Decagon announced PACT on October 6, identifying Instinct as a co-developer and supporter. The protocol addresses a practical problem: a business needs to know both which personal-agent platform is contacting it and what the customer actually authorized. PACT combines Agent2Agent communication with OAuth authorization. A customer signs in with the business and approves defined permissions; the personal agent does not receive the customer’s login credentials through that flow.
The specification describes short-lived signed delegation tokens, business-defined permissions and signed receipts recording actions and scopes. Requests for additional authority trigger another authorization step within the same conversation. This is an infrastructure announcement, not evidence that every company now accepts Instinct or that all existing Instinct tasks have switched to PACT. Decagon also says it is participating in the broader Personal Agent Protocol working group.
Editorial take: The important advance is making permission something a receiving business can verify, rather than infer from a convincing conversation. Real value will depend on adoption and enforcement. Users should still check which business and action a consent screen covers before approving it.