Sierra publishes draft of Poppy, a protocol for personal agents

A draft and 35 more design partners

Sierra said the response was "overwhelming" after it announced the protocol on Tuesday with Meta and Genesys, Instinct, Rocket, Shopify, Stripe, and Walmart. It has now released a draft of Poppy and expanded the group of companies that will take part in the design process.

The 35 new design partners are Adyen, Atomic, Bank of America, BBVA, Chime, Cigna, Cloudflare, Comcast, DIRECTV, ElevenLabs, FOX, Gap Inc., GEICO, Hertz, Insurify, Klaviyo, Liberty Mutual, Mastercard, Nordstrom, Notion, Okta, OneSignal, OpenAI, PayPal, Plaid, SiriusXM, Synchrony, Target, United Airlines, Venmo, Visa, Wells Fargo, Zapier, Zendesk, and 1Password. According to Sierra, they will contribute feedback from their own business perspectives.

The problem Poppy targets

Sierra says that when someone asks a personal agent to make a purchase or resolve an issue, the agent often has to sign in as the customer and navigate pages built for people. Businesses have no standard way to guide the agent. That limits what the customer, the agent and the brand can do together.

Poppy is built on the principle that customers decide what access their agents get, and companies set parameters for what those agents can do. Companies can know when they are dealing with an agent and who it represents.

Five building blocks

Sierra describes five parts of the protocol:

• Discovery: a company publishes one file at a standard address (/.well-known/poppy.json) that tells agents how to interact, how customers can sign in, and what the agent can do.
• Sessions: the agent starts a session for its customer, possibly as a guest, for tasks such as checking stock or a returns policy. It identifies itself so the company knows an agent is acting.
• Sign-in: when an account is needed, the person signs in on the company's page through OAuth. If the company permits, the agent can sign in with a session token granting only the access the customer approved.
• One session across every channel: the same token works for the company's APIs, website and conversations with its agent, so the customer does not have to start over.
• Getting the job done: the company picks the channel: its website, its APIs through standards such as OpenAPI and MCP, or its own agent for tasks like a warranty claim or an exchange.

Built on existing standards

Poppy builds on OAuth, JSON Web Tokens (JWTs), HTTPS, OpenAPI and MCP. Sierra says teams can implement it with libraries and tools they already have, and that companies can connect once through Poppy rather than building a separate connection for each personal agent. The core is designed to be extended so industries can add their own layers.

Sierra positions the protocol as complementary to Universal Commerce Protocol (UCP), which focuses on shopping. Poppy covers how an agent identifies itself, gets permission, and works with a company on any kind of task, "from buying a sweater to applying for a mortgage".

Live demo and next steps

At Sierra Summit, Alex McGillis, VP of Product at Rocket, showed the protocol live with Meta's personal agent, Muse. He asked Muse to get pre-approved for a mortgage. Muse went to Rocket's website, found Rocket's agent through Poppy, and asked for permission to connect. McGillis signed in to share credit and income details, the two agents worked through the purchase price, down payment and interest rate, and a pre-approval letter was ready within moments.

Sierra calls the draft a starting point. Over the next month it plans to host design workshops and publish a reference implementation to help developers get started. The company says it wants as many companies as possible to read the draft and help shape the protocol.