Sierra Opens Poppy Draft of Personal Agent Protocol: Meta Standard Adds OpenAI, Visa and 33 More Design Partners

Sierra published a working draft of Personal Agent Protocol on 9 October 2026, branding the draft “Poppy,” three days after Meta and Sierra announced the open standard with a first wave of commerce and CX partners. The update matters because it turns a press line into something engineers can read: discovery rules, session tokens, and a public partner list that now includes OpenAI, Visa, Mastercard and Cloudflare among 35 additional design partners.

The core pitch is blunt. Personal agents already try to book flights, return jackets and chase insurance quotes by clicking websites like people do. Brands want to know when an agent is acting for a customer, and customers want to decide what that agent can touch. Poppy is Sierra and Meta’s proposed shared way to do both without a one-off integration for every agent vendor.

There is still no finished v0.1 specification in the wild, no published compliance suite and no USD product price, because this is a protocol, not a SaaS SKU. What shipped on 9 Oct is a draft plus a longer design-partner roster. Treat every “agents will just work everywhere” claim as marketing until the reference implementation lands.

What Sierra and Meta announced

In the 6 October Sierra post, co-founders Bret Taylor and Clay Bavor said Meta and Sierra are developing Personal Agent Protocol with Genesys, Instinct, Rocket, Shopify, Stripe and Walmart. The goal is an open standard anyone can implement for how personal agents authenticate, what access consumers grant, and how companies see agent activity across websites, APIs or a company-owned agent.

The 9 October follow-up published the draft under the Poppy name and listed 35 more design partners, including Adyen, Bank of America, BBVA, Chime, Cigna, Cloudflare, Comcast, DIRECTV, ElevenLabs, FOX, Gap Inc., GEICO, Hertz, Insurify, Klaviyo, Liberty Mutual, Mastercard, Nordstrom, Notion, Okta, OneSignal, OpenAI, PayPal, Plaid, SiriusXM, Synchrony, Target, United Airlines, Venmo, Visa, Wells Fargo, Zapier, Zendesk and 1Password. The same post also names NiCE among the companies tied to the original Tuesday announcement.

The public explainer at personalagentprotocol.org frames the same idea for users, personal-agent builders and companies: publish once, let any conforming agent connect, keep the person in control of scopes.

How Poppy is supposed to work

Poppy’s discovery step is concrete. Companies publish a file at a standard path, /.well-known/poppy.json, describing how to start sessions, how customers sign in, and which APIs or company agent endpoints are offered.

Sessions can start as a guest for low-risk tasks such as stock checks or returns policy questions. When account access is required, the person signs in on the company’s own page through OAuth. Sierra says the same session can span website browsing, API calls and a conversation with the company’s agent, so a pre-login question and a later order change stay one visit.

The company chooses the channel mix:

• Website: the agent uses regular pages while the company applies the customer’s permissions
• APIs: interfaces built on OpenAPI and MCP
• Company agent: conversational tasks such as warranty claims or mortgage pre-approval

Sierra says the stack builds on OAuth, JSON Web Tokens, HTTPS, OpenAPI and MCP so teams can reuse libraries they already run. That is the practical claim for platform teams: less custom glue per agent vendor, more policy on scopes and channels.

Confirmed vs unconfirmed

Why the partner list moved in three days

The 6 October announce list was heavy on retail, payments and contact-center vendors. The 9 October design-partner expansion pulls in banks, insurers, airlines, identity vendors and, notably, OpenAI. That last name closes a hole some early coverage flagged when rival agent makers were missing from day one.

It does not mean production Muse-to-merchant flows are standardized tomorrow. Design partner means feedback rights on a draft, not a certified live deployment. Still, putting OpenAI, Visa, Mastercard, Plaid and Cloudflare on the same roster signals that authentication, payments adjacency and edge security are all in the room while the wire format is soft.

Sierra positions Poppy as complementary to Universal Commerce Protocol, which focuses on shopping journeys from discovery to checkout. Poppy claims the broader identity and permission layer across any task, including mortgages and claims, not only carts. If both stick, merchants may end up implementing two related standards instead of one. That is a cost line for platform teams, not a free lunch.

How this sits next to other agent news

Meta already pushed Muse as a consumer and enterprise surface. Our earlier coverage of Meta’s enterprise platform under CJ Desai tracked Muse, Muse API and Muse Code as named pieces without a public platform price. Poppy is the rails story sitting under that product bet: merchants need a reason to let agents in.

Privacy and permission pressure is rising on the client side too. We covered how Apple plans to tighten macOS Full Disk Access as agents ask for broader file and message reach. Poppy’s OAuth-and-scopes pitch is the server-side twin of that debate: who approved what, and can the company prove it.

Runtime and platform lock-in still matter for anyone shipping agents. When Cloudflare absorbed the Deno team, official runtime support got a one-year clock. Cloudflare also appears on Poppy’s design-partner list, which is interesting if your agent stack already sits on Workers-style edges.

Security operations teams watching agent autonomy will recognize the approval-gate theme from Elastic’s work. Our report on Elastic AlertZero’s human approval gates is a different product, but the same policy question: consequential actions should not be silent.

What it means for Indian developers

India’s agent builders sit in the same squeeze as US and EU teams: banks, insurers and ecommerce brands will not open write access to random scrapers. If Poppy sticks, an India SaaS that acts for a user at HDFC-scale merchants or global travel brands will want a first-class session model rather than brittle browser automation.

Practical steps now, before the reference implementation ships:

• Map your product to guest versus signed-in scopes. Separating read from write early saves a rewrite when OAuth scopes land
• Prefer OpenAPI and MCP surfaces you already expose. Poppy’s draft leans on those instead of inventing a new RPC religion
• Plan for /.well-known/poppy.json on customer-facing domains if you sell to merchants who will need to publish discovery
• Do not promise “works with every personal agent” in sales decks until the v0.1 text and a reference client exist
• Watch payments carefully. Sierra lists payments as a future extension, not a finished Poppy core. UPI and card flows in India will need local compliance review even if a global payments layer appears later

For Indian IT services firms packaging agent projects for US or EU retailers, the useful sentence is narrow: Sierra and Meta published a draft identity and channel protocol with a large design-partner list. Implementation cost and liability still sit with the integrator.

What to watch next

Three checkpoints decide whether Poppy is infrastructure or slideware. First, whether the promised reference implementation and workshops produce interoperable client and server samples. Second, whether OpenAI and Meta Muse both ship production connectors against the same draft without forking. Third, whether banks and retailers publish live poppy.json files or only stay on the logo wall.

Until those land, the honest status line is: draft open, partners named, no universal agent passport yet.

FAQ

What is Personal Agent Protocol?

It is an open standard Meta and Sierra are developing so personal AI agents can authenticate with businesses, receive customer-approved scopes, and work through websites, APIs or a company agent under rules the business sets.

What is Poppy?

Poppy is the name Sierra gave the draft published on 9 October 2026. The protocol site and Sierra blog use Poppy as the short label for Personal Agent Protocol.

Is there a price in USD?

No product price was published. Sierra presents Poppy as an open protocol anyone can implement. Your costs are engineering, compliance and whatever agent or merchant platforms you already pay for.

Did OpenAI join?

OpenAI appears on Sierra’s 9 October list of 35 additional design partners. That is not the same as a finished production integration. Anthropic was not named on that list.

When does v0.1 ship?

Sierra said a v0.1 specification, design workshops and a reference implementation would follow after the October announce, then repeated that workshops and a reference implementation would come over the next month after the draft. No exact calendar date was attached to a finished v0.1 artifact as of this writing.