What is agentic commerce for a small business?
Agentic commerce is the point where your customer no longer fills in your form: an AI agent they have asked to do it does. It checks availability, compares three quotes, moves an appointment, returns an item. Most guides on the topic focus on online retail and payments. For a service or trade business, the likelier case is simpler: a well-written message arrives on behalf of a customer, and nobody can tell whether it came from them or from software.
This is already happening. According to CNBC, Meta's personal agent Muse, launched in early September 2026, climbed to the top of Apple's App Store, and Meta says it has millions of users in the US. CNBC also reports that Amazon has blocked Meta's agents. Sierra co-founder Bret Taylor put it this way: "It is kind of chaos until such a standard exists."
Why isn't recognising the agent enough?
Because knowing who is at the door does not tell you how far they may come in. The protocol's website describes today's situation as all or nothing: either the business blocks the agent, or the agent signs in with the customer's credentials and can do anything the customer can. In between, it proposes a ladder of access that is useful even without the protocol:
| Level | What the agent can do | Small business example |
|---|---|---|
| Blocked | Nothing | Your customer portal |
| Guest | Read what is public | Opening hours, service area, lead times, returns policy |
| Signed in, read only | See the customer's account once they sign in | Order status, appointment time |
| Signed in, with approval | Act, each time with the customer's approval | Move an appointment, accept a quote |
| Full access | Anything the customer can do | Avoid: this is what happens today when a customer hands over their password |
Authentication answers the first question. The other two stay with you: what the agent may do at each level, and the record of what it did.
What does the Personal Agent Protocol cover?
The draft published on personalagentprotocol.org (version 0.1, read on 12 October 2026) is built on OAuth, the standard behind "sign in with Google". The parts that matter to a small business:
- The business declares itself in a file on its website (poppy.json) saying what it opens to agents: web pages, APIs or its own agent.
- The agent identifies itself through a web address that publishes its name and keys. The business can keep allow lists and block lists, rate-limit requests, and revoke an agent that misuses access.
- Everything starts as a guest. The agent sees the account only after the customer signs in and grants read-only or write access; the business may not grant more than was requested.
- Access has an end: it lasts until the customer signs out or disconnects the agent, the access expires, or the business revokes it.
- Each side says whether a human or an AI is speaking in a conversation, and the agent can ask for a person at the business, who is held to the same permissions.
- An extension for actions with consequences: the business proposes an action with its exact terms, the customer approves that specific version, and the action runs once, even if the request is retried.
The text is candid about its limits. On some points the business has to take the agent's word: the type of sign-in it reports, or that the customer approved an action. The text says so: a confirmation sent by the agent does not prove the customer saw the terms; a business that needs that proof has to ask for approval on its own page. Payments, push notifications and attachments are listed as open topics.
What about Visa's protocol?
Visa released its Trusted Agent Protocol in October 2025, built with Cloudflare. It focuses on buying: the agent signs its requests to prove it is a Visa-approved agent with intent to purchase, and can carry payment details. According to The Next Web, Stripe and Shopify take part in both protocols. How the two will fit together has not been published. The same article notes that no European retailer, bank or payment company is named among the Personal Agent Protocol partners.
What a small business can require right now
There is no code to write today. These five rules are worth deciding before the first agent asks to change an order, and they apply to your providers too (store platform, booking tool, help desk software):
- Know when it is an agent. Ask your provider whether it tells agents from human visitors, and what it plans for the protocols under way (Shopify and Stripe are in both).
- Write down what an agent may do without signing in: usually, whatever is already public.
- Separate reading from acting. Viewing an order and cancelling it are not the same consent. Any action with consequences (order, cancellation, refund, quote change) should rest on precise terms the customer has approved.
- Keep a record: which agent, for which customer, which action, on what terms, at what time. That log is what lets you answer a customer who disputes something.
- Be able to cut access: block an agent that misbehaves, and let the customer withdraw the access they gave.
It is the same rule we apply to our own agents: they prepare, a person approves anything that commits the business. We go into it in four questions to ask before connecting an AI agent to your tools, and for agents that work through a software screen, in our piece on agents that click for you.
What do customers' agents change for your incoming requests?
A quote request written by an agent may be more complete than a message typed on a phone, or it may go out in ten copies to ten competitors. Either way, your reply must stay accurate, quick and approved by someone on your team before it leaves. If an agent already drafts your replies, it should treat a message from an agent like any other request: check, prepare, and leave the price or commitment to a person. That is what we set up for quote requests handled by an agent.
What the top pages leave out
Method: on 12 October 2026, we looked at the top 9 Google France results for "commerce agentique" (the French term) and read 5 of the top 6 in full (Stripe, Wikipedia, Mastercard, KPMG, IBM; the Salesforce page could only be read in part).
None of those 5 pages speaks to small businesses or explains how to revoke an agent's access. Only one, KPMG's, mentions mandate rules, action rights and traceability, in two lines aimed at online retailers. The other four describe the agent from the buyer's side: it searches, compares, pays. Our reading: a small business owner wonders less what agentic commerce is than what to allow on the day a customer's agent gets in touch. That is the question this article answers.
FAQ
How can I tell if a message comes from a customer's AI agent?
Today, often you can't. The protocols in preparation (Personal Agent Protocol, Visa's Trusted Agent Protocol) have the agent identify itself with verifiable keys. Ask your provider what it plans, and meanwhile treat any commitment the way you would an unknown message: with an approval step.
Can I use the Personal Agent Protocol today?
A draft specification, version 0.1, is online, and its authors warn that any part of it can change. Sierra has announced a reference implementation and design workshops. For a small business, this is the time to set your rules, not to build.
Should I block AI agents on my website?
Not necessarily. Blocking everything also stops a customer's agent from checking your hours or lead times. Leave public information open, and keep anything that touches the customer's account, or commits them, for a signed-in customer who has approved it.
Can an agent pay or cancel an order for the customer?
Technically, more and more. The Personal Agent Protocol does not cover payments yet. For a cancellation or change, require precise terms approved by the customer, a single execution and an entry in a log.
Sources: Sierra, "Introducing Personal Agent Protocol", 6 October 2026 (sierra.ai) · Personal Agent Protocol home page, specification (draft 0.1), operations extension and open topics (personalagentprotocol.org, read on 12 October 2026) · CNBC, "Meta joins companies to tame 'chaos' of doing business with AI bots", 6 October 2026 (cnbc.com) · The Next Web, "Sierra announces Personal Agent Protocol" (thenextweb.com, read on 12 October 2026) · Visa, "Visa Introduces Trusted Agent Protocol", 14 October 2025 (investor.visa.com) · Reading of 5 of the top 6 Google France results for "commerce agentique", 12 October 2026. No client is named.