What was published today

Bret Taylor and Clay Bavor of Sierra write that they are publishing a draft of Personal Agent Protocol, known as Poppy. On Tuesday they had announced the protocol with Meta, Genesys, Instinct, NiCE, Rocket, Shopify, Stripe, and Walmart. Today they name 35 more design partners: Adyen, Atomic, Bank of America, BBVA, Chime, Cigna, Cloudflare, Comcast, DIRECTV, ElevenLabs, FOX, Gap Inc., GEICO, Hertz, Insurify, Klaviyo, Liberty Mutual, Mastercard, Nordstrom, Notion, Okta, OneSignal, OpenAI, PayPal, Plaid, SiriusXM, Synchrony, Target, United Airlines, Venmo, Visa, Wells Fargo, Zapier, Zendesk, and 1Password. Those companies will take part in the design and comment from their own businesses.

This is a draft, not a standard already in force.

[1]
An open binder with a black cover, blank pages, and a small oxide-red tab on the spine
The gouache shows an open binder with no writing on the pages. It stands for the protocol draft published today, and it is not a news photograph., AI-generated illustration, not a news photograph

Five building blocks

The post says that when a personal agent buys something or resolves an issue today, it often has to sign in as the customer and use pages built for people. A business has no standard way to guide that agent. Poppy’s principle is that customers decide what access to give their personal agents, and companies set parameters for what those agents can do. A company can keep using its website and APIs, or use an agent of its own.

Discovery: the company publishes one file at /.well-known/poppy.json, saying how to interact, how a customer signs in, and what the agent can do. Sessions: the personal agent starts a session for the customer. It can begin as a guest, for example to check stock or ask about returns, and it identifies itself so the company knows an agent is there. Sign-in: when a task needs the account, the person signs in on the company’s page through OAuth. If the company allows it, the agent can use a session token limited to the access the customer approved. One session across channels: the same token works for the company’s APIs, its website, and a conversation with its agent. A question asked before sign-in and an order change made afterward belong to the same visit. Getting the job done: the company chooses its website, APIs built on OpenAPI and MCP, or its own agent. For a conversation such as a warranty claim or an exchange, replies can stream as they are written, and the company can hold a request open until there is news.

The protocol is built on OAuth, JSON Web Tokens, HTTPS, OpenAPI, and MCP. The post describes Universal Commerce Protocol as complementary. That protocol covers shopping, from finding a product to checkout and orders. Poppy covers how a personal agent identifies itself, gets permission, and works with a company on any kind of task. The post’s examples run from buying a sweater to applying for a mortgage.

[1]

The demo, and what is not finished

The post uses three sketches of how this would work. They are not measured customer results. On a website, the agent uses the retailer’s existing returns page to return a jacket. The retailer lets it start the return and does not let it change the payment details on file. Through APIs, after a flight is canceled, the agent connects to the airline’s booking tools through MCP with the customer’s approved access, finds the next flight, and confirms the seat with the customer before booking.

The third is a live demonstration Sierra describes. At Sierra Summit on Tuesday, Alex McGillis, vice president of product at Rocket, asked Meta’s personal agent, Muse, to get pre-approved for a mortgage. Muse found Rocket’s agent through Poppy and asked Alex for permission to connect. Alex signed in and shared the credit and income details a mortgage needs. The two agents worked through the purchase price, the down payment, and the interest rate. The post says Alex then had a pre-approval letter ready, and that he remained in control of the steps. This article does not treat that demonstration as a verified business result.

The post says the draft is a starting point. Over the next month Sierra will host design workshops and publish a reference implementation. It states the goal this way: customers choose who acts for them, companies know who they are working with, and both stay inside the boundaries they set. That is a goal, not a state already reached.

[1]