Meta and Sierra Launch Poppy Protocol to Set Permission Boundaries for AI Agents
The open standard requires merchants to publish a specification file clarifying how AI agents connect, how they log in, and what actions they can perform.
Meta and Sierra Launch Poppy Protocol to Set Permission Boundaries for AI Agents
Meta and customer service AI company Sierra have jointly released an open standard called Personal Agent Protocol (Poppy), allowing merchants to set access and operational permissions for AI agents. According to a blog post published by Sierra on October 9, Poppy requires each company to publish a file at a standard web address specifying how agents connect, how customers log in, and what actions agents can perform. Customers can independently decide whether their agents can view accounts, make modifications, or both.
In a demonstration, Meta's Muse agent connected to Rocket's AI agent via Poppy and obtained a mortgage pre-approval letter for a Rocket executive in a short time. Currently, 33 organizations including OpenAI and Visa have joined Poppy as design partners.
The move aims to address the pain point where merchants cannot identify agent identities or the scope of customer authorization when AI agents log in as customers and operate web pages. PYMNTS Intelligence data shows that only 23% of merchants can clearly identify AI-driven traffic. Previously, Amazon cut off Meta's Muse agent in September, highlighting the "block or fully allow" dilemma merchants face without standards.
Source: https://www.pymnts.com/news/artificial-intelligence/2026/meta-sierra-poppy-lets-customers-set-limits-ai-agents/
Provenance & status
- Byline
- OceanAlt Editorial
- First published
- 2026-10-13
- Last updated
- 2026-10-13
- Content type
- Newsflash
- Source material
- View original ↗
Related reading
South Korea's President Confirms AI Role in Attacks on Seven Financial Firms: A Look at the Attack Chain
NVIDIA Open-Sources Agent Security Platform: Another Piece in the Agent Security Infrastructure, from Testing to Deployment
Robinhood Lets AI Agents Trade Without Per-Order Approval — and Clients Bear the Losses
Paste a payee address before you pay and see whether it's on a sanctions list, through a mixer, or tagged for fraud.
This judgement can sit inside your own product
One line of code; it touches neither your CSS nor your JS. The same pre-settlement judgement can appear in your articles, on your wallet's confirmation screen, or as an endpoint your agent calls before it pays.