MapGraphSeamsCalendarIntroductionDisclosureMethodFor agents and tools

Updated weekly, new versions on Mondays · Corrections: open an issue

Personal Agent Consent & Trust Protocol (PACT), published by Decagon with Instinct

Industryspecificationcore entry

Verified 2026-10-13. Status as of 2026-10-13. All entries.

Seams: S1S3S4

Status

Version 1.0 of the specification ("This is PACT 1.0.") is published at openpactprotocol.org (the Decagon announcement is dated 2026-10-06), and the repository openpactprotocol/openpactprotocol (created 2026-10-01, Apache-2.0) holds the documentation, a reference Provider, a demo personal agent and conformance tests; its latest commit on main is 838c6bd (2026-10-06, a dependency update), read 2026-10-13. Decagon, 2026-10-06: it is open-sourcing PACT, "co-developed and supported by Instinct". No standards body or governing organisation is named in the pages of the site read on 2026-10-13.

Relevance

PACT builds on A2A 1.0 and defines how a personal agent identifies itself to a business's support agent and, optionally, which permissions the customer has granted it. The business's Agent Card is found at "https://{brandDomain}/.well-known/agent-card.json", which "serves the card or redirects to" the Provider's URL; the personal agent "never builds it from a Brand ID". The Poppy protocol uses a different well-known document (see pap and seam S1).

The personal agent signs every request with a JWT (ES256 or RS256) checked against its published keys, and section 3.3 says what that proves: "That a known personal agent is calling for someone it calls sub. Not that sub owns a Brand account." Delegated authority is optional: the customer logs in with the business, never with the personal agent, and approves scopes that "Each Brand defines" (examples on the card: orders:read, orders:cancel), through OAuth 2.0 device code (RFC 8628).

The Decagon post puts it as "It separates the identity of the personal agent from its authority to act on a customer". Section 5.6: every reply under a delegation token carries a signed receipt (grant id, user, scopes used, actions, timestamp), and "Personal agents SHOULD verify and keep receipts". The receipt records what the Provider's agent did; the words consumer, durable medium and confirm are not found in the specification page (2026-10-13).

Committed next

None declared in the sources read.

Boundary

The specification does not define a registry: "This spec does not define a registry." Registration of a personal agent with a Provider is out of scope ("How these are exchanged is out of scope"), and each Brand defines its own scopes, none reserved by PACT.

Sources

Overlaps

Personal Agent Protocol (PAP, "Poppy"), published by Sierra with Meta, Agent2Agent (A2A) protocol, core specification, A2A protocol, agent discovery

Neighbours in the map

Neighbours of Personal Agent Consent & Trust Protocol (PACT), published by Decagon with Instinct in the map Each circle is an entry of the map and links to its page; the colour is the kind of body behind it, a filled circle is a core entry and a dashed circle a context entry. The entry in the middle, with the entries it overlaps and the entries named by the same seams. Overlaps (3)Share a seam (29)A2A protocol, agent discovery (Linux Foundation, core)A2A protocol Agent2Agent (A2A) protocol, core specification (Linux Foundation, context)Agent2Agent Personal Agent Protocol (PAP, "Poppy"), published by Sierra with Meta (Industry, core)Personal Agent Protocol W3C AI Agent Protocol Community Group (W3C, core)W3C AI Agent Protocol C… S1 DNS for AI Discovery (DNS-AID, draft-mozleywilliams-dnsop-dnsaid) (IETF, context)DNS for AI Discovery S1 IETF DAWN, Discovery of Agents With Names (proposed WG) (IETF, core)IETF DAWN S1 AI Catalog (Agent Card Working Group) (Linux Foundation, core)AI Catalog S1 MCP Server Cards (ext-server-card, SEP-2127) (Linux Foundation, core)MCP Server Cards S1 Model Context Protocol (MCP), core specification (Linux Foundation, context)Model Context Protocol S1 Agentic Resource Discovery (ARD) (Independent, core)Agentic Resource Discov… S1 schema.org vocabulary for products, offers, sellers and lodging (current release) (Independent, context)schema.org vocabulary f… S1 Shopify, MCP surfaces for buyer agents, developers and merchants (Industry, context)Shopify S1 S4 Universal Commerce Protocol (UCP) (Industry, core)Universal Commerce Prot… S1 S3 S4 W3C Agentic Web Working Group (draft charter) (W3C, core)W3C Agentic Web Working… S3 WebMCP (Draft Community Group Report, Web Machine Learning CG) (W3C, context)WebMCP S3 IETF Web Bot Auth (webbotauth WG) (IETF, core)IETF Web Bot Auth S3 IETF agentproto (Agent Communication Protocols WG) (IETF, core)IETF agentproto S3 x402 (Linux Foundation, core)x402 S3 S4 Browser vendor positions on WebMCP (WebKit, Mozilla, Chrome, Edge) (Independent, core)Browser vendor position… S3 S4 OpenID Foundation AuthZEN Working Group (agent authorization drafts AARP and COAZ) (Independent, context)OpenID Foundation AuthZ… S3 Agentic Commerce Protocol (ACP) (Industry, core)Agentic Commerce Protoc… S3 S4 KYAPay (Skyfire) (Industry, core)KYAPay S3 Mastercard Agent Pay (Industry, core)Mastercard Agent Pay S3 Visa Trusted Agent Protocol (TAP) (Industry, core)Visa Trusted Agent Prot… S3 IETF vcon (Virtualized Conversations WG) (IETF, core)IETF vcon S4 Payment HTTP Authentication Scheme (draft-httpauth-payment, Tempo Labs and Stripe) (IETF, context)Payment HTTP Authentica… S4 AAIF Agentic Commerce Working Group (AAIF, core)AAIF Agentic Commerce W… S4 EMILIA Protocol (individual drafts and open-source gate) (Independent, context)EMILIA Protocol S4 Agent Payments Protocol (AP2) (Industry, core)Agent Payments Protocol S4 EMV Agentic Payments Framework for Specifications (draft for public feedback) (Industry, core)EMV Agentic Payments Fr… S4 FIDO Alliance agentic authentication and payments work (Industry, context)FIDO Alliance agentic a… S4 Verifiable Intent (Industry, core)Verifiable Intent S4 Personal Agent Consent & Tr…

Solid lines: overlaps declared by one of the two entries. Dashed lines, coloured by seam: entries named by the same seam (S1 to S4) in the seams note. Every node is a link.

Evidence and coverage

Read
On 2026-10-13: the specification page and the home page of openpactprotocol.org, the repository metadata (default branch, licence, creation date, latest commit), the LICENSE file header and the README of the repository, and the Decagon announcement of 2026-10-06.
Not read
The pages "Build a personal agent integration", "Build a Provider" and "Run the reference stack", the reference code and the conformance tests, the Instinct side of the announcement, any publication of a standards body on PACT.
Not found
Not found, 2026-10-13: a standards body, foundation or working group in the pages of the site read; consumer, durable medium, confirm, poppy.json and Web Bot Auth in the specification page.