Sierra released Personal Agent Protocol 1.0, known as Poppy, on November 13, 2026, with automatic support for every Shopify store and enablement across Meta’s Muse agent. Sierra said 60 additional companies are joining as design partners, bringing the total to more than 100.
Poppy defines how a personal agent acting for one user discovers a company and works through its APIs, website or company agent. The release follows five weeks of design partners testing drafts against real websites, APIs and agents. Its changes allow staged adoption, refine the use of existing standards, expand company guidance and agent feedback, and introduce extensions so industries can add capabilities without changing the core protocol.
Muse now automatically looks for Poppy first on every site it visits. Any company can implement the protocol independently, making it available when Muse visits its site. The new design partners include Cisco, Delta Air Lines, Intuit, Salesforce, Twilio and Zoom.
How Poppy Structures Access
The draft specification requires a company to publish a poppy.json document at its domain’s /.well-known/poppy.json path over HTTPS. The document advertises available channels, capabilities and sign-in options, while the company chooses which channels and capabilities to offer.
A signed Session header identifies the personal agent and a pseudonymous user and connects activity across channels. Standard OAuth separately authorizes actions on a company account. Signed-out interactions can operate without an OAuth server, allowing a company to expose limited functionality before implementing account access.
User IDs remain stable at one company but are opaque and different across companies, so businesses cannot use them to match users with one another. Security rules require company content to be treated as data rather than instructions, addressing prompt-injection attempts to direct the model. Access tokens, refresh tokens, Session tokens, private keys, authorization codes and device codes must stay out of model context. Conversations also identify whether a person or AI wrote each message and support handoff to a person.
Shopify Integration and Early Business Uses
Every Shopify store now automatically publishes a Poppy file, with no extra merchant implementation. Sierra said the automatic publication extends across Shopify businesses in more than 175 countries.
Poppy handles the earlier interaction in which an agent identifies itself and learns what it may do, while Universal Commerce Protocol (UCP) handles product discovery, carts and checkout. Every Shopify store supports UCP by default. The arrangement adds a common company-discovery and permission layer in front of Shopify’s existing transaction flow.
Shopify also co-authored Poppy’s commerce extension, which links the two protocols. It supports guest and account-based shopping, requires customer approval before certain actions and connects to UCP Ask for direct conversations between shopper and store agents.
Mercury customers can use personal agents to check balances and transactions, categorize spending, maintain budgets and receipts, and initiate payments or transfers. Payment requests still pass through the account’s approval policy before anything is sent, preserving an authorization step around agent-initiated money movement.
Turkish Airlines supports agent checks of fares, flight status and stopovers, plus booking retrieval with a reference number and surname. Miles&Smiles members can have an agent find business-class upgrades, which customers approve before paying. The airline is still working to let members complete a purchase without leaving the conversation.
Synchrony’s work is exploratory. Sierra said it is examining product discovery that considers affordability, relevant offers and financing products, with potential use across its network of more than 500,000 merchant locations.
Implementation Tooling and Draft Status
The company implementation kit covers only the company side and combines a coding-agent skill with a command-line validator. The validator acts as a test personal agent and reports which protocol requirements a deployment meets. Its five-stage process covers survey, design, build, verification and reporting, and building begins only after the company approves the design. The dependency-free validator requires Node 22.18 or later; a test environment is recommended because it starts real Sessions and sends test messages to the company agent.
Sierra’s announcement calls the release v1.0, while the specification and kit label it draft 1.0. The specification permits further fixes, including changes that are not backward compatible. Shopify and Muse therefore give Poppy immediate reach before its technical foundation is fully settled. For each deployment, the substantive boundary is the combination of company-selected channels, user-approved OAuth scopes and approval policies governing consequential actions.
Credit: Source link
