Sierra's announcement reports no Poppy traffic, no completed transactions and no rival agent using the protocol, so the 1.0 release shows how far Poppy could spread, not how much it is used.
Summary
On November 13, 2026, Sierra released version 1.0 of Personal Agent Protocol (Poppy), a spec for how a personal agent identifies itself to a company and finds out what it is allowed to do. Shopify now publishes a Poppy file for every merchant, and Meta's Muse agent looks for Poppy first on every site it visits. Mercury, Synchrony and Turkish Airlines are named as going live, though Sierra describes Synchrony's work as exploratory. Our read: the two defaults give Poppy unusual reach on day one. Whether that turns into real usage, or into a standard that more than one consumer agent reads, has not yet been shown.
What happened
Bret Taylor and Clay Bavor announced Poppy 1.0 on Sierra's blog after five weeks in which design partners tested the drafts against real websites, APIs and agents. The protocol tells a personal agent how to connect to a company that implements it. It then points the agent to the company's existing interfaces: business agents, websites, OpenAPI specs and MCP servers. Customers grant and revoke what their agent may do through OAuth. Compared with the draft, version 1.0 lets companies adopt in stages, refines how it uses existing standards, gives companies more ways to guide agents and collect feedback from them, and adds extensions. The first extension covers commerce and was co-authored by Shopify. It links Poppy to the Universal Commerce Protocol (UCP). Poppy handles an agent's arrival, identity and permissions; UCP handles carts and checkout. The extension also makes the agent ask the customer before certain actions, and through UCP Ask it lets a shopper's agent talk directly to the store's agent. Sierra ships an implementation kit with a validator.
The adoption figures come in three layers of very different strength. The broadest is a list: 60 new design partners, bringing the total above 100, including Salesforce, Delta Air Lines, Intuit, Twilio and Wayfair. Next come two defaults. Shopify auto-publishes a Poppy file for every store, and Muse checks for Poppy before anything else. The narrowest layer is named live use. Mercury lets agents check balances and start transfers, which go through the account's approval policy. Turkish Airlines lets agents check fares and find business-class upgrades, which the customer approves before paying. Synchrony's work is described as exploring how agents could bring financing into shopping, not as a live flow. The announcement gives no session counts, no transaction volumes and no share of Muse visits that find a Poppy file. It names no consumer agent other than Muse that reads the protocol.
What the archive adds
New Runtime's earlier coverage helps place Poppy among the other agent protocols. Google and Shopify co-developed the Universal Commerce Protocol (UCP), which Shopify described as an open protocol for agent-to-merchant transactions. Google says UCP covers discovery, checkout and post-purchase steps and can integrate through APIs, A2A or MCP. Shopify and Coinbase separately published a commerce payments protocol on Base. OpenAI's Agentic Commerce Protocol documentation focuses on checkout and delegated payments, with payment requests carrying limits such as a maximum amount and an expiry. Poppy's own documentation calls it a connection and authorization layer: agent identification, pseudonymous user identity, sign-in and access limited to agreed permissions. It says Poppy is not a shopping or payment protocol. So Poppy sits underneath UCP and ACP rather than competing with them. MCP is the closest governance precedent: its maintainers published a formal governance model in July 2025, after adoption had spread well beyond the company that wrote it. In the same week as Poppy 1.0, Shopify published engineering posts on Cyber Chaos Monkey, an agent system that attacks Shopify's own production infrastructure under strict runtime controls, and on a generative model serving both search and recommendations. Earlier New Runtime notes, on October 22 and 23, 2026, covered Shopify's task-expert open models and its Remote Dev environment for agents.
Trend signal
Agent protocols are splitting into layers: tool access (MCP), agent-to-agent messaging (A2A), the shopping flow (UCP), payment authorization (ACP and similar), and now arrival, identity and consent (Poppy). A recurring pattern decides which formats spread. A format gets traction when a large host emits it automatically and a large client reads it by default, because each side then has a reason to keep supporting it. Poppy has both halves on day one. That is rare, and it matters more than the partner count. The pattern has a second step, though, and Poppy has not taken it yet. A default pair becomes a standard only when clients beyond the first one start reading the format. Until then, a protocol that is open on paper can still be tuned in practice to one consumer agent. Sierra's own pitch to implementers names Muse as the agent whose users benefit.
Why now
First, Meta wants Muse to act inside company systems rather than browse their pages, and Sierra's announcement says Muse checks for Poppy first on every site. That gives the protocol a default reader. Second, every Shopify store already supports UCP by default, and Shopify co-authored the commerce extension linking UCP to Poppy. Auto-publishing Poppy files therefore cost merchants nothing and gave the protocol a default supply. Third, five weeks of partner testing let Sierra add staged adoption and a validator, which makes it cheap for companies outside Shopify to try. Fourth, Sierra sells business-side agents, so writing the protocol those agents speak is commercially useful to it (our inference, not a stated motive).
Connections to other events
Here is what each party stands to gain, labeled as incentives rather than stated motives. Meta gets a structured, permissioned way into Shopify stores and into partners such as Mercury and Turkish Airlines. That beats having Muse scrape pages with a browser. Shopify gets to set the terms on which outside agents arrive: its commerce extension makes the agent ask the customer before certain actions and can route the agent to the store's own agent through UCP Ask. Sierra, which sells business-side agents and reported more than $400 million in annual recurring revenue on October 30, gets to shape the conversations its products will take part in. Axios reports that Nvidia is buying $3 billion of Meta's stock offering alongside expanded work on Muse, so it has a reason to want Muse used more. Nothing in either announcement ties that deal to Poppy, and we do not treat it as a cause.
What the defaults actually establish is reach. Every Shopify store now has a file a Muse visit can find. Reach is not the same as use or control. The announcement reports no Poppy traffic, no completed transactions and no other agent reading the files, and one of the three named live partners is still exploring. Our read: Poppy 1.0 is best described as a distribution arrangement waiting for usage evidence. The 100-partner list is an option on future integrations. The two defaults are what is switched on today.
Why it matters
For Shopify merchants, the file already exists, so the decision is no longer whether to adopt. The work is checking what the generated file exposes and what approval prompts the agent will trigger. For companies outside Shopify, Poppy is cheap to try because it points to OpenAPI and MCP interfaces they may already run. Today, though, the only named consumer agent reading it is Muse, so buyers should treat implementation as serving one agent, with an option on others.
The strongest counterargument is interoperability. Poppy reuses OAuth, OpenAPI, MCP and UCP. It is published as an open repository with schemas and a validator. More than 100 companies across finance, travel and software have signed on, including Salesforce and Stripe. On this view, the defaults are just how it was bootstrapped, and rival agents will read the files because doing so costs them little. That case is credible, and the evidence for it is still missing. Four observable things would settle it: a production client from a vendor other than Meta, traffic figures showing non-Muse agents, reported transaction counts, or governance moving to a body independent of Sierra and Meta. Until one of those appears, the reach is real and the standard status is a claim.
What happens next
- No consumer agent from OpenAI, Google or Anthropic will be documented as a production Poppy client within three months, leaving Muse as the only named default reader. (3 months, 65%). Watch for: A Sierra post or an OpenAI, Google or Anthropic docs page saying ChatGPT, Gemini or Claude checks for Poppy files on company sites. Resolves on 2027-02-14, yes if: As of 2027-02-14, neither the personal-agent-protocol/personal-agent-protocol GitHub repository README nor any official OpenAI, Google or Anthropic blog or docs page states that its consumer agent reads Poppy files in production.
- Sierra will name at least one more company as live with Poppy, beyond Mercury, Synchrony and Turkish Airlines, within three months. (3 months, 70%). Watch for: Partner press releases or Sierra blog posts describing production Poppy integrations. Resolves on 2027-02-14, yes if: By 2027-02-14, a post on the Sierra blog (sierra.ai/blog) names at least one company other than Mercury, Synchrony, Turkish Airlines and Shopify as live with Poppy.
- Poppy governance will not move to a foundation or independent body within three months. (3 months, 80%). Watch for: An announcement from Sierra or Meta of a steering committee or foundation hosting for Poppy. Resolves on 2027-02-14, yes if: By 2027-02-14, no announcement on sierra.ai, personalagentprotocol.org or linuxfoundation.org states that Poppy has been transferred to a foundation or independent governance body.
Limits and uncertainty
Sierra's announcement gives no traffic, session or transaction figures, and no share of Muse visits that find a Poppy file or fall back to browsing pages. Governance terms are unpublished: who can change the core spec, and whether a foundation is planned. One third-party post on X claims OpenAI and Visa have lined up behind Poppy. If OpenAI's consumer agent actually reads Poppy files, our narrower reading weakens considerably, and nothing we have seen settles that. The incentives described for Meta, Shopify, Sierra and Nvidia are our inferences, not stated motives. Shopify's security and discovery results are its own unaudited figures. We use them only to illustrate the company's capabilities, not to measure anything about Poppy. Our forecasts on rival adoption rest on judgment, not on New Runtime's archive base rate. That base rate measures follow-on access or pricing changes, not rival-client adoption.
Competing readings
- Poppy 1.0's significance is distribution potential: Shopify supplies the files and Muse reads them by default, but usage, transactions and multi-agent support are not yet shown (likely, about 55%). What would tell it apart: The switched-on adoption is Shopify's automatic file plus Muse checking first (sierra.ai); Sierra's pitch names only Muse as the benefiting consumer agent (sierra.ai); Only three partners are named as going live, and one is exploratory (sierra.ai).
- Poppy is already a neutral interoperability standard; its reuse of OAuth, MCP and UCP and its 100-plus partners will pull in rival consumer agents quickly (unlikely, about 30%). What would tell it apart: More than 100 design partners across finance, travel and software (sierra.ai); Poppy is narrowly scoped to identity and permissions and composes with UCP, which lowers the cost for rival agents to read it (sierra.ai).
- Poppy is mainly a vehicle for Sierra's business-agent sales, and adoption will stall at the partner-list stage (very unlikely, about 15%). What would tell it apart: Named live use is thin, and Synchrony is still exploring (sierra.ai).
Base rate
Of 79 earlier release stories about companies, products or standards in the New Runtime archive over the last 12 months that are at least 3 months old, 69 (87%) were followed within 3 months by a access-change or pricing story on the same company or product line. In 69 of 79 earlier release stories, an access-change or pricing story on the same product line followed within 3 months. That supports expecting more live partners or changed access terms for Poppy soon. It says nothing about whether a rival consumer agent will adopt it, so we do not use it for that question.
What would change this view
- OpenAI, Google or Anthropic documents that its consumer agent reads Poppy files in production (model-listing signal): Demand would no longer depend on Muse, and Poppy would be a working multi-vendor standard.
- Poppy governance moves to a foundation or steering body independent of Sierra and Meta (open-source signal): Control of the spec would be spread out, weakening the reading that two platforms set its course.
- Sierra or Shopify publishes Poppy traffic or transaction figures showing substantial non-Muse agent use (signal): Adoption would be real usage, not just distribution potential.
Skill to build now
Learn to audit and test permissions for agents acting on a customer's behalf. First exercise: fetch the Poppy file actually published for your domain (Shopify generates one automatically) and run Sierra's validator against it. List every action it exposes and sort each into three buckets: agents may do it freely, the customer must approve it first (Turkish Airlines' approve-before-paying upgrade flow is a useful model), or agents may never do it. Then, against a test shop or sandbox account only, never live customer data, have an agent attempt one action from the approval bucket. Confirm it pauses for consent and that refusing consent leaves nothing changed.
Reader takeaway
If you run a Shopify store or a customer-facing API, fetch the Poppy file actually published for your domain this week and run Sierra's validator against it. Do not assume the auto-generated defaults match your policies. Then test approval behavior against a test shop or sandbox account: try one action that should need customer approval and confirm the agent asks before acting. Count the 100-partner list as demand only once a consumer agent other than Muse is shown reading the file.
Open question
When a shopper's Muse talks directly to a store's agent through UCP Ask, whose ranking wins when they conflict: the merchant's discovery model or Meta's agent acting for the shopper? And would Poppy's permission prompts make that conflict visible to the customer?