PAP and PACT, side by side.
PAP and PACT are two proposals, both announced on 6 October 2026, for how a person’s AI agent works with a business. PAP, the Personal Agent Protocol from Meta and Sierra, covers OAuth sessions across a company’s website, APIs, and its own agent; its v0.1 spec is promised for later in October. PACT, Personal Agent Consent & Trust from Decagon and Instinct, published a 1.0 spec the same day, built on A2A and OAuth device-code sign-in.
What each one covers today.
Based on what was published on 6 October 2026. PAP’s column will change when its v0.1 spec is out.
Who
Meta and Sierra. Sierra lists Genesys, Instinct, Rocket, Shopify, Stripe, and Walmart as partners; Meta’s list adds NiCE and Decagon and leaves out Instinct.
Decagon, co-developed with Instinct.
Published
An announcement. A v0.1 spec, design workshops, and a reference implementation are promised.
PACT 1.0 on GitHub, with an Identity profile and a Delegated profile.
Licence
Not stated. Sierra says it is “open for anyone to implement.”
Apache 2.0
Built on
OAuth sessions.
A2A 1.0 and the OAuth 2.0 device-code flow (RFC 8628).
Discovery
Starts on the company’s website, where the agent learns what the company offers and how to reach it.
The brand’s A2A Agent Card at /.well-known/agent-card.json. No registry.
Channels
The company’s website, its APIs (such as MCP and OpenAPI), or its own agent, with one session across them.
Agent to agent, over A2A.
Customer control
A session can start as a guest. The customer signs in and chooses read-only or write access.
The user signs in with the brand directly and approves scopes the brand defines. The personal agent never sees the login.
Agent identity
Not specified yet.
The personal agent signs a short-lived JWT. It shows which agent is calling, not who owns the account.
Receipts
Not specified yet.
Under the Delegated profile, every reply sent under a delegation token carries a signed JWS receipt of scopes used and actions taken.
Payments
Listed as a possible future extension.
Not covered.
Disputes
Not covered.
Not covered.
What it leaves on the record.
Neither proposal covers payments or disputes today. PACT’s receipts are the closest thing to evidence: under the Delegated profile, each reply sent under a delegation token records the grant, the user, the agent, the brand, the scopes used, and the actions taken, signed with the same keys as the token. The spec says personal agents should verify and keep receipts; it says nothing about the business keeping them.
The two efforts overlap. Instinct is named in both, and Decagon says it has joined the PAP working group. Neither Sierra’s nor Meta’s announcement mentions PACT, and the PACT repository does not mention PAP.
Two unrelated IETF individual drafts also use the name PACT: draft-laxsharma-pact, on task contracts for autonomous agents, and draft-valverde-oauth-pact, an OAuth consent profile. Neither is Decagon’s PACT.
What to do now.
- 01
Nothing to install for PAP yet. Watch for the v0.1 spec this month.
- 02
If you run a customer-service agent, PACT 1.0 can be implemented now: publish an Agent Card and define your scopes.
- 03
Decide which account actions an outside agent may take without sign-in, and which need it. Both proposals leave that to the business.
- 04
If you adopt PACT, keep your own copy of each receipt with the order or support case.
Short answers.
Are PAP and PACT competing standards?
They overlap in purpose and in people. Instinct works on both, and Decagon has joined the PAP effort. PAP has no published spec yet, so a detailed comparison has to wait for its v0.1.
Do PAP or PACT handle payments?
Not today. Sierra lists payments extensions as a possible next step for PAP. PACT does not cover payments.
Is Decagon’s PACT the same as the IETF PACT drafts?
No. draft-laxsharma-pact and draft-valverde-oauth-pact are unrelated individual drafts that share the name.
Sources, checked 2026-10-07
Keep what each agent order leaves behind.
We’ll map what PAP vs PACT and the other specs reaching your checkout produce to one record per order, with the gaps marked.