A visitor with Pepper, a humanoid service robot built by SoftBank, at Oracle OpenWorld in San Francisco in October 2017. Photo: GeneralAB13 via Wikimedia Commons, CC BY-SA 4.0.
Meta and Sierra have launched the Personal Agent Protocol, an open standard that sets the rules for how a customer's AI assistant identifies itself to a business and what it is allowed to do there. The two companies announced the standard on 6 October 2026, and Sierra published the first draft, nicknamed Poppy, on 9 October at personalagentprotocol.org. If AI assistants are going to shop, book and complain on our behalf, this is the first serious attempt at a shared rulebook.
How did the Personal Agent Protocol come about?
AI shopping agents like Meta's Muse sign into websites as the customer and click through pages the way a person would. That is convenient for shoppers, but it left businesses with no way to tell a legitimate agent from a bot or a credential thief. The tension boiled over in September, when Amazon blocked Meta's Muse agent from its store, saying Meta had not told it the agent would access the site and that the agent appeared to capture and store customer credentials. Meta disputes that account, but the clash showed what happens when agents meet businesses with no agreed rules.
Poppy is also the newest entry in a crowded field. Google launched its Universal Commerce Protocol in January 2026 with Shopify, Etsy, Wayfair, Target and Walmart; Stripe and OpenAI built the Agentic Commerce Protocol for purchases inside ChatGPT; Visa runs its own Trusted Agent Protocol; and Cloudflare is pushing a verification method called Web Bot Auth. Sierra describes Poppy as complementary rather than competing, because it covers any task an agent performs with a business, not just buying things.
How does the Personal Agent Protocol work?
The draft rests on three pillars, according to Sierra's announcement. First, the assistant identifies itself to the business instead of browsing anonymously. Second, the customer decides what the agent may do, from read-only access to full permission to act. Third, the business can see what the agent did inside its systems. Agent sessions use OAuth, the same standard that lets you sign into apps with your Google account, so an agent can start as a guest with read-only access and gain write access only once the customer signs in.
Who is behind Poppy?
Sierra, the customer service AI firm co-founded by former Salesforce co-CEO Bret Taylor, is building the standard with Genesys, Instinct, NiCE, Rocket, Shopify, Stripe and Walmart. On 9 October Sierra added 35 more design partners, including OpenAI, Visa, Mastercard, PayPal, Bank of America, Wells Fargo, Chime, Target, United Airlines, Zendesk and Okta. Two names are missing from the list so far: Amazon and Anthropic.
What does it mean for payments?
Poppy does not handle payments yet. Sierra has listed payments extensions on its roadmap that would eventually let an agent complete a purchase without ever sharing card details with the merchant. Stripe's head of payments Kevin Miller set expectations in the launch blog post: "A customer relationship doesn't start or end at checkout." Businesses should expect the competing commerce standards to keep converging over the next year.
What should Nigerian businesses do now?
Poppy is draft 0.1 and can still change, so no business needs to build anything today. But the direction of travel is clear, and Nigerian businesses that sell through Shopify, WhatsApp Business or Instagram, or that serve customers who use AI assistants, should put three foundations in place now: clean sign-in and permission flows, a real API for product and order data, and a log of every action taken on customer accounts. Companies that join the design workshops over the next month will help set the defaults everyone else inherits. It is also the second time this month Meta has rewritten how businesses deal with it: from 30 October its new commercial terms let it crawl business websites to train AI (what that means for Nigerian businesses).
Frequently asked questions
What is the Personal Agent Protocol?
An open standard announced by Meta and Sierra on 6 October 2026 that defines how a customer's AI assistant identifies itself to a business, what permissions the customer grants it, and what the business can see of its activity.
Is Poppy the same as Visa's Trusted Agent Protocol?
No. They are separate, overlapping standards, and Stripe and Shopify back both. Poppy covers any agent task with a business and defers payments to a future extension, while Visa's protocol focuses on agent-driven payments.
Should my business implement Poppy today?
Not yet. It is a draft that can still change. Prepare the foundations instead: clear sign-in and permissions, an API for product and order data, and logs of agent actions.
Sources: Sierra's announcement, and coverage by PYMNTS, Customer Experience Magazine and LBZ Advisory.
0 Comments