Sierra Ships Version 1.0 of Its Poppy Protocol for Personal AI Agents, and Every Shopify Store Now Speaks It
The Personal Agent Protocol tells a visiting AI agent who it is dealing with and what it may do. Shopify has switched it on for all of its merchants, Meta's Muse now looks for it first, and more than 100 companies have signed up, though the specification is still labeled a draft.
Published
Last updated / Fact-checked on
Illustrative photo of a shopper using a smartphone. It has no connection to Sierra, Shopify or the companies named in this article.
The race to set the rules for AI agents that shop, bank and book travel for people took a concrete step on Friday. Sierra, the customer-service AI company led by former Salesforce co-CEO Bret Taylor, released version 1.0 of Personal Agent Protocol, a standard it nicknames "Poppy," and said Shopify has turned it on for every merchant on its platform.
In a post signed by Taylor and Clay Bavor, Sierra said Poppy is also now on for everyone who uses Muse, Meta's AI agent, which "automatically looks for Poppy first on every site it visits." Sixty more companies have joined as design partners, bringing the total to more than 100, and several are already live with the protocol.
At a glance
| Item | Detail | Source |
|---|---|---|
| Released | Nov. 13, 2026 | Sierra |
| What it is | A standard for how personal AI agents work with companies | Sierra; Poppy specification |
| Built on | MCP, OpenAPI, Universal Commerce Protocol (UCP) and OAuth | Sierra |
| Shopify | Every store now publishes a Poppy file automatically | Sierra |
| Meta's Muse | Looks for Poppy first on every site it visits | Sierra |
| Design partners | More than 100, after 60 new additions | Sierra |
| Live now | Mercury, Synchrony and Turkish Airlines among those going live | Sierra |
| Status | Specification still labeled "draft version 1.0" | Poppy specification; The Next Web |
What Poppy does
As more people hand chores to AI agents, companies face a new kind of visitor: software acting for a customer. A website built for humans, or an API built for developers, does not say who the agent works for or what it is allowed to do. Poppy is meant to fill that gap.
Sierra describes the protocol as defining how personal agents connect with companies "through business agents, websites, and APIs." It leans on standards that already exist. The draft specification lays out the pieces. A company publishes a file called poppy.json that lists its channels, capabilities and sign-in options. The agent identifies itself with a signed session token that names the agent and a pseudonymous user. Account access runs through standard OAuth, so customers decide what their agent can do and can change that later. And the company chooses which channels to offer: APIs, its website, or a conversation with the company's own AI agent, including a handoff to a person.
The specification also recommends a Web Bot Auth signature so existing bot defenses can recognize a legitimate agent's operator, a practical point for retailers whose security systems often block automated traffic.
What changed in version 1.0
Sierra and Meta first unveiled Poppy in October with an initial group of design partners: Meta, Genesys, Instinct, NiCE, Rocket, Shopify, Stripe and Walmart. Sierra said version 1.0 reflects what those partners learned over about five weeks of testing drafts against real websites, APIs and agents.
According to the company, the changes make it easier to adopt the protocol in stages, refine how it uses existing standards, give companies more ways to guide a visiting agent and collect feedback from it, and add "extensions" so industries can build on the core protocol without changing it. The first is a commerce extension co-authored by Shopify. Sierra also published an implementation kit with a validator so companies can check their setup.
Why Shopify matters most
Shopify's move gives Poppy its biggest footprint overnight. Sierra says Shopify powers businesses in more than 175 countries and that every Shopify store already supports UCP by default. Now every store also publishes a Poppy file, with no extra work from merchants.
Sierra explains the split between the two protocols this way: UCP handles the shopping itself, such as finding products, filling a cart and checking out. Poppy handles the moment before that, "when an agent shows up at a store, says who it is, and finds out what it's allowed to do." The commerce extension links them. It lets an agent shop as a guest or sign in with the customer's account, and it makes the agent ask the customer before taking certain actions. It also connects to UCP Ask, so a shopper's agent can talk directly to the store's agent.
The Muse connection supplies the other half of the market. The Next Web reports that more than 10 million people have set up Meta's Muse agent. With Muse checking for Poppy first and Shopify stores publishing it by default, a large number of agent shopping trips can now start with the protocol.
Early users
Sierra named three companies going live. Mercury lets people who use it for business and personal banking ask their agent to check balances, review transactions, categorize spending and keep budgets and receipts current. Agents can even start a payment or transfer, Sierra said, but the request still passes through the account's approval policy before money moves.
Synchrony is exploring how an agent could help customers weigh affordability, financing and rewards while shopping, which Sierra said could reach Synchrony's network of more than 500,000 merchant locations over time. Turkish Airlines lets agents check fares, flight status and stopovers, pull up a booking with a reference number and surname, and find business-class upgrades for Miles&Smiles members, which customers approve before paying.
The new design partners span finance, travel, insurance and software. Sierra's list includes Affirm, Delta Air Lines, Hyatt, Intuit, Cisco, Salesforce, Wayfair, Twilio and Zoom, among others.
The caveats
Version 1.0 is not frozen. The specification calls itself "draft version 1.0," starting from the 0.4 release candidate, and says it will add fixes for problems implementers find, "which can include changes that aren't backward compatible." The Next Web flagged the same point.
Poppy also has company. The Next Web notes that Visa and Mastercard are building identity checks for agents, and that Amazon wants shoppers to use its own agent rather than Muse. Which approach wins will depend on whether merchants, banks and agent makers keep adopting the same rules.
For now, Sierra's pitch is about trust on both sides. "As personal agents take on more of our everyday tasks, companies need clear, secure ways to work with them while continuing to deliver a trusted experience," the company wrote.
How we reported this
DailyMech read Sierra's announcement and The Next Web's report in full, and read the introduction and protocol overview of the draft 1.0 specification. Partner capabilities are as Sierra described them and were not tested by DailyMech. The Muse user figure and the notes on Visa, Mastercard and Amazon come from The Next Web only. The Next Web's text says Sierra announced on Thursday, while both its dateline and Sierra's post are dated Friday, Nov. 13; this article uses Nov. 13. DailyMech contacted no one for this article.
Published November 13, 2026. Facts checked against the cited sources by DailyMech's AI writer.
Sources
- Releasing Personal Agent Protocol 1.0, Bret Taylor and Clay Bavor, Sierra, Nov. 13, 2026 (fully read).
- Sierra releases Poppy 1.0 as Shopify and Meta's Muse sign on, The Next Web, Nov. 13, 2026 (fully read).
- Personal Agent Protocol specification (draft 1.0), Personal Agent Protocol, accessed Nov. 13, 2026 (introduction and protocol layers read).
DailyMech used AI tools to research and draft this article. Facts were checked against the cited sources by DailyMech's AI writer, not by a human editor.