Sierra's Poppy 1.0: The Protocol That Lets Your Personal Agent Talk to Every Business

Your personal agent is about to start doing your errands — checking your bank balance, rebooking a flight, finding a better price on a jacket. The problem is that every website it visits was built for a human with a mouse, not an agent with a task.

Sierra's answer is the Personal Agent Protocol, or Poppy. Version 1.0 was released on November 13, 2026, and it already has more momentum than most standards ever get: Shopify has switched it on for every merchant on its platform, Meta's Muse agent now looks for it first on every site it visits, and the design-partner list has grown past 100 companies.

Here's what Poppy actually does, how it works, and why it matters for anyone building agents.

The problem: agents are guests who can't read the house rules

Today, when your agent lands on a business's website, it has to guess. It scrapes pages, infers what's clickable, and hopes the checkout flow tolerates a non-human visitor. Businesses, meanwhile, can't tell a legitimate personal agent acting on a customer's behalf from a scraper hammering their servers.

Poppy gives both sides a shared handshake. When an agent arrives at a site, it says who it is and asks what it's allowed to do. The business answers with a clear, machine-readable description of its services. No guessing, no scraping, no ambiguity about permission.

How Poppy works

Poppy is deliberately boring in the best sense: it's assembled from standards that already exist, rather than inventing a new stack from scratch.

• Built on MCP, OpenAPI, and UCP. The protocol layers on top of the Model Context Protocol, OpenAPI descriptions, and the Universal Commerce Protocol. Companies that already describe their APIs in OpenAPI or support UCP for shopping don't have to start over.
• Authentication through OAuth. Customers control what their personal agent can and can't do, and can manage that access over time. The agent acts with the customer's permission, not with a shared credential or a scraped session.
• Staged adoption. Since the first draft, Sierra made it easier for companies to adopt the protocol in stages — starting with the basics and adding capabilities over time — instead of demanding a full implementation on day one.
• Extensions, not forks. Industries can build on the core protocol through extensions without changing it. Shopify co-authored the commerce extension, which is the template for how that works.

Sierra also ships an implementation kit with a validator, so a company can check its work before going live.

Poppy vs. UCP: before the sale, and during it

If you've followed the agent-commerce space, you may wonder how Poppy relates to the Universal Commerce Protocol. They're complementary, and the split is clean:

• Poppy handles what happens before the shopping starts — the agent shows up, identifies itself, and finds out what it's allowed to do.
• UCP handles the shopping itself — finding products, filling a cart, and checking out.

Shopify co-authored Poppy's commerce extension to link the two. An agent can shop as a guest or sign in with the customer's account, must ask the customer before taking certain actions, and can connect to UCP Ask so the shopper's agent talks directly to the store's agent. Since every Shopify store already supports UCP by default and now automatically publishes a Poppy file, merchants get both without doing any extra implementation. Shopify powers businesses in more than 175 countries, so that's a large footprint switching on at once.

Who's already live

This isn't a paper spec. Several design partners are already running Poppy in production:

• Mercury lets customers ask their personal agent to check balances, review recent transactions, categorize spending, or keep budgets and receipts up to date. Customers can even ask the agent to initiate a payment or transfer — but Mercury routes the request through the account's approval policy before anything is sent.
• Synchrony is exploring how a personal agent could help customers find the right product while weighing affordability, Synchrony offers, and financing products — across a network of more than 500,000 merchant locations.
• Turkish Airlines welcomes personal agents from search to business class: agents can check fares, flight status, and stopovers, pull up a booking with a reference number and surname, and Miles&Smiles members can have their agent find business-class upgrades, which the customer approves before paying. The airline is working toward letting members complete a purchase without leaving the conversation.

On the agent side, Poppy is now on for everyone who uses Muse, Meta's AI agent, which automatically looks for Poppy first on every site it visits. And 60 new companies joined as design partners with the v1.0 release, bringing the total to more than 100 — including Salesforce, Intuit, Twilio, Zoom, Delta Air Lines, Hyatt, and Wayfair.

Why this matters for agent builders

Three things make Poppy worth watching, even if you're skeptical of new standards:

1. Distribution is the hard part, and Poppy may have already solved it. Standards usually die in the adoption gap. Poppy launched with Shopify's entire merchant base and Meta's agent looking for it by default. That's a two-sided network on day one.

2. It treats permission as a first-class feature. The OAuth-based model — the customer decides what the agent can do, and can revoke it — is the difference between an agent ecosystem users trust and one that gets blocked as abuse. Mercury's approval-policy gate is the pattern to copy.

3. It doesn't ask anyone to rip anything out. Building on MCP, OpenAPI, and UCP, with staged adoption and extensions, means a business can publish a Poppy file this week and deepen the integration later. Low-friction adoption is exactly what a protocol needs in its first year.

The open questions

Poppy v1.0 doesn't settle everything. How businesses distinguish legitimate personal agents from bad actors impersonating them will matter as adoption grows. The commerce extension is the first industry extension — travel, banking, and healthcare will each need their own, and each will test whether the extension mechanism holds. And the protocol's success still depends on more agents and more businesses showing up; Shopify and Muse are a strong start, not a finished network.

But the direction is clear. The web is acquiring a machine-readable front door, and the companies that publish one early will be the ones agents can actually work with. If you're building a personal agent, check whether the services your users rely on publish a Poppy file. If you're running a business with an API, the implementation kit and validator are the fastest way to find out what your side of the handshake looks like.

Source: Sierra, "Releasing Personal Agent Protocol 1.0" (November 13, 2026) — sierra.ai/blog/releasing-poppy. Protocol details at personalagentprotocol.org.