On October 6, a consortium anchored by Sierra and Meta published version 0.1 of PAP — a protocol built to answer the one question the AI agent economy has been quietly dodging: who is allowed to act? The framing is grand. The release describes a "three-layer protocol stack" now formally complete. MCP handles how tools get called. A2A handles how autonomous agents talk to one another. PAP handles identity and authorization. Three pillars, one architecture, a new internet for machines.
I pulled the specification. I went looking for the code. There is no production deployment. There is no audit. There is no token, no chain, no on-chain registry — nothing that would let me verify a single claim against a ledger. What exists is a v0.1 draft, a permission model with exactly three settings, and a promise that a reference implementation lands in late October 2026. Code doesn't lie. But here the code hasn't been written yet — and that absence is the most honest data point in the entire release.
That gap matters for crypto readers specifically. Because PAP, whatever its stated scope, is a direct shot at the one layer of the internet that decentralized systems actually solved well: identity. And the market is not pricing the collateral damage.
Context: The Three-Layer Landgrab
To understand PAP, you have to map the territory it's claiming. The AI agent stack has quietly split into three governed layers, each controlled by a different alliance.
The bottom layer is MCP — Model Context Protocol — shepherded by Anthropic. It defines how an agent invokes a tool: a database query, a payment API, a file system. The release cites MCP at roughly 500 million monthly downloads. Treat that number with suspicion. No statistical source is cited, and the figure has never been independently audited. But if even a fraction is real, MCP is already de facto infrastructure — the plumbing nobody notices because it always works.
The middle layer is A2A — Agent-to-Agent — driven by Google. It governs how autonomous entities negotiate with one another. The release cites 150 participating organizations. Again: unsourced, unverifiable, and three orders of magnitude smaller than the MCP figure. That ratio is not noise. It's a maturity curve. Tool interoperability is real. Agent-to-agent communication is early. The higher you climb the stack, the thinner the ground.
The top layer is PAP, and it's the new entrant. Sierra and Meta lead it. The founding partner list is the tell: Walmart, Stripe, Shopify, Genesys, Rocket, Instinct. Look at that list closely. These are not protocol engineers. These are enterprise gateways — retailers, payment rails, customer-service platforms. PAP's commercial logic is not "make agents smarter." It's "help enterprises decide which agents get through the door."
That is a governance layer dressed as a technical standard. And governance layers are where control concentrates. The three alliances do not share a governing body. MCP answers to Anthropic. A2A answers to Google. PAP answers to Sierra and Meta. Developer summits have already flagged this coordination gap in public — the industry knows the layers are governed separately, and nobody has a fix. PAP doesn't resolve the fragmentation. It adds a third flag to the map.
Core: What PAP Actually Is
Strip the marketing and PAP is an OAuth-based authentication and access-control protocol. OAuth is not new. It is the same session-permission model that has run enterprise single sign-on for fifteen years. PAP does not invent cryptography. It does not introduce zero-knowledge proofs, verifiable credentials, or decentralized identifiers. It takes a mature, centralized authorization framework and points it at agents instead of humans.
The release confirms the mechanism. Permissions are scoped through OAuth sessions. Credentials are issued and held by the standard-setting authority. Access is gated by the identity issuer. This is a trust-centric design by construction — the opposite of trust-minimized.
Here is the architectural point the press release buries: PAP does not expand what an agent can do. It defines who is permitted to do it. It is an authorization boundary, not a capability boundary. Technical complexity is low. Strategic leverage is enormous. This is the textbook signature of a low-complexity, high-control design — easy to build, hard to escape. The real innovation is not in the mechanism. It is the architectural decision to split identity out as an explicit third pillar of the stack. The mechanism is old. The positioning is new. That distinction is the whole game.
Now look at the permission model. Three tiers: guest, read-only, write. That's it.
I've spent years auditing allocation mechanisms and vesting schedules, and I've learned to read scope as intent. Three permission tiers cannot express the authorization needs of a functioning agent economy. An agent that can "represent the user but cap spend at $100" is not expressible. An agent that can "write only to specific merchants" is not expressible. An agent that can "execute trades within a risk envelope, subject to human confirmation above a threshold" is not expressible. A three-tier model is not a v1.0 design. It is a placeholder — a land-grab specification meant to plant a flag and claim the standard's name before anyone else does. Complexity was deliberately stripped to ship something, anything, on the timeline.
Then there's the security model, and here PAP carries a structural flaw the release itself surfaces. The document references a credential-theft vulnerability previously disclosed in a Python SDK. In an OAuth-centric architecture, that is not a bug. That is the architecture. Credentials concentrate at the issuer. Concentrated credentials mean a single point of failure maps to total failure. If PAP becomes the identity layer for agents that execute payments, then PAP's security ceiling becomes the payment system's security ceiling. The identity layer is the money layer.
And the money layer is exactly where this is heading. Stripe is on the founding partner list. Stripe is a payment rail. The release explicitly states that executing transactions is the ultimate value of an agent. Connect the two: if Stripe binds PAP into agent commerce, PAP does not merely authorize agents — it becomes the clearing entry point for agent-initiated transactions. That is the single most strategically significant line in the entire document, and it is delivered as an aside. Who controls the identity gate controls who can spend. That is rent extraction at the platform level, and it is the economic core of PAP, not a footnote to it.
Now the part the release does not say. PAP chose OAuth over DID and verifiable credentials. That is not a technical accident. OAuth is compatible with existing enterprise SSO, which makes it frictionless to adopt inside corporate firewalls — precisely the adoption PAP needs. But the trade is explicit: the design sacrifices decentralization for enterprise convenience. The mechanism that makes PAP easy to deploy is the same mechanism that makes it impossible to verify trustlessly. You cannot audit an OAuth session on a public ledger. There is nothing to audit. Trust lives in the issuer, not the chain.
And the data quality problem is real. The document is built around an October 6, 2026 announcement — a date that sits ahead of any conventional information baseline, raising the possibility that this is a forward-dated or synthetic scenario rather than a completed event. Key figures — 500 million downloads, 150 organizations — carry no statistical source. And one critical partner appears only as a repeated placeholder, OpenAI, inferred from context to be an anonymized major model provider sitting alongside Anthropic. Three data-integrity flags stacked on top of each other. Any "fact" layer built on this should be discounted accordingly. I don't publish transaction hashes I can't verify. I won't pretend this release gives me any.
Set against a sideways market starved for signal, this is exactly the kind of narrative that gets repriced twice: once on the announcement, once on the delivery. The announcement already happened. The delivery hasn't.
Contrarian: The Silence Is the Signal
The market is reading PAP as a consolidation event — three pillars, one stack, industry alignment. I read it the opposite way. The defining fact of the release is not who joined. It's who didn't.
Anthropic — steward of MCP, operator of the most-deployed layer in the stack — is absent from PAP. The anonymized OpenAI placeholder, which context strongly suggests is a second major model provider, is also absent. In a standard war, absence is not neutrality. Absence is a veto.
Think about the incentives. If MCP is genuinely running at hundreds of millions of monthly downloads, Anthropic holds the strongest bargaining position in the stack. It has no reason to hand identity control — the most sticky, most valuable layer — to a consortium it doesn't lead. Anonymity and absence here read as a deliberate holdout, not an oversight.
That reframes the entire risk. PAP's fate does not depend on its own technical merit. It depends on two variables Sierra and Meta do not control: whether the major model providers join, and whether enterprises enforce compliance. If Anthropic and OpenAI stay out, PAP does not become an industry standard. It becomes a private standard for a Meta-aligned enterprise bloc — a walled garden with a standards-body coat of paint.
There's a second blind spot the bullish framing ignores. Sierra is described as the primary commercial entity behind PAP. This is not a neutral foundation. It is a commercial standard-promotion vehicle, and its monetization path is almost certainly enterprise agent platform services. Combine that with Meta's participation — a company that both writes the standard and wants its own agents to pass through it — and you have a judge that is also a player. Standards bodies derive legitimacy from neutrality. PAP's governance has a structural neutrality deficit on day one, and competitors selling open or decentralized alternatives will attack exactly there.
And here is the crypto-specific collateral. Identity is the one layer where decentralized systems already delivered something genuinely superior to the corporate web. DID. Verifiable credentials. ENS. Sign-in with Ethereum. These are trust-minimized, user-sovereign, auditable by anyone with a node. PAP represents the re-centralization of that layer — and enterprises will not run two identity systems side by side. If PAP becomes the default for enterprise agent access, it does not merely compete with decentralized identity. It forecloses the path. Once a corporate security team writes PAP into its procurement requirements, a DID-based agent has no door to knock on. The migration cost runs the wrong way, and it runs permanently.
That is the trade the market isn't pricing. A v0.1 draft, released with unverifiable metrics and a future-dated timeline, is being read as the completion of an infrastructure stack. In reality, it is a positioning move — an attempt to claim the identity layer before the layer's real owners show up.
Takeaway
Watch one date. Late October 2026 — the promised reference implementation. If it ships, and if it ships with a richer permission model than guest/read-only/write, PAP is a serious contender and decentralized identity has a genuine fight on its hands. If it slips, or ships thin, the "three-layer stack is complete" narrative deflates fast, because it was never grounded in a deployed line of code.
Track two signals alongside it. First, whether Anthropic or OpenAI join — their absence is the clearest tell that PAP is a bloc standard, not an industry one. Second, whether Walmart and Stripe enforce it. A standard nobody enforces is a convenience. A standard enterprises mandate is a chokepoint.
Verify, then narrate. The gate is being built. The question is who ends up holding the key — and whether crypto's answer to identity gets to walk through it at all.