Personal Agent Protocol: Why Your Business Chatbot Still Comes First

On October 6, 2026, Sierra (founded by former Salesforce CEO Bret Taylor) and Meta announced the Personal Agent Protocol — a new open standard that lets AI agents authenticate on behalf of a user and perform tasks on a business website. Three days later, Sierra published the v0.1 draft under the nickname “Poppy” and announced 35 more design partners, including OpenAI. Founding partners already include Walmart, Shopify, Stripe, Genesys, Instinct and Rocket.

If you own a website that handles customers, suppliers, or leads, your inbox is probably full of “What should we do about PAP?” questions. The honest answer, after reading the spec and the industry commentary, is this: the Personal Agent Protocol is a real signal about where the web is going — but it is not what your business needs this quarter. What you need this quarter is a bounded chatbot that answers your anonymous human visitors, correctly, in your language, under GDPR. Here is why, and how to prepare for both without wasting a cent.

What the Personal Agent Protocol actually is

Technically, PAP is an OAuth 2.0 extension. An AI agent (built on ChatGPT, Gemini, or any other platform that joins the protocol) can present three things to your business: an identity (which user it represents), an intent (what task it wants to complete), and a requested scope (read-only, or write access to a specific workflow). Your business decides which agents to accept, which actions to grant, and through which channel: ordinary web pages, API endpoints built on MCP or OpenAPI, or your own conversational chatbot.

The analogy pushed by the press is a “common front door for AI agents”. Instead of each platform building its own way to log in to Walmart, Shopify, or your SaaS, everyone speaks the same OAuth-flavored dialect. Sierra plans design workshops and a reference implementation during November 2026. Production use at scale is realistically 2027.

Three facts the tech press glossed over, that matter for your business:

• Anthropic is not listed. Neither is Amazon. Anthropic has pushed its own Model Context Protocol since 2024, which Mistral and Google already use. The agent protocol war is far from decided.
• No French or European vendor is in the 42-partner list. PAP is a US-centric specification. If it becomes dominant, European commercial intents will route through US runtimes — adding another layer on top of the CLOUD Act, EU AI Act Article 50, and the DSA.
• Poppy is still a draft. Design workshops are scheduled for the following month. Expect breaking changes.

The visitor your chatbot actually serves

Here is the question nobody is asking: on your website today, what percentage of visitors arrive with an AI agent acting on their behalf? The honest answer, in October 2026, is close to zero. Your real traffic comes from four sources: Google organic (now partly filtered by AI Overviews in France), direct, paid campaigns, and conversations referred by ChatGPT, Perplexity, or Gemini. In every one of these cases, the person arriving on your site is a human, anonymous, looking for an answer.

That means PAP solves a problem you will have in 2027 — not the one you have today. Today’s problem is simple and expensive: when a prospect lands on your pricing page at 10 p.m., has one question, and does not get an answer in ten seconds, that prospect leaves. McKinsey, Forrester, and Gartner have all documented the same number — a lead that waits more than one hour converts 75% less often than a lead answered immediately. Your chatbot is what fills that gap.

Two populations, two tools

Think about your business as having two completely different populations of visitors:

Population A — authenticated users with an agent. These are logged-in customers whose personal assistant acts on their behalf: rebook a flight, re-order supplies, cancel a subscription, request a refund. Volume today: negligible. Expected volume by 2028: material but still a minority. The right tool here is a PAP-compliant endpoint (API, MCP, or OpenAPI) wired to your business logic.

Population B — anonymous human visitors. These people land on your site through SEO, direct, paid, or AI assistant referrals. They are not logged in, do not have an agent, and need factual answers right now about your product, pricing, hours, coverage, documentation. Volume today: 95%+ of your real traffic. The right tool is a bounded RAG chatbot that reads your documents and answers in your voice.

The Sierra spec itself admits this. Buried in the draft, the protocol says businesses can expose their functionality through “ordinary web pages, APIs built on standards such as MCP and OpenAPI, or the company’s own conversational agent”. Your chatbot is explicitly the third valid channel. It is not something PAP replaces — it is something PAP complements.

The risk of waiting

The real danger with PAP coverage this month is not the protocol itself. It is distraction. We have already seen marketing and product teams at mid-sized French companies tell us “we’re going to wait and see on chatbots until PAP settles”. That is a mistake worth tens of thousands of euros in lost conversion per quarter. The two decisions are completely independent:

• Deploying a bounded RAG chatbot for anonymous visitors takes about two minutes with the right vendor and is reversible.
• Implementing a PAP endpoint is a 2027 project that requires a mature spec, security review, legal review, and probably a certification path that does not exist yet.

Mixing the two decisions costs you one year of qualified leads.

Where DoxyChat fits — in both worlds

DoxyChat is a sovereign French RAG chatbot that reads your documents (PDF, DOCX, website, RSS) and answers your website visitors from them only — no hallucinated price, no fabricated opening hour, no invented policy. The widget deploys in one line of JavaScript, works everywhere in the EU (unlike the just-launched ChatGPT Apps SDK, which excludes the EEA, Switzerland and the UK), and ships EU AI Act Article 50 disclosure natively.

The stack is Mistral Large 4 “Le Chonk” (via Scaleway, France) + PostgreSQL row-level security + a 1,062-pattern input moderation layer — a design that is structurally bounded, deterministic and auditable. The free Discovery plan lets you test the chatbot on your real traffic before paying anything.

When Poppy, PAP, or whichever agent protocol wins the standards war matures in 2027, we will add a conformant endpoint so authenticated agents can talk to your DoxyChat on behalf of their user. Until then, your 2026 priority is clear: cover Population B, now, with a chatbot that respects your brand, your language, your data residency, and your margin.

Conclusion

The Personal Agent Protocol is important. It will probably reshape e-commerce and SaaS checkout flows by 2028. But it does not answer the question your 10 p.m. visitor is asking tonight. That question still needs a bounded, well-trained chatbot on your public site — one that respects European law and your margin.

Try DoxyChat free — plug a RAG chatbot into your site in two minutes, keep your data in France, and be ready for whichever agent protocol wins.