personal agent protocol (Poppy) 1.0: What Sierra's Agent Standard Does

The personal agent protocol reached version 1.0 on November 13: Sierra released the finished spec for Poppy, the open standard that defines how a personal AI agent interacts with a company on a customer's behalf, and the launch comes with distribution most standards never get. Shopify has enabled Poppy for every merchant on its platform, Meta's Muse agent now looks for Poppy first on every site it visits, and 60 new companies joined as design partners, taking the total past 100. Source

What Poppy is

Personal Agent Protocol, or Poppy for short, is an open standard that defines how a personal agent, acting for one user, works with a company on that user's behalf. It covers discovery, identity, account access, and interactions across APIs, web browsing, and conversations with the company's own agent. Sierra and Meta first announced it on October 6 alongside design partners Genesys, Instinct, NiCE, Rocket, Shopify, Stripe, and Walmart, published a draft on October 9 with 35 more partners, and shipped v1.0 five weeks later after partners tested the drafts against real websites, APIs, and agents. Source Source

The problem it targets is the awkward moment when an agent shows up at a business. Today a personal agent visiting a site is indistinguishable from a bot: it has no standard way to say who it is, who it acts for, or what the customer allows it to do. Poppy gives the company a way to publish an answer and the agent a way to ask. Source

What shipped with 1.0

Three distribution moves matter more than the spec text itself. First, every Shopify store now automatically publishes a Poppy file, so merchants need no extra implementation; Shopify powers businesses in more than 175 countries. Second, Poppy is on for everyone who uses Muse, Meta's AI agent, which automatically looks for Poppy first on every site it visits; The Next Web reports more than 10 million people have set up Muse. Third, the design partner list passed 100 companies, including Delta Air Lines, Intuit, Salesforce (including Fin, Commerce Cloud, and Agentforce), Twilio, Wix, and Zoom. Source Source

A handful of companies are already live. Mercury customers can ask a personal agent to check balances, review transactions, categorize spending, or initiate a payment or transfer, with Mercury ensuring the request goes through the account's approval policy before anything is sent. Turkish Airlines lets personal agents check fares, flight status, and stopovers, pull up a booking with a reference number and surname, and find business-class upgrades that Miles&Smiles members approve before paying. Synchrony is exploring how an agent could surface financing and relevant offers during agent-led shopping across its network of more than 500,000 merchant locations. Source

How the protocol works

Discovery starts with a file. A company publishes poppy.json at /.well-known/poppy.json describing its channels, capabilities, sign-in options, and supported versions. The document lists OAuth scopes with plain-language descriptions and hints, such as whether a scope changes nothing, makes a reversible change, or is irreversible, and whether it touches personal data. A company can also set auth.disabled to offer no sign-in, or web.disabled to ask personal agents not to browse. Source

Account access is standard OAuth, hardened. The spec requires a client_id that is the URL of a client metadata document, authenticated with private_key_jwt; exact redirect_uri matching as RFC 9700 requires; a refresh token from every sign-in, refreshed with the DPoP key it was issued with; and scopes on every sign-in request with none granted beyond those requested. Sign-in happens two ways: Direct Sign-In, where the user signs in on the company's own page in their browser, and Device Sign-In, where the agent shows a link and code the user opens on any device. Source

Identity is deliberately pairwise. The personal agent assigns each user a stable but opaque User ID that differs at every company, so companies cannot match users with each other. On every request, the agent sends a Poppy-Session header: a JWT it signs for that request, naming the session and the User ID. The signature uses a short-lived delegated key, vouched for by a key in the agent's jwks_uri through a delegation carried in the JWT's poppy_dlg header. There is no session-start step; the first request with a new session ID starts it, and a session can tie together activity like a cart and an open conversation whether signed in or out. For bot defenses, the spec recommends a Web Bot Auth signature so existing edge tooling can authenticate the operator before application handling. Source

On top of that foundation sit three channels. In web browsing, the agent can join the site's pages to its session through a browser session endpoint, with a poppy:browser-sign-in scope covering signed-in browsing. For APIs, the company points at existing OpenAPI documents and similar descriptions rather than inventing new endpoints. For conversations, the company offers its own agent over a supported conversation protocol with streaming, a defined handoff to a human, and sign-in during a conversation. A task-coverage layer lets the company declare excluded tasks, offer alternatives, collect feedback from the agent, and accept agent-supplied context such as skills. The security section is unusually direct for a young spec: a redirect never carries protocol secrets, and neither side may connect to loopback, private, or link-local addresses from URLs the other party supplied. Source

Poppy and UCP: the Shopify split

The commerce story explains the design philosophy. Every Shopify store already supports Universal Commerce Protocol (UCP) by default, and the two protocols divide the work: UCP handles the shopping itself, finding products, filling a cart, and checking out, while Poppy handles what happens before that, when an agent arrives, says who it is, and finds out what it is allowed to do. Shopify co-authored Poppy's commerce extension to link the two: it lets an agent shop as a guest or signed in with the customer's account, makes the agent ask the customer before taking certain actions, and connects to UCP Ask so a shopper's agent can talk directly to the store's agent. Source

What changed from the draft

Sierra lists four changes from the October drafts: companies can now adopt the protocol in stages, starting with the basics and adding capabilities over time; the protocol's use of existing standards like MCP, OpenAPI, and UCP was refined; companies gained more ability to provide guidance to and collect feedback from the personal agent; and extensions were introduced so industries can build on the core protocol without changing it, with Shopify's commerce extension as the first example. Sierra's implementation kit walks companies through setup and includes a validator to check the work. Source

One caveat sits inside the spec itself: the document labels itself draft version 1.0, says it starts from 0.4 as the 1.0 release candidate, and warns that fixes for problems implementers find can include changes that are not backward compatible. Areas the spec does not cover yet are on the roadmap. Teams implementing against it should pin to the versioned docs and watch the changelog. Source

Our read

This section is our assessment, not Sierra's claims. The thing to take seriously is not the spec, which is competent but young, but the default-on distribution. Standards for agent-to-business interaction have been announced all year and most die waiting for someone to implement them; Poppy skipped that phase by landing inside Shopify's merchant fleet and Muse's browsing behavior on day one. When an agent platform and a commerce platform both treat one discovery file as the front door, publishing that file stops being optional for any company that expects agent traffic, much as robots.txt and sitemap.xml became table stakes for search.

For teams building or operating agents, the interesting engineering is the trust model. Pairwise user IDs, DPoP-bound refresh tokens, delegated signing keys, and explicit scope hints are a coherent answer to the question we keep circling in MCP OAuth security and AI agent tool permissions: how does a service know which agent, acting for which user, with what authority? Poppy's answer is opinionated and worth reading even if you never implement it, because any agent that touches customer accounts will be measured against it. The Web Bot Auth recommendation also matters operationally: companies that have spent years tuning bot defenses now have a sanctioned way to let good agents through, which changes the calculus we described in Meta Muse gadgets SDK and agent device security.

The open question is fragmentation. The Next Web notes Visa and Mastercard are building their own ID checks for agents, and Amazon would rather shoppers use its own agent than Muse. If payment networks and the largest retailer each field a competing agent-identity scheme, companies could end up publishing several discovery files for several ecosystems. The draft-status warning cuts the same way: 1.0 is a line in the sand, not a frozen target. Our advice: if you run a customer-facing business, read the spec now and implement the discovery file when your platform makes it cheap; if you build personal agents, support Poppy but abstract the identity layer so a second standard is an adapter, not a rewrite.