Meta and Sierra’s Poppy protocol now has a published draft and 35 newly named design partners, including OpenAI, Visa, Mastercard and PayPal. The proposal aims to let businesses recognise when an AI agent is acting for a customer, while giving customers a say over what it can access.
Meta AI Watch analysis
What happened
Poppy, short for Personal Agent Protocol, is an open standard being developed by Meta and customer-service AI company Sierra. PYMNTS reports that Sierra has published a draft and named 35 new design partners, joining six previously announced partners, including Shopify, Stripe and Walmart.
The proposed flow lets an agent begin as a guest, then ask the customer to sign in and choose whether it can view account information, make changes, or both. A live demonstration had Meta’s Muse agent connect with Rocket’s AI agent to obtain a mortgage pre-approval letter. PYMNTS says the protocol does not yet handle payments.
Why it matters
An agent that shops or handles customer service can currently look much like a customer clicking through a website. PYMNTS cites a survey finding that only 23% of merchants can clearly identify AI-driven traffic. A shared protocol could give businesses a way to recognise agents and check what customers have authorised, rather than choosing between blocking them and granting full account access.
That could matter most when an agent moves from browsing to an action with consequences, such as changing an order or handling a financial application. The draft is a proposal, not proof that businesses can already rely on a consistent system across the web.
Our read
The useful idea here is permission before action: let an agent browse, then ask the customer before it reaches into an account. But a roster of design partners is not the same as a working standard adopted across the businesses customers actually use. The draft will need to make consent clear and practical, not just add another acronym to checkout.
What to watch
- Whether the draft becomes a published specification developers can implement.
- How customers can see, narrow or revoke the access they grant.
- Whether businesses adopt Poppy alongside other agent-identification approaches.
- How payment permissions are handled if they are added later.
Discussion spark: Should an AI agent be allowed to make account changes after one broad permission, or should customers approve each consequential action separately?
Sources and evidence
- Meta and Sierra’s Poppy Lets Customers Set Limits for AI Agents – PYMNTS.com (12 October 2026, 19:23 UTC)
not affiliated with, endorsed by, or operated by Meta