Introducing the Personal Agent Consent & Trust Protocol (PACT) | Decagon

This post introduces the Personal Agent Consent & Trust Protocol (PACT) as a new capability. It details the three-step interaction flow: discovery and connection using A2A Agent Cards and JWTs for agent identity verification; customer authentication and consent via OAuth device authorization flow to obtain a delegation token binding customer account, agent platform, business, and scopes; and acting within granted permissions with subsequent requests carrying agent identity and delegation. Key design decisions are highlighted, including routing requests through the business's agent, leveraging A2A and OAuth, separating identity from authority, allowing business-defined permissions, and keeping customer login with the business. The post also emphasizes PACT's role as an open standard for consistent interaction across different personal agents and businesses.