Sierra releases Poppy agent-protocol draft and adds 35 design partners

AI company Sierra published a draft of its Personal Agent Protocol, called Poppy, on October 9, 2026, and named 35 more companies that will take part in the design process. Sierra had announced the project on October 6 with Meta, Genesys, Instinct, NiCE, Rocket, Shopify, Stripe and Walmart. The new list includes Adyen, Bank of America, Cloudflare, Mastercard, OpenAI, PayPal, Visa and Zapier. Sierra says they will contribute feedback from their own business perspectives.

The draft addresses a practical problem. Sierra says that today a personal agent asked to buy something or resolve an issue often has to sign in as the customer and work through pages built for people, and businesses have no standard way to guide it. Poppy proposes that customers decide what access an agent receives, while companies set what agents may do.

Sierra describes five building blocks. A company publishes one file at /.well-known/poppy.json telling agents how to interact and how customers sign in. An agent starts a session, possibly as a guest, and identifies itself. When an account is needed, the customer signs in through OAuth, and, if the company permits it, the agent then acts with a session token limited to the access the customer approved. The same token is meant to work across the company's website, APIs and its own agent. Companies choose which of those channels to offer.

Sierra says Poppy builds on OAuth, JSON Web Tokens, HTTPS, OpenAPI and MCP, so teams can use existing libraries. It says companies could connect once rather than build a separate integration for each personal agent. Sierra positions Poppy as complementary to the Universal Commerce Protocol, which focuses on shopping, and says Poppy covers identity, permission and work across any kind of task.

What is confirmed is limited to Sierra's own statements: the draft exists, the partner names were published, and workshops plus a reference implementation are planned over the next month. This article relies on that single company source. Other coverage reviewed restates Sierra's announcement; no independent reporting was found. A design-partner role is not a commitment to deploy, and Sierra has not shown that these companies will adopt the protocol. The effectiveness of its security model also remains untested outside Sierra's description.

Sierra argues that personal agents are taking on more work and that businesses lack a standard way to recognize and guide them. Whether Poppy becomes that standard will depend on implementations, which are still to come.

Revised 16 October 2026: Guth re-read the original sources and rewrote this article. Correction: the earlier version said the ability to connect once through Poppy, instead of building a separate connection for each personal agent, was a proposed benefit for AI builders and a central design goal. Sierra's post says companies can connect once through Poppy, and does not call it a central design goal. The earlier version remains available as revision 1.