Sierra announced the release of Personal Agent Protocol 1.0, known as Poppy, on November 13, 2026. The protocol defines how a person’s AI agent connects to a business through its website, APIs or business agent. For universities evaluating AI tools for research, the relevant distinction is between discovering a service, identifying an agent and authorizing access to an account.
What Sierra announced
In its release announcement, Sierra said Shopify had enabled Poppy across its merchant platform and that Meta’s Muse agent now looks for Poppy when visiting websites. These are Sierra’s deployment statements.
The company described staged implementation, additional guidance and feedback capabilities, and a commerce extension developed with Shopify. This follows Sierra’s October 9 draft announcement; the November development is the 1.0 release and associated rollout announcement.
The examples have different availability states. Sierra described Mercury account-information functions and Turkish Airlines booking lookups as available. It described Synchrony’s shopping and financing work as exploratory, while completing an airline purchase within the conversation remained under development.
The specification separates identity from account access
The official specification identifies itself as version 1.0. It separates three functions that matter when assessing an agent-connected service:
- Discovery: a business publishes a poppy.json file at a defined address to describe its available channels and sign-in options.
- Session identity: a signed session message identifies the personal agent and a pseudonymous user, connecting activity across supported channels.
- Account authorization: OAuth provides the user’s approved access to the business account. A session can exist without that account access.
The business chooses which channels and capabilities it offers. A discovery file therefore does not establish that every possible task is supported. For research offices comparing the release with the wider AI agent standards landscape, Poppy supplies a concrete interface specification whose implementation scope still matters.
Sierra’s announcement is dated November 13. The project’s changelog separately dates publication of the frozen 1.0 specification to November 14, 2026. The announcement date and specification publication date should therefore be distinguished.
The changelog records changes from the 0.4 release candidate that can require implementers to revise their software. Among them, consent pages must list all permissions being granted, including previously granted permissions. It also clarifies that successful discovery checks identify the publishing domain; they do not establish that the domain belongs to the company whose name appears in the file.
What the release means for research institutions
For university teams evaluating delegated agents, the practical implication is that connectivity, account permissions and institutional authorization need separate consideration. An agent’s ability to connect to a supplier does not itself establish who within a university may approve the resulting action. That is an institutional governance question alongside the technical integration, relevant to broader discussions of governance for agentic AI.
The release gives researchers a versioned specification to examine and research offices a more precise way to ask what a proposed integration actually enables. The announced merchant rollout should not be read as evidence that every service exposes the same capabilities.
Sources
- Sierra: Releasing Personal Agent Protocol 1.0, November 13, 2026. Checked 2026-11-14.
- Personal Agent Protocol: version 1.0 specification. Checked 2026-11-14.
- Personal Agent Protocol: changelog, version 1.0 entry dated November 14, 2026. Checked 2026-11-14.
- Sierra: Sharing a draft of Personal Agent Protocol, October 9, 2026. Checked 2026-11-14.
