On October 6, 2026, a specification that does not exist in production was described as the moment AI agent infrastructure "formally took shape." PAP — the identity and authorization layer pitched by Sierra and Meta — arrived as a v0.1 draft: no deployment, no audit, no peer review, and a reference implementation deferred to late October. That is the entire verifiable payload. Everything surrounding it — the three-layer stack, the founding-partner roster, the download counts — is narrative waiting for evidence. I have audited enough infrastructure specs to recognize the tell. When a governance layer ships ahead of a capability layer, the product is never the technology. The product is the standard.
Consider the architecture the announcement implies. Three layers, three owners, three governance regimes. Anthropic's MCP governs tool interoperability — how an agent invokes external functions. Google's A2A governs agent-to-agent communication — how autonomous entities negotiate. PAP governs identity and access — who is allowed to act at all. Each is controlled by a separate alliance, and the seams between them are precisely where integration cost accumulates. Three alliances, no shared coordination mechanism — a gap developers have flagged at industry summits without resolving it. The founding partners read like a demand-side consortium: Walmart, Stripe, Shopify, Genesys. Enterprises, not model labs. And two conspicuous absences: Anthropic, and an entity the source material anonymizes as OpenAI. In standard-setting, absence is not neutrality. Absence is a veto.
Now the mechanism. PAP does not invent cryptography. It applies the OAuth session-permission model — the same plumbing behind corporate single sign-on — to agent authorization. Permissions arrive in three tiers: guest, read-only, write. That is the whole vocabulary. My assessment after working through comparable authorization designs is that PAP's technical essence is an authorization boundary, not a capability boundary. It does not make agents smarter or faster. It decides who is permitted to execute. The engineering complexity is low. The strategic leverage is enormous. This is a textbook low-complexity, high-control design. And maturity is the least contestable fact in the document: v0.1, no deployment, no audit. Every ecosystem claim attached to PAP is projected rather than observed. There is no attack surface because there is, quite literally, no surface.
The choice of OAuth over decentralized identifiers or verifiable credentials is not accidental. OAuth is deliberately centralized: credentials concentrate at a standard-issuing authority, and it maps cleanly onto existing enterprise firewalls. That compatibility is the selling point — and the sacrifice. Decentralized identity was never in the running because enterprises will not maintain two identity systems. The re-centralization of the identity layer is the single most consequential decision in this announcement, and it is the one nobody is pricing.
The permission model tells you this is a land-grab, not a finished product. Three tiers cannot express the authorization grammar an agent economy actually needs — "may transact on the user's behalf up to one hundred dollars," "may write only to this merchant." A model that coarse is a placeholder to seize standard-setting authority — to claim the vocabulary before anyone else defines it. When a spec ships this thin, the intent is capture, not completeness.
Follow the economics. PAP has no token, so traditional tokenomics does not apply. The relevant frame is a gatekeeping economy: value capture sits in access rights, not usage fees. Whoever controls PAP decides which agents may participate in digital commerce. The mechanism is platform-level rent extraction, and the founding roster tells you who the gatekeepers are — enterprises protecting their own doorways, with Sierra and Meta selling the locks.
Then there is Stripe. Buried in the partner list, Stripe is the most strategically loaded signal in the entire announcement. Stripe is a payment rail. If PAP becomes the authorization layer for agents executing transactions, then PAP is not an identity utility — it is the clearing gateway for agent commerce. And that collapses two risk categories into one. If the identity layer is breached, the attacker does not need to steal funds. They inherit a legitimate identity and transact with it. Identity layer equals fund security layer. The blast radius is not a data breach. It is a settlement failure.
The counter-intuitive reading, and the one the market keeps missing, is that PAP's danger is not failure. A failed standard costs its backers sunk capital and nothing else. The real risk is success as a private standard. If Walmart and Stripe write PAP into procurement and security compliance, agent builders have no alternative but to comply, and PAP crosses the threshold from convenient tool to quasi-public infrastructure — a chokepoint governed by a company with a documented privacy history. That outcome forecloses decentralized identity from enterprise agent scenarios before DID, ENS, or SIWE ever get a foothold. The competitive threat to Web3 identity is not another protocol. It is an enterprise consortium deciding the question is already settled.
And note what the source material itself concedes: a future-dated announcement, an anonymized placeholder, and two flagship statistics — MCP's five hundred million monthly downloads and A2A's hundred and fifty organizations — with no cited statistician. Treat every "fact" here as narrative-priced. If those figures are unverifiable, the three-layer stack is a diagram, not a deployment.
The date to watch is late October. If the reference implementation ships and enterprises enforce compliance, PAP becomes infrastructure. If it slips, the story deflates and the three-layer stack reverts to three separate slide decks. Either way, the strategic question was never whether the technology works. It was always who gets to hold the door.
