: an agent can arrive as a guest before anyone signs in. For a business it is the cheapest form of openness. No account data leaves, nothing can be changed, and there is nothing to undo.

The trade is that you become comparable. An agent that reads your price and your returns window can read your competitor’s in the same breath, and it has no reason to prefer the site with the better photography. A lobby business competes on the facts it publishes. If those facts are worse than a rival’s, the lobby just makes that visible faster.

Which is also the case for the lobby. A business with a genuinely good returns window has spent years hiding it three clicks deep under a footer link. An agent finds it in one call.

Scenario 3: The counter

The most open answer lets the agent sign in and act on the customer’s behalf. This is where the protocol does its real work, because it splits the decision between two parties.

The customer picks read-only or write. The business picks whether the agent works through its website, through its APIs using standards such as MCP and OpenAPI, or by talking to an agent the business runs itself. That last option matters more than it looks: a business that already runs a support agent can let the customer’s agent negotiate with its own.

The design job at the counter is writing the action menu. Every action you declare is a promise you have to keep at machine speed, with no human in the loop to smooth over an edge case. An “exchange” action that quietly fails when the new size ships from a different warehouse will fail for every agent, every time, and you will hear about it in aggregate rather than in one polite email.

It is also where the old persuasion layer finally has nowhere to live. There is no banner on an API response. If you want to offer Maya something extra, you have to make it an honest, declared option the agent can weigh: “a 9 is out of stock, a 9.5 ships today.” That is an upsell an agent can actually accept.

What this gets wrong

The model is clean. The market around it is not.

First, the standards are unfinished and plural. The Personal Agent Protocol’s spec isn’t out yet. Visa’s Trusted Agent Protocol, introduced in October 2025, already covers overlapping ground by letting merchants verify that a request comes from a registered agent rather than a scraper, and Stripe and Shopify have joined both efforts. A business may end up implementing two handshakes for one customer, and nobody can tell you today which one wins.

Second, the counter can’t take money yet. Payments sit on the protocol’s list of later extensions. Maya’s exchange works because no new charge was involved. Had the 9 cost more, her agent would have hit a wall that nobody chose.

Third, the model treats the two customers as separate people. They aren’t. Maya will still browse for the next pair of boots herself, because choosing boots is half the fun, and she’ll delegate the return because returns are no fun at all. The split runs through tasks, not through customers, which is why the reader exercise above asks about tasks.

Fourth, it says nothing about blame. If the agent swaps the boots for the wrong color, who pays for the second return? The protocol defines who may act. It doesn’t yet define who is responsible when the action is wrong, and that gap will shape how open businesses are willing to be far more than any spec will.

What to do before your next visitor is software

Start with the bottom panel. Read your own returns policy, shipping terms and fee schedule as if a strict, literal reader were checking them against your marketing, because one soon will be. Wherever the banner promises more than the policy delivers, fix the policy or fix the banner.

Then publish the facts an agent will ask for in a form it can read: stock per variant, the real price including fees, the actual delivery window. These are lobby-tier answers, and they cost nothing to expose that a competitor’s agent can’t already scrape.

Finally, write your first action menu, even if you ship none of it this year. Five actions, each with what it does, what it refuses and what it returns when it fails. That document is the part of your customer experience the second customer will actually use, and it’s the first piece of brand you’ve written that has to be literally true.