Why this matters: if your AI agent can shop, book and change orders for you, businesses need a trusted way to know who sent it, what it may do, and when to stop it.
October 10, 2026 — Sierra has published a draft of the Personal Agent Protocol, known as Poppy, an open standard it is developing with Meta for how personal AI agents interact with businesses. Sierra said the October 9 draft adds 35 additional design partners, including OpenAI, PayPal, Mastercard, Visa, Bank of America and Cloudflare.
Image: A personal AI agent presenting a digital identity and permission key at an online storefront. Credit: AI-generated illustration / Red Eye Eagle News, original illustration.
Editor's Highlight: Poppy is not a shopping product or a payment system. It is a proposed identity and permission layer: the customer decides what access an agent gets, and the business decides which actions that agent may take.
Table of Contents
- Key Facts
- Why Agents Need a Common Front Door
- How Poppy Is Meant to Work
- Three Routes Into a Business
- 35 New Design Partners Join the Draft
- What Poppy Does Not Do Yet
- Bottom Line
- FAQ
- Sources
Key Facts
| Detail | Information |
| Protocol | Personal Agent Protocol, known as Poppy |
| Led by | Sierra and Meta |
| First announced | October 6, 2026 |
| Draft published | Draft 0.1 on October 9, 2026 |
| Earlier partners | Genesys, Instinct, Rocket, Shopify, Stripe and Walmart |
| New partners | 35 additional design partners announced October 9 |
| Technical basis | OAuth sign-in, with sessions across websites, APIs and company agents |
| Status | Draft for design input, not a finished standard |
Why Agents Need a Common Front Door
People already use personal agents to schedule appointments, book flights and shop for insurance, according to Sierra.
Today, Sierra says, most agents use websites and apps much as people do, loading pages and clicking through forms. When that fails, an agent may turn to a support line or web chat, which Sierra says can be slow and may still not finish the task.
Newsroom Focus: The core issue is recognition. A business needs to distinguish a customer's authorised agent from an unknown bot, and to see what that agent is trying to do.
How Poppy Is Meant to Work
The principle Sierra described is split control. Consumers decide what access to give their agents, and companies set parameters for what those agents can do.
An interaction starts on the company's website, where the agent discovers what the company offers and how to reach it, then begins a session on its user's behalf.
It can start as a guest, which Sierra says may be enough to check product availability or ask about a returns policy. For an account task, the customer signs in on the company's page and decides whether the agent gets read-only or write access.
Analysis Note: That read-versus-write choice is the practical safeguard. Looking up an order is different from changing it, and the protocol is built to keep that difference explicit.
Sessions are built on OAuth, an established standard for authorising access, Sierra said. A session carries across channels, so a question asked before sign-in and an order change afterwards can belong to the same visit.
Three Routes Into a Business
Sierra says a company can choose the route that best fits its customers. The company decides what it makes available.
| Route | How it works |
| Website | The agent uses the company's regular web pages |
| APIs | The agent connects through interfaces built on standards such as MCP and OpenAPI |
| Company agent | The personal agent works with the company's own agent, for example on a warranty claim |
Practical Takeaway: A business would not have to open every system at once. It could start with public information and add account access later, on its own terms.
35 New Design Partners Join the Draft
Sierra's October 9 post said it was publishing a draft known as Poppy and announcing 35 additional design partners. The new group spans payments, banking, retail, travel, software and security, including Adyen, Bank of America, Cloudflare, Mastercard, Notion, Okta, OpenAI, PayPal, Plaid, Target, United Airlines, Venmo, Visa, Wells Fargo, Zapier, Zendesk and 1Password, among others.
These are design partners, not proof of live adoption. Their role, as described, is to take part in shaping the draft.
The earlier October 6 group was Genesys, Instinct, Rocket, Shopify, Stripe and Walmart.
What Poppy Does Not Do Yet
Poppy is a draft. Summaries of the October 9 publication note that it can still change, with design workshops and a reference implementation expected next month, according to Sierra.
Payments also need careful reading. Sierra described payments as a possible future extension, where an agent could complete a purchase without sharing credit card information.
That is not the same as Poppy handling payments today. The presence of PayPal, Visa and Mastercard as design partners does not mean purchases already run through Poppy.
Analysis Note: The test for Poppy will be specificity. Businesses will want to know exactly which actions can be limited, logged, paused or revoked, not just that an agent signed in.
Bottom Line
Poppy gives the agent debate a concrete draft. It proposes that an agent should arrive identified, work inside permissions set by both the customer and the business, and keep one session across a website, APIs and a company agent.
What to watch next is whether the workshops turn draft 0.1 into clear rules, when a reference implementation appears, and which partners move from design input to real support.
FAQ
What is the Personal Agent Protocol?
It is an open standard Sierra and Meta are developing for how personal AI agents interact with businesses, covering authentication, consumer control and company visibility.
Why is the draft called Poppy?
That is the name Sierra gave the draft in its October 9 post.
How does sign-in work?
Sierra says sessions are built on OAuth. An agent can start as a guest, and the customer signs in on the company's page when an account task requires it.
Can a Poppy agent pay for things now?
No, based on the announcements read for this article. Sierra described payments as a possible future extension, not as a feature established by the October draft.
Does joining as a design partner mean a company has launched Poppy?
No. The October 9 announcement describes design partners taking part in the design process. It should not be read as production adoption by every company named.
Sources
- Sierra — Introducing Personal Agent Protocol, October 6: https://sierra.ai/blog/introducing-personal-agent-protocol
- Sierra — Author page listing the October 9 Poppy draft: https://sierra.ai/author/clay-bavor
- Unite.AI — Sierra Unveils Personal Agent Protocol: https://www.unite.ai/sierra-unveils-personal-agent-protocol-built-with-meta-and-partners/
- ODSC — Meta and Sierra Introduce Personal Agent Protocol: https://opendatascience.com/meta-and-sierra-introduce-personal-agent-protocol-for-ai-to-business-interactions/
- LupaRiel — PAP hub, October 9 draft and partner list: https://lupariel.com/en/pap/
- TechStartups — Top AI News Stories This Week, October 5-9: https://techstartups.com/2026/10/09/top-ai-news-stories-this-week-october-5-9-2026/
- Image source — AI-generated illustration by Red Eye Eagle News, original illustration.
Join the conversation
Comments
Post a Comment