Skip to main content
Personal agents increasingly contact Brands on someone’s behalf. Today they do it by driving a chat widget like an anonymous browser: the Brand can’t tell which agent is calling, and the agent can’t act on the person’s account without their password. PACT fixes both:
  • Trust: the agent signs every request, so the Brand knows which agent is calling.
  • Consent: the User logs in with the Brand and approves specific actions. The agent never sees their password.
PACT is a new protocol built on A2A 1.0. Everything A2A defines works unchanged.

​
Terms

A personal agent registers with each Provider once, then can talk to every Brand that Provider hosts.

​
How it works

PACT at a glance Before the first conversation, the personal agent registers once per Provider: it gives the Provider its issuer URL and public keys (JWKS); the Provider gives it an audience string.
  1. Discovery. The personal agent fetches the Brand’s Agent Card, which says where to send messages and, if the Brand offers delegation, which scopes it defines (e.g., orders:read, orders:cancel). The Provider hosts it, e.g. https://provider.example.com/a2a/{brandId}/.well-known/agent-card.json. The personal agent finds that URL through:
    • Well-known URL (the standard): the Brand’s own domain serves the card or redirects to it, e.g. https://brand.example.com/.well-known/agent-card.json.
    • Link or registry: a link from the Brand, or a public registry of Agent Cards, points to the card’s URL on the Provider.
  2. Signed request. The personal agent sends the User’s message with a short-lived JWT it signed itself; the JWT carries a stable, anonymous id for the User. The Provider checks the signature against the personal agent’s JWKS, and the Brand’s agent answers with a contextId that the personal agent sends with later messages to continue the conversation.
  3. Consent without credentials (optional, if the Brand offers it). The User signs in on the Brand’s own login page, never with the agent, then approves each scope individually.
  4. Scoped, short-lived token. The personal agent receives a delegation token naming the User, the agent, the Brand, and the granted scopes.
  5. Act for the User. The personal agent sends the token with its JWT, and the Brand’s agent acts on the User’s account within the granted scopes.
Without steps 3–5, the Brand’s agent knows which personal agent is calling, not who the User is, and asks in the conversation (order number, email).

​
Start here