Who's on the line? The protocol race for the agent-facing customer experience

Two protocols for the same problem appeared recently. On 6 October, Decagon open-sourced PACT, the Personal Agent Consent & Trust Protocol, co-developed with Instinct. That same day, Sierra's Bret Taylor and Clay Bavor announced the Personal Agent Protocol (PAP), which Sierra is building with Meta and a partner list that includes Genesys, Shopify, Stripe and Walmart. Decagon has joined the PAP working group too, so the two efforts look more likely to converge than to compete.

I recently wrote about how I think personal agents will change how customer experience runs and, among other things, break the arrival assumptions under every workforce plan in our industry. These protocols tackle a different question. They tell a business who is knocking and what that visitor may touch, but say far less about what happens to the operation once the door opens.

Obviously I work at Operata, and visibility into CX interactions is what we build, so weigh what follows accordingly. That said I'd make the same argument if I worked anywhere else in CX.

What are PACT and PAP, and what do they hope to solve?

Both answer a question businesses now face daily: this software says it's acting for one of my customers, so how do I check, and what may I let it do?

PACT separates a personal agent's identity from its authority. The agent platform proves who it is with a short-lived signed token. The customer signs in with the business directly and approves scopes the business defines (Decagon's examples are orders:read and orders:cancel), so the agent never sees a password. Every reply carries a signed receipt of the scopes used and actions taken, and the business's own policies still decide what's allowed. The spec is public.

PAP starts from the session. An agent can arrive as a guest to check stock or a returns policy, then the customer signs in and grants read-only or write access. The session follows the customer across channels, and each business decides whether agents use its website, its APIs or its own AI agent. Sierra published Draft 0.1, nicknamed Poppy, on 9 October and added 35 design partners including Visa, Mastercard and OpenAI.

Decagon also launched a companion product on 1 October, the Personal Agent Gateway. It flags likely personal agents in live chat and voice, gives agents that identify themselves their own channel, and ties each permission scope to the procedures that agent may see.

Why is everyone building one at once?

This is a chicken-and-egg scenario. One was going to come before the other, and in this case the agents arrived before the rules. Meta launched its Muse personal agent in the US on 8 September, running in a cloud browser that books, buys and fills in forms. On 20 September Amazon blocked it, saying Muse didn't identify itself as an AI agent and could reach customer account information. An undisclosed agent inside a customer account looks a lot like account takeover, even when the customer sends it. Meta's counter was blunt: "Turning away a personal agent means turning away the customer behind it" (CMSWire). I tend to disagree a little. In my opinion, it's more like telling a customer we don't support this channel (yet). Sure, it's frustrating for the customer but I suspect many customers attempting this form of communication won't be surprised, as they too are learning and testing this method of communication.

PACT and PAP differ from  Agentic Commerce Protocol from Stripe, OpenAI and Meta, and the Universal Commerce Protocol from Google and Shopify that cover the shopping  standards. PACT and PAP cover the service conversation instead: the refund, the warranty claim, the disputed fee.  Since the release of PACT and PAP, Zendesk added a discovery layer, the Open Service Directory, which helps an assistant find a brand's verified support before it connects, and says it will adopt both protocols. All of it points at contact center and CX territory. Genesys sits on both PAP partner lists, and NiCE says it is co-developing the protocol.

What do the protocols hope to solve?

In short, Identity, consent and scope. A signed token says which platform is calling, a delegation says which customer it represents and what they approved, and PACT's receipts record what was done. Sierra's own announcement names what happens when that path fails: a personal agent that can't finish a task online "may call the company's support line or open its web chat." The traffic heads for your queues either way.

What don't they solve?

Three problems stay with the operations team, which don't appear in a spec.

Outcome and quality. A completed session tells you two agents finished talking. Whether the customer got the refund they asked for is a separate question, and CSAT can't answer it: the personal agent won't fill in your survey, and the customer may never see the conversation they delegated.

Abuse at volume. A valid token tells you who sent the agent. It can't tell you whether 400 identical requests at 9am come from 400 customers who scheduled the same task or one bad actor holding 400 delegations. Scheduled tasks also break the random-arrival assumption behind Erlang C, so the same spike is a fraud question and a staffing question.

Troubleshooting, accountability and compliance. When a delegated session fails, the evidence sits across the agent platform, the gateway, your AI agent's turns, the policy engine and possibly a person on the phone at the end. AHT stops describing effort, and an agent that fails on the web, retries in chat, then rings looks like three contacts unless your reporting sees one session ID. Compliance raises its own questions. Does the customer's delegation count as consent to record the call? Article 50 of the EU AI Act requires telling people when they're dealing with AI; what applies when both sides are AI and the customer appears only at escalation? When your agent cancels an order under a granted scope and the customer disputes it, which record settles it: the recording, the transcript or the signed receipt?

So, who's on the line?

Thanks to PACT and PAP, you'll soon answer that with a signature. Identity is the easier half. The harder half is knowing what happened after the agent was let in, whether it got the customer what they wanted, and what it did to your queues and metrics along the way. Most coverage so far repeats the vendor announcements and adoption is unproven, which is a reason to start measuring now rather than wait for a winner.

Running on Genesys or NiCE? Ask your vendor where personal-agent traffic will show up in your reporting. For teams who'd rather not stitch those records together themselves, joining the whole interaction up end to end is what we built CX Observability for.

Credit to Harry Gao and Gram Liu at Decagon and Bret Taylor and Clay Bavor at Sierra for publishing early and inviting others in. Read their posts, then ask your team the question in the title and time how long the answer takes.

Talk to us about agent-facing CX

Until next time and as always, hooroo.