Sierra announces Poppy protocol draft and 35 more design partners

In an October 9, 2026, post, Sierra announced a draft of its Personal Agent Protocol, known as Poppy, and named 35 additional design partners. The list includes Bank of America, Cloudflare, Mastercard, OpenAI, PayPal, Visa and Zapier.

Those names represent participation in the design process, not announced deployments. Sierra said the companies would contribute feedback from their business perspectives. It also planned design workshops and a reference implementation over the following month, describing the draft as a starting point.

The problem Sierra wants to address is familiar to anyone building agents that act for customers: a purchase or support request can require an agent to sign in as the person and navigate pages built for humans. Poppy proposes a more explicit arrangement. Customers would decide what access to grant, while businesses would set the boundaries on what agents could do.

Sierra illustrates that distinction with a hypothetical jacket return. An agent would identify itself to the retailer, the customer would sign in, and the agent would use the retailer's ordinary returns page. The retailer could permit it to start the return without allowing changes to stored payment details. Recognizing an agent would not mean giving it unrestricted account access.

Under the proposed design, a business would publish a discovery file at /.well-known/poppy.json, telling agents how to interact and how customers can sign in. An agent could begin with a guest session; tasks requiring an account would use OAuth sign-in. Where the business permits it, a session token would give the agent only the access the customer approved.

Sierra says the protocol builds on OAuth, JSON Web Tokens, HTTPS, OpenAPI and MCP, allowing teams to use existing tools. Its proposed integration benefit is that a business could connect once rather than build a separate connection for every personal agent. The same session token would work across the business's website, APIs and its own agent—but each business would choose which of those channels to offer.