Personal Agent Protocol 1.0: what Poppy means for builders

Sierra released version 1.0 of the Personal Agent Protocol on November 13, 2026. Poppy, as everyone calls it, is a standard for how your personal AI agent deals with a company: how it finds what the company offers, proves who it is, signs in to your account, and does things like checking an order or changing a booking.

The launch news is about adoption. Shopify turned it on for every merchant. Meta's Muse agent now looks for Poppy first on every site it visits. More than 100 companies are design partners. I build CRM and ERP software at erxes and spend most of my day on security, so I read the spec with two questions. What would a SaaS product have to ship to support it? And where does the risk land?

What shipped in Personal Agent Protocol 1.0

From Sierra's announcement, written by Bret Taylor and Clay Bavor:

• The v1.0 spec is out, along with an implementation kit that includes a validator.
• Shopify enabled Poppy for every merchant. Each store now publishes a Poppy file with no extra work.
• Mercury, Synchrony, and Turkish Airlines are going live.
• Poppy is on for everyone who uses Muse, Meta's AI agent. The Next Web reports that more than 10 million people have set Muse up.
• 60 new design partners joined, for more than 100 total. The list includes Salesforce, Zoom, Delta Air Lines, Intuit, Twilio, WorkOS, Descope, and Ping Identity.

Sierra says the changes since the first draft came from five weeks of partners testing against real sites and agents. Companies can now adopt in stages, the use of existing standards was refined, companies get more ways to give guidance and collect feedback, and there is an extension system. The first big extension is a commerce extension co-authored by Shopify.

One caveat. The Next Web notes that the spec is still labelled a draft and allows changes that could break existing setups. Treat 1.0 as stable enough to prototype against, not as frozen.

How Poppy works: discovery, sessions, sign-in

The Poppy 1.0 specification splits the problem into layers, and a company picks which ones to offer.

Discovery with poppy.json

A company publishes poppy.json at https://{domain}/.well-known/poppy.json. It names the organization, lists OAuth scopes in plain language, points to APIs (each one typed as openapi or mcp), and can expose a conversation endpoint for the company's own agent, a browser session endpoint, and a tasks endpoint.

I like the scope design. Each scope gets a human description like "See your orders, returns, and bookings," plus scope_hints that say whether it touches personal data and whether its changes are none, reversible, or irreversible. An agent can use that to decide when to stop and ask you before acting. That is the kind of metadata OAuth consent screens have needed for years.

Sessions: a signed JWT on every request

Every request to a company's APIs and protocol endpoints carries a Poppy-Session header. It is a JWT signed for that one request, with ES256 only. It includes the HTTP method and URL (htm, htu), a unique jti, and a hash of the access token when there is one. The agent signs it with a short-lived delegated key, and a key from the agent's published jwks_uri vouches for that delegated key.

The user ID inside is opaque, stable per company, and different at each company. The point is that companies can't use it to match the same user across sites.

Account access is plain OAuth, tightened

Sign-in is standard OAuth with stricter choices. The agent's client_id is the URL of a client metadata document, clients authenticate with private_key_jwt, redirect URIs must match exactly per RFC 9700, refresh tokens are bound with DPoP, and PAR is used when the company requires it. There is also a device sign-in flow where you approve on any device with a link and code.

For signed-out use, such as browsing products, a company doesn't need an OAuth server at all.

The security model, from a security engineer's view

This is where the spec impressed me. A few rules show the authors thought about how it gets attacked:

• An agent only trusts a poppy.json if organization.domain matches the host that served it. When an OAuth issuer is involved, the issuer must list that domain too. A file copied to another domain can't speak for the company.
• Discovery may follow redirects, but the final URL must be exactly /.well-known/poppy.json with no query. Otherwise anyone who could upload a file somewhere on your domain could have it speak for you.
• Neither side may connect to loopback, private, or link-local addresses the other party handed them, unless configured to on purpose. That's SSRF protection: it stops a company from aiming agents at someone else's internal servers.
• If a token, API, or conversation endpoint answers with a redirect, the agent must not send tokens or session JWTs to the new URL.
• The spec recommends a Web Bot Auth signature so existing bot protection can recognize the operator before the app even sees the request.

The part that stays hard is outside the spec: what your API lets an agent do once it holds a valid token. Mercury's live setup is a good pattern. An agent can start a payment or transfer, but it still goes through the account's approval policy before anything is sent. If you read my post on ChatGPT Wallet and agent payments, it's the same lesson: keep the approval step on the company side, not inside the agent.

Poppy vs MCP and UCP

Poppy doesn't replace MCP. A company lists its MCP server inside poppy.json as one of its APIs. Poppy adds the layer MCP leaves open: which company this is, who the agent and user are, and what the user has allowed.

Shopify's framing of UCP is clear. UCP handles the shopping itself (products, cart, checkout). Poppy handles the moment before that, when an agent arrives at a store, identifies itself, and learns what it is allowed to do. The commerce extension links the two and makes the agent ask the shopper before certain actions.

It also complements the browser side. Agents will keep browsing sites, which is why tools like Cloudflare's Kitesurf browser for agents matter. Poppy's browser join lets a company tie that browsing back to the same signed session.

How I'd adopt Poppy in a SaaS or CRM product

If I were adding Poppy to a product like erxes, I'd go in this order:

1. Publish a signed-out poppy.json that points to the OpenAPI spec or MCP server you already have. No OAuth server needed yet.
2. Verify the Poppy-Session JWT at the edge and log the agent's client_id and session ID with every request. You want that audit trail before any write access exists.
3. Design scopes around real user tasks, with honest scope_hints. Mark anything that moves money or deletes data as irreversible.
4. Add OAuth sign-in with read-only scopes first. Only then add write scopes, and route risky writes through your existing approval rules.
5. Run Sierra's validator before you call it done.

FAQ

What is the Personal Agent Protocol?

It's an open standard, started by Sierra with Meta and other partners, that defines how a personal AI agent acting for one user works with a company. It covers discovery, identity, account access, and interactions through APIs, web browsing, and the company's own agent.

Is Poppy a replacement for MCP?

No. MCP servers and OpenAPI specs are listed inside a company's poppy.json as the APIs an agent can call. Poppy adds identity, sessions, and OAuth-based permission on top.

Do Shopify merchants need to do anything?

According to Sierra, no. Every Shopify store now publishes a Poppy file automatically, and Shopify's existing UCP support handles carts and checkout.

What to watch next

The protocol is only as useful as the number of real agents that look for it. Muse checking for Poppy on every site is the big early signal. Next I want to see whether other agent makers adopt it, and how companies handle the scopes marked irreversible. That second part will decide whether people trust agents with real accounts.

---

Sources

• Releasing Personal Agent Protocol 1.0, Sierra (Nov 13, 2026)
• Personal Agent Protocol specification, version 1.0
• Sierra releases Poppy 1.0 as Shopify and Meta's Muse sign on, The Next Web

Cover image: Sierra