Sierra has released version 1.0 of Personal Agent Protocol, an open standard for how personal AI agents identify themselves to businesses and learn what they are allowed to do on a customer's behalf. Shopify has turned the protocol on for every merchant on its platform, and Meta's Muse agent now looks for it first on every site it visits, Sierra said in a blog post dated Nov. 13.
The standard, nicknamed Poppy, now has more than 100 design partners after 60 companies joined, according to the post by Sierra co-founders Bret Taylor and Clay Bavor. New names include Delta Air Lines, Hyatt, Intuit, Twilio, Wayfair and Zoom. Sierra and Meta first announced the protocol in October with Genesys, Instinct, NiCE, Rocket, Shopify, Stripe and Walmart.
How it works
A company that supports Poppy publishes a file at /.well-known/poppy.json on its domain. The file names the organization and describes what it offers to agents, such as APIs or its own company agent, along with the access a visiting agent can request, according to the draft specification. Sierra said the protocol is built largely on existing standards, including MCP and the Universal Commerce Protocol (UCP), with sign-in handled through OAuth so customers decide what their agent can and cannot do.
The specification includes several protections against spoofing and tracking. A Poppy file found at any other path, such as an uploaded document, cannot speak for the domain. Each agent gives a user a stable but opaque ID that differs at every company, "so Companies can't match Users with each other," the spec says.
Agents sign each request with a short-lived delegated key, and users can sign in either on the company's own page or with a link and code shown on another device.
Shopify and Muse
Every Shopify store already supports UCP by default and now automatically publishes a Poppy file, so merchants do not need to do any setup, Sierra said. The two protocols split the work. UCP covers the shopping itself, from product search to checkout, while Poppy covers the moment an agent arrives and finds out what it may do.
Shopify co-authored a commerce extension that links the two. It lets an agent shop as a guest or sign in with the customer's account, and it requires the agent to ask the customer before taking certain actions, according to Sierra.
On the agent side, Poppy is now on for every Muse user. The Next Web reported that more than 10 million people have set up Meta's agent.
Early deployments
Sierra named a few companies that have already gone live. Mercury customers can ask an agent to check balances or start a payment, with each request run through the account's approval policy before money moves.
Turkish Airlines lets agents check fares and flight status, and lets Miles&Smiles members have an agent find business-class upgrades that the customer approves before paying. Synchrony is exploring how agents could weigh financing offers across its network of more than 500,000 merchant locations, Sierra said.
The rules are not settled. The specification is labeled draft 1.0 and says it can include changes that are not backward compatible as implementers report problems. Sierra said changes since the first draft include staged adoption, so companies can start with the basics, and an extensions system that lets industries build on the core protocol.
The release lands in a busy week for agent commerce rules. OpenAI on Friday launched a payment wallet for its agents, and United Airlines changed its contract of carriage to stop third-party AI agents from completing bookings, CBS News reported. The Next Web noted that Visa and Mastercard are building their own identity checks for agents, while Amazon wants shoppers to use its own agent instead of Muse.
Sierra said any company can now implement Poppy on its own, and it published an implementation kit with a validator for checking a setup.
Source: Sierra, “Releasing Personal Agent Protocol 1.0”
Additional sources: Personal Agent Protocol, “Personal Agent Protocol specification (draft 1.0)”; poppy.ax, “Set it up”; The Next Web, “Sierra releases Poppy 1.0 as Shopify and Meta's Muse sign on”; Sierra on X, “Today we're releasing Personal Agent Protocol (Poppy) v1.0”
