Sierra publishes a draft of Personal Agent Protocol (Poppy) with Meta, adding 35 design partners including OpenAI, Visa and Mastercard to define how personal agents identify themselves, get permission and work with businesses

Why it matters

【Key points】

On Oct 9 Sierra co-founders Bret Taylor and Clay Bavor published the first draft of the Personal Agent Protocol, nicknamed Poppy, an open standard for how personal AI agents deal with businesses: customers decide what access their agent gets, and companies decide what agents may do. Sierra and Meta announced the protocol on Oct 6 at Sierra Summit with Genesys, NiCE, Rocket, Shopify, Stripe and Walmart; the draft adds 35 design partners, including OpenAI, Visa, Mastercard, PayPal, Bank of America, Cloudflare, Okta and United Airlines.

【Verifiable】

The draft has five parts: a discovery file at /.well-known/poppy.json telling agents how to sign in and what they can do; sessions that start as a guest, with the agent always identifying itself; OAuth sign-in on the company's page that yields a token limited to what the customer approved; one session across website, APIs and the company's own agent; and a company choice of channel (web pages, APIs built on OpenAPI and MCP, or its own agent). It builds on OAuth, JWT, HTTPS, OpenAPI and MCP and is pitched as complementary to the shopping-focused UCP. At the Summit, Meta's agent Muse reached Rocket's agent and got a mortgage pre-approval letter. Sierra plans design workshops and a reference implementation over the next month. About 70 X posts followed within two hours; Cloudflare, Okta and OneSignal confirmed joining.

【Our read】

What stands out is who signed: payment networks, banks, airlines and retailers, plus OpenAI and Meta, two companies building personal agents. Agents that declare themselves and follow company rules, instead of posing as humans clicking through pages, appeal to businesses. Caveats: Sierra sells company-side agents, so a first-class "company agent" channel is no accident, and design partners are not implementers. The real test is how many companies publish a poppy.json once the reference implementation ships, and whether Google, Anthropic and Apple join.