Poppy 1.0 was released on November 14. Sierra announced that version 1.0 of the Personal Agent Protocol (Poppy) is now live, enabled by default for every Shopify merchant and for all users of Muse, Meta's AI agent. The problem it tackles is specific: when a personal agent acts on your behalf, it and the businesses it deals with have shared no common language — Poppy is version 1.0 of that language.
Sierra launched Poppy in October with founding design partners including Meta, Shopify, Stripe, and Walmart, and over the past five weeks the partners tested drafts against real websites and agents. The protocol reuses existing standards — MCP, OpenAPI, and UCP — with OAuth for authentication, so users control what their agents can and cannot do and can manage permissions at any time. Sixty more companies joined in this round, bringing the total past 100.
Shopify Is In Everywhere, With No Extra Work for Merchants
Every Shopify store in more than 175 countries and regions supports the Universal Commerce Protocol (UCP) by default, and each store now automatically publishes a Poppy file — no extra development needed. UCP handles the shopping itself — finding products, filling carts, checking out — while Poppy handles what comes before: the agent introduces itself when it arrives and confirms what it is allowed to do. The commerce extension between them was co-authored by Shopify: an agent can shop as a guest or sign in with the customer's account, must ask the customer first before sensitive actions, and can talk directly to the store's agent through UCP Ask.
Banks and Airlines Are Already Live
Three design partners are already live. Mercury lets banking customers have their personal agent check balances, review transactions, categorize spending, manage budgets and receipts, and even initiate payments or transfers — but only after the request clears the account's approval policy. Synchrony is bringing financing and rewards into agent-led shopping, across more than 500,000 merchant locations. Turkish Airlines lets a personal agent check fares, flight status, and connections, pull up a booking with a reference number and surname, and help Miles&Smiles members find business-class upgrades, with the customer confirming before paying; the eventual goal is to complete a purchase without leaving the conversation.
Users Still Hold the Switch
The protocol leaves control with the user: an agent's permissions are granted by the customer, OAuth handles identity, and the scope of access can be adjusted at any time. Sierra's argument is that as agents take on more everyday tasks, companies need a clear, secure way to work with them without losing user trust. For companies, 1.0 lowers the bar — adoption can happen in stages, starting with basic capabilities; for users, change is gradual: only merchants that adopt Poppy can have their agents act by the rules.
Two things are worth watching next: how many of the 100-plus design partners go live soon, and whether Muse users actually feel a difference in everyday browsing. A protocol alone guarantees no experience — rollout speed and merchant coverage are what matter.
