Poppy draft lands with 45 partners, forcing small…

Meta and Sierra's Personal Agent Protocol asks every company to publish a poppy.json. Owners who skip it hand the choice to a default.

Sierra co-founders Bret Taylor and Clay Bavor published Draft 0.1 of the Personal Agent Protocol on Friday, Oct. 9, naming 35 new design partners and bringing the total committed since the Oct. 6 Sierra Summit launch to 45. The practical ask is small and consequential: every business is expected to host a poppy.json file at /.well-known/poppy.json declaring which tasks a verified personal agent may perform on a customer’s behalf, with OAuth-scoped sign-in, DPoP-bound session tokens that expire in roughly an hour, and a longer-lived Account Token for resumption.

The partner list reads like a payments-and-commerce whip count. Visa, Mastercard, PayPal, Plaid, Bank of America, Wells Fargo, BBVA and Chime on the money side. Target, Nordstrom, Gap Inc., United Airlines, Hertz, Cigna, GEICO and Liberty Mutual on the merchant side. Cloudflare, Okta, Zendesk, Klaviyo, Notion, Zapier and 1Password filling in the infrastructure. OpenAI is in. So is Meta, whose Muse agent launched Sept. 8 and, per Meta’s David Singleton to CNBC, reached millions of U.S. users within a month before Amazon cut it off on Sept. 20 over undisclosed access and credential storage. Poppy is the standards response to that fight.

Two competing stacks already exist: Google’s Universal Commerce Protocol, which went live in January with Shopify, Etsy, Wayfair, Target and Walmart, and the Stripe-OpenAI Agentic Commerce Protocol routing through ChatGPT.

BBVA’s David Puente framed the bet plainly: a “common protocol lays the foundation for an open and interoperable ecosystem that protects our customers’ privacy and allows them to remain in control.”

The merchant-side numbers explain the urgency. A July PYMNTS Intelligence report with Visa Acceptance Solutions, surveying 1,185 merchants in March across the U.S., Brazil and the UAE, found just 23% can identify AI-driven traffic. A separate September report put nearly 132 million U.S. adults as having already made an AI-assisted retail purchase. In a July PYMNTS survey of 5,241 consumers, 35% said they’d hand an agent their saved payment credentials.

Liat Ben-Zur of LBZ Advisory, formerly a Microsoft corporate vice president, captured the shift: once an agent can prove whom it represents, refusing it’s “a commercial decision,” not a security one. That’s the inflection. The agent channel is already the invisible first step in a customer’s buying journey, and Poppy turns a passive silence into an active policy. Design workshops and a reference implementation are promised within a month. Businesses that don’t publish a file will still have one written for them, by default, by somebody else’s inference.

Poppy draft lands with 45 partners, forcing small businesses to decide what agents can do

Sources