What is Personal Agent Protocol (Poppy)?

Personal Agent Protocol, or Poppy, is a draft standard that lets your AI agent handle a task at a company for you, like returning a jacket or moving a flight, signed in to your account without knowing your password. Sierra and Meta announced it in October 2026 with Shopify, Stripe, Walmart, and others. It's version 0.1, so details can still change. Why it exists. Today an agent that acts for you has two bad options. It can click through the company's website like a person, which is slow, breaks when the page changes, and needs your password to sign in. Or it can use an API that each company sets up differently. Either way, the company can't tell a helpful agent from a bot, so it often blocks both. How it works: 1. Your agent finds out what the company offers. It reads a file at a fixed address on the company's site, /.well-known/poppy.json. The file lists the ways in: the website, an API, or the company's own support agent. 2. Your agent says who it is. It names its product and proves it with a digital signature. It also gives the company an ID for you that's different at every company, so the company recognizes you next time, but two companies can't compare notes. 3. You sign in once, on the company's own page. You approve what the agent may do: look things up (poppy:read), or also make changes (poppy:write). The company gives your agent a pass for your account. You can cancel the pass at any time, and the agent never sees your password. 4. Your agent uses that pass everywhere. It can call the company's API, chat with the company's own support agent, or open the website in its cloud browser already signed in as you. If a person needs to step in, the chat can hand off to a person at the company, or to you. MCP connects an AI to one tool. Poppy covers the whole visit to a company: who's asking, for whom, and with what access. A company can list an MCP server as one of its ways in.

Why would I want my AI agent to use Poppy?

Personal Agent Protocol, or Poppy, is a draft standard that lets your AI agent handle a task at a company for you, like returning a jacket or moving a flight, signed in to your account without knowing your password. Sierra and Meta announced it in October 2026 with Shopify, Stripe, Walmart, and others. It's version 0.1, so details can still change. Why it exists. Today an agent that acts for you has two bad options. It can click through the company's website like a person, which is slow, breaks when the page changes, and needs your password to sign in. Or it can use an API that each company sets up differently. Either way, the company can't tell a helpful agent from a bot, so it often blocks both. How it works: 1. Your agent finds out what the company offers. It reads a file at a fixed address on the company's site, /.well-known/poppy.json. The file lists the ways in: the website, an API, or the company's own support agent. 2. Your agent says who it is. It names its product and proves it with a digital signature. It also gives the company an ID for you that's different at every company, so the company recognizes you next time, but two companies can't compare notes. 3. You sign in once, on the company's own page. You approve what the agent may do: look things up (poppy:read), or also make changes (poppy:write). The company gives your agent a pass for your account. You can cancel the pass at any time, and the agent never sees your password. 4. Your agent uses that pass everywhere. It can call the company's API, chat with the company's own support agent, or open the website in its cloud browser already signed in as you. If a person needs to step in, the chat can hand off to a person at the company, or to you. MCP connects an AI to one tool. Poppy covers the whole visit to a company: who's asking, for whom, and with what access. A company can list an MCP server as one of its ways in.

How will my AI assistant sign in to my accounts at other companies?

Personal Agent Protocol, or Poppy, is a draft standard that lets your AI agent handle a task at a company for you, like returning a jacket or moving a flight, signed in to your account without knowing your password. Sierra and Meta announced it in October 2026 with Shopify, Stripe, Walmart, and others. It's version 0.1, so details can still change. Why it exists. Today an agent that acts for you has two bad options. It can click through the company's website like a person, which is slow, breaks when the page changes, and needs your password to sign in. Or it can use an API that each company sets up differently. Either way, the company can't tell a helpful agent from a bot, so it often blocks both. How it works: 1. Your agent finds out what the company offers. It reads a file at a fixed address on the company's site, /.well-known/poppy.json. The file lists the ways in: the website, an API, or the company's own support agent. 2. Your agent says who it is. It names its product and proves it with a digital signature. It also gives the company an ID for you that's different at every company, so the company recognizes you next time, but two companies can't compare notes. 3. You sign in once, on the company's own page. You approve what the agent may do: look things up (poppy:read), or also make changes (poppy:write). The company gives your agent a pass for your account. You can cancel the pass at any time, and the agent never sees your password. 4. Your agent uses that pass everywhere. It can call the company's API, chat with the company's own support agent, or open the website in its cloud browser already signed in as you. If a person needs to step in, the chat can hand off to a person at the company, or to you. MCP connects an AI to one tool. Poppy covers the whole visit to a company: who's asking, for whom, and with what access. A company can list an MCP server as one of its ways in.

Does my agent need my password to act for me?

Personal Agent Protocol, or Poppy, is a draft standard that lets your AI agent handle a task at a company for you, like returning a jacket or moving a flight, signed in to your account without knowing your password. Sierra and Meta announced it in October 2026 with Shopify, Stripe, Walmart, and others. It's version 0.1, so details can still change. Why it exists. Today an agent that acts for you has two bad options. It can click through the company's website like a person, which is slow, breaks when the page changes, and needs your password to sign in. Or it can use an API that each company sets up differently. Either way, the company can't tell a helpful agent from a bot, so it often blocks both. How it works: 1. Your agent finds out what the company offers. It reads a file at a fixed address on the company's site, /.well-known/poppy.json. The file lists the ways in: the website, an API, or the company's own support agent. 2. Your agent says who it is. It names its product and proves it with a digital signature. It also gives the company an ID for you that's different at every company, so the company recognizes you next time, but two companies can't compare notes. 3. You sign in once, on the company's own page. You approve what the agent may do: look things up (poppy:read), or also make changes (poppy:write). The company gives your agent a pass for your account. You can cancel the pass at any time, and the agent never sees your password. 4. Your agent uses that pass everywhere. It can call the company's API, chat with the company's own support agent, or open the website in its cloud browser already signed in as you. If a person needs to step in, the chat can hand off to a person at the company, or to you. MCP connects an AI to one tool. Poppy covers the whole visit to a company: who's asking, for whom, and with what access. A company can list an MCP server as one of its ways in.

How is Poppy different from MCP?

Personal Agent Protocol, or Poppy, is a draft standard that lets your AI agent handle a task at a company for you, like returning a jacket or moving a flight, signed in to your account without knowing your password. Sierra and Meta announced it in October 2026 with Shopify, Stripe, Walmart, and others. It's version 0.1, so details can still change. Why it exists. Today an agent that acts for you has two bad options. It can click through the company's website like a person, which is slow, breaks when the page changes, and needs your password to sign in. Or it can use an API that each company sets up differently. Either way, the company can't tell a helpful agent from a bot, so it often blocks both. How it works: 1. Your agent finds out what the company offers. It reads a file at a fixed address on the company's site, /.well-known/poppy.json. The file lists the ways in: the website, an API, or the company's own support agent. 2. Your agent says who it is. It names its product and proves it with a digital signature. It also gives the company an ID for you that's different at every company, so the company recognizes you next time, but two companies can't compare notes. 3. You sign in once, on the company's own page. You approve what the agent may do: look things up (poppy:read), or also make changes (poppy:write). The company gives your agent a pass for your account. You can cancel the pass at any time, and the agent never sees your password. 4. Your agent uses that pass everywhere. It can call the company's API, chat with the company's own support agent, or open the website in its cloud browser already signed in as you. If a person needs to step in, the chat can hand off to a person at the company, or to you. MCP connects an AI to one tool. Poppy covers the whole visit to a company: who's asking, for whom, and with what access. A company can list an MCP server as one of its ways in.

What does a company need to do to support personal agents?

Personal Agent Protocol, or Poppy, is a draft standard that lets your AI agent handle a task at a company for you, like returning a jacket or moving a flight, signed in to your account without knowing your password. Sierra and Meta announced it in October 2026 with Shopify, Stripe, Walmart, and others. It's version 0.1, so details can still change. Why it exists. Today an agent that acts for you has two bad options. It can click through the company's website like a person, which is slow, breaks when the page changes, and needs your password to sign in. Or it can use an API that each company sets up differently. Either way, the company can't tell a helpful agent from a bot, so it often blocks both. How it works: 1. Your agent finds out what the company offers. It reads a file at a fixed address on the company's site, /.well-known/poppy.json. The file lists the ways in: the website, an API, or the company's own support agent. 2. Your agent says who it is. It names its product and proves it with a digital signature. It also gives the company an ID for you that's different at every company, so the company recognizes you next time, but two companies can't compare notes. 3. You sign in once, on the company's own page. You approve what the agent may do: look things up (poppy:read), or also make changes (poppy:write). The company gives your agent a pass for your account. You can cancel the pass at any time, and the agent never sees your password. 4. Your agent uses that pass everywhere. It can call the company's API, chat with the company's own support agent, or open the website in its cloud browser already signed in as you. If a person needs to step in, the chat can hand off to a person at the company, or to you. MCP connects an AI to one tool. Poppy covers the whole visit to a company: who's asking, for whom, and with what access. A company can list an MCP server as one of its ways in.

Concepts

Personal Agent Protocol (Poppy)

Updated 2026-10-14

Questions this answers

What is Personal Agent Protocol (Poppy)?
Why would I want my AI agent to use Poppy?
How will my AI assistant sign in to my accounts at other companies?
Does my agent need my password to act for me?
How is Poppy different from MCP?
What does a company need to do to support personal agents?

The Fix

Personal Agent Protocol, or Poppy, is a draft standard that lets your AI agent handle a task at a company for you, like returning a jacket or moving a flight, signed in to your account without knowing your password. Sierra and Meta announced it in October 2026 with Shopify, Stripe, Walmart, and others. It's version 0.1, so details can still change.

Why it exists. Today an agent that acts for you has two bad options. It can click through the company's website like a person, which is slow, breaks when the page changes, and needs your password to sign in. Or it can use an API that each company sets up differently. Either way, the company can't tell a helpful agent from a bot, so it often blocks both.

How it works:

Your agent finds out what the company offers. It reads a file at a fixed address on the company's site, /.well-known/poppy.json. The file lists the ways in: the website, an API, or the company's own support agent.
Your agent says who it is. It names its product and proves it with a digital signature. It also gives the company an ID for you that's different at every company, so the company recognizes you next time, but two companies can't compare notes.
You sign in once, on the company's own page. You approve what the agent may do: look things up (poppy:read), or also make changes (poppy:write). The company gives your agent a pass for your account. You can cancel the pass at any time, and the agent never sees your password.
Your agent uses that pass everywhere. It can call the company's API, chat with the company's own support agent, or open the website in its cloud browser already signed in as you. If a person needs to step in, the chat can hand off to a person at the company, or to you.

MCP connects an AI to one tool. Poppy covers the whole visit to a company: who's asking, for whom, and with what access. A company can list an MCP server as one of its ways in.

When to Use It

There's nothing to set up yet. When your agent supports Poppy, use the rule we teach for connectors: allow read access for lookups, and make the agent ask before it changes anything. Read access still shows your account to the agent, so keep sensitive accounts out unless your company's IT and data policies allow it.

Some companies will also let your agent sign in by typing your password for you. Choose the company's sign-in page instead, so you never hand over the password. The pass is still real access, though: a web page can carry hidden instructions that trick an agent into misusing it (prompt injection), so give write access only to agents you trust.

For a company, the first step is publishing poppy.json. Ours lists only our website, because trygradient.ai has no customer accounts for an agent to sign in to. We cover agent permissions in our AI training for teams.