As personal AI agents start booking travel, making purchases and reaching out to customer support, a tough question comes up: how can a business tell what an agent is actually permitted to do for someone? PACT, short for the Personal Agent Consent & Trust Protocol, is a proposed answer. Decagon open-sourced the protocol on October 6, 2026, drawing attention as more services prepare for customer-facing AI agents.
What PACT is
PACT is an open protocol for delegated access. It lets a personal AI agent prove both which agent platform is making the call and which actions the customer has approved. It is meant for situations where one AI agent represents a customer while another represents a business.
A customer, for instance, might ask an assistant to check an order or cancel a reservation. PACT is designed to prevent that assistant from getting broad, ongoing access to the customer’s account just because it submitted a request.
How PACT works
PACT brings together existing components: the Agent2Agent protocol for agent communication and OAuth 2.0 for authorization. A personal agent first discovers a business agent’s published capabilities and the permission scopes it requests, such as reading orders or cancelling an order.
When account access is required, the customer signs in directly with the business and approves the requested scopes. The agent never handles the customer’s login credentials. The business-side provider then issues a short-lived, signed delegation token that links the verified customer account, the calling agent platform, the target business and the permissions granted.
Future requests must include both the agent’s identity and the customer’s delegation. Before allowing an action, the business can verify each one and keep signed receipts of what occurred.
Why it matters
AI agents become more valuable when they can finish tasks instead of just suggesting them. Yet that ability brings risks involving mistaken identity, overly broad access and unclear customer consent. PACT keeps an agent’s identity separate from its authority, meaning even a recognized agent still needs explicit permission for each type of action.
PACT isn’t a universal standard yet, and its real-world effect will depend on adoption. Still, the approach could help businesses work with multiple personal-agent platforms without building a separate consent and trust system for every one.
