Personal Agent Protocol: what Shopify merchants should know

Personal Agent Protocol is a proposed open standard for how a customer’s AI agent identifies itself and acts with a business. Meta and Sierra announced it on 6 October, with Shopify, Stripe, Walmart, Genesys, Instinct and Rocket participating.

For store owners, the question is practical: how should an assistant get permission to look up an order or request a change? Sierra’s announcement outlines a shared approach.

Poppy draft published on 9 October

Sierra has released the first draft and added 35 design partners, including OpenAI, Visa, Mastercard and Klaviyo. Participation in the design process should not be read as a completed merchant rollout.

The draft describes discovery through /.well-known/poppy.json, followed by sessions and customer-authorised access. Businesses can offer a website, APIs or their own agent as the route for a task. Sierra describes Poppy as complementary to UCP: it deals with agent identity and permission across tasks, while UCP focuses on commerce.

The Draft 0.1 introduction says companies choose allowed agents, channels and access, while users choose whether an agent can view or change their account. Access can be revoked. These controls are useful criteria for evaluating a returns or support integration; they are not evidence that your existing app has implemented them.

How access would work

An agent could begin as a guest, then move to authorised account access. Customers choose read or write permission; businesses decide which routes they offer. OAuth sessions would carry across websites, APIs and company agents. MCP and OpenAPI are named as possible API routes.

Questions to put to your app providers

Our recommendation is to start with a short list of customer tasks, rather than commission an integration from an announcement. Checking delivery progress, changing an address and requesting a refund deserve different permissions and review rules.

Ask your support and returns providers how they would record the customer’s approval, restrict an agent to the intended order, revoke access and handle an incomplete request. Use these questions to assess a provider’s implementation against the published draft; a specification alone does not establish what an individual app supports.

Keep ordinary customer service usable while assessing any proposal. A shopper should have a clear route to resolve a mistaken action or reach a person. Test a small, reversible workflow before considering actions that move money or alter subscriptions.

What to watch next

In its 9 October update, Sierra said design workshops and a reference implementation would follow over the next month. The protocol remains a draft; implementation details may change.

Compare the draft’s requirements with the apps your store uses. A partnership announcement alone is not a deployment plan or evidence that a particular merchant can enable it.

Sierra’s original announcement, 6 October 2026. Read the post on X.

For work you can do now on product information and channel access, see our Shopify agentic commerce merchant checklist.