PAP needs mindset context. Here is where it comes from.
This week, three of the largest US banks confirmed they are blocking outside AI agents from accessing customer accounts. JPMorgan was first. CEO Jamie Dimon said the bank will not allow outside agents to operate on behalf of retail customers, warning of "rogue agents" operating at scale. Days later, Citi announced it does not permit "third-party AI agents or assistants to log into a customer's account or transact directly." Bank of America's Brian Moynihan put it plainly: "We strongly believe there should be a human in the loop to authorise money moving out of your account."
But blocking everything is not a strategy. It is a pause. The question is what needs to be true before the pause can end.
Sierra's Personal Agent Protocol (PAP) is the most serious proposal on the table. Developed by Meta and Sierra together with Genesys, Instinct, Rocket, Shopify, Stripe and Walmart, the standard defines a clear mechanism: a customer's AI agent identifies itself, proves it has permission to act, and transacts directly with a business. No menus, no hold music, no forms.
The protocol addresses trust and governance at the technical layer. What it does not yet address is something more fundamental: the difference between an agent that has permission to act and an agent that actually understands the person it is acting for.
Those two things are not the same. And that gap is exactly what the banks are sensing.
Permission is not understanding
A signed authorization is proof that a customer delegated a task. It is not proof that the action the agent is about to take reflects who that customer actually is, what they genuinely want, or whether this particular moment is the right one to act.
The deposit sweep scenario illustrates it well. The agent has permission to move funds. Moving cash to a higher-yield account is, on paper, a rational financial action. But for a customer who has kept a large liquidity buffer for years because they are two months from a property purchase, sweeping that cash is not optimization. It is a problem. The agent cannot know that from permission alone.
The same logic applies beyond finance. An agent initiating a significant stock purchase during a falling market has authorization. But if the customer has never invested during a downturn, and the personal agent has been consuming content arguing that falling markets are buying opportunities, the business agent is about to execute an action that is inconsistent with every behavioral pattern on record.
A protocol built only on permission says execute. A protocol that includes mindset context says: this does not match the profile. Let us verify before proceeding.
The agent dialogue that makes PAP trustworthy
The more interesting version of PAP is not a handshake between two authorized parties. It is a dialogue between two agents that both carry context about the same person, from different angles.
The business agent knows the customer's behavioral history: their transaction patterns, their typical risk posture, the moments when their behavior has shifted. The personal agent knows what the customer has been doing, reading, watching, and thinking about lately.
When the two agents talk, they are not just exchanging credentials. They are comparing notes. The business agent can flag: this action is unusual for this customer. Can you explain the context? The personal agent can provide it. Together, they can reach a better decision than either could alone.
This agent-to-agent dialogue is not a blocker. It is a quality check that makes the whole system more trustworthy, for the customer and for the business. A PAP handshake that includes a mutual recognition of consistent mindset context is categorically more reliable than one that only verifies authorization.
The 2FA floor that agents cannot cross
Bank of America is right that there should be a human in the loop for money moving out of an account. The question is which actions require it and which do not.
There is a category of action that should always require the person directly, regardless of how good the agents are and how rich the context is. Irreversible decisions, large transactions, changes to core account settings: anything where the cost of an error is high enough that no agent should be authorized to complete it alone.
The practical solution is a second factor on a device that the personal agent cannot access. Not a notification the agent can read or respond to. A physical confirmation, on a separate device, that only the human can perform.
This is not a limitation of PAP. It is a design principle that should be part of the standard. Agents handle the routine. The person remains in the loop for what matters most. The banks blocking everything today are essentially applying this floor to all transactions because they have no way to distinguish between them.
Why the pre-agentic layer becomes critical infrastructure
All of this depends on context that has to exist before the agent ever shows up.
The business agent can only compare a current action against a known behavioral profile if that profile has been built over time. It can only flag an anomaly if it knows what normal looks like for this particular customer. It can only participate in a meaningful dialogue with the personal agent if it has something to contribute beyond raw transaction data.
This is the role of the pre-agentic layer: building the mindset-context profile on the business side, continuously, through the channels that already exist. Push notifications, RCS, messaging, small well-timed interactions that capture not just what customers do but how they think and feel about what they do.
When PAP becomes the standard for how agents transact on behalf of customers, the businesses that have been building this context will have agents that can actually use it. Their side of the dialogue will be richer. Their anomaly detection will be sharper. And crucially, they will be able to tell a regulator or a customer exactly why an action was flagged or cleared, based on a documented behavioral record rather than a permission slip.
The banks blocking agents today are not wrong. They are early. The ones building context now will be the ones ready to open the door when the protocol matures.
The pre-agentic layer only works if customers actually engage with it. That means the mechanism has to offer something in return. A push notification that asks how a customer feels about a recent transfer, and then delivers a relevant tip or a small personalised insight, is not surveillance. It is a service. The customer gets value. The business gets the why behind the transaction, not just the transaction itself.
This is what makes it 0.5 party data: not the passive record that first-party data captures, and not the explicit declaration that zero-party data requires. It is a voluntary behavioral signal, triggered in the moment, that captures the mindset and the feeling behind the action. The win-win is structural. When the personal agent eventually arrives, that signal is already in the profile and ready to use.
PAP defines the handshake. Mindset context is what makes it worth having.