Meta and Sierra Debut Poppy Standard for AI Agent Permissions

Meta and Sierra have launched a draft open standard called the Personal Agent Protocol, or Poppy, designed to let AI agents identify themselves to businesses and give customers control over what those agents can do. Under the framework, companies publish a file on their website that tells agents how to connect, how customers sign in, and what actions are permitted. Sierra said 35 new design partners have joined, including OpenAI, Visa, Mastercard, PayPal, Bank of America and others, according to its blog post.

The protocol aims to solve a growing problem: personal AI agents often sign in as customers and navigate human-facing pages, leaving businesses unable to tell whether an agent is acting or what the customer approved. Companies have had to either block agents or grant full account access. Amazon blocked Meta's Muse agent in September, PYMNTS reported.

Poppy lets an agent begin as a guest, which might be enough to check stock or ask about a return policy, according to Sierra. If an account is needed, the customer signs in through the company's own page. The same session then carries across the company's website, APIs and customer service agent, and the customer chooses whether the agent can view the account, make changes or both.

At the Sierra Summit, Rocket demonstrated Poppy for a mortgage preapproval. Rocket VP Alex McGillis asked Meta's Muse agent to get him preapproved; Muse found Rocket's AI agent, requested permission to connect, and McGillis signed in to share credit and income details. The two agents worked through purchase price, down payment and interest rate, and McGillis received a preapproval letter within moments.

Adoption is still early. Only 23% of merchants can clearly identify AI-driven traffic, according to a July PYMNTS Intelligence report with Visa Acceptance Solutions that surveyed 1,185 merchants in the U.S., Brazil and UAE. A September PYMNTS Intelligence report found nearly 132 million U.S. adults have made a retail purchase with AI assistance. The July report also found that 56% of 5,241 consumers would let an agent search and compare products, while only 35% would give one access to saved payment credentials.

Poppy doesn't handle payments yet. Sierra has listed payments extensions on its roadmap that would allow an agent to make a purchase without sharing card details, according to a separate blog post. Visa and Mastercard, now Poppy design partners, have built their own agent-identification frameworks, Trusted Agent Protocol and Verifiable Intent, and in September began working with Ant International on a shared framework for identifying AI agents, PYMNTS reported. Stripe Head of Payments Kevin Miller said in the blog post that a customer relationship doesn't begin or end at checkout.