Sierra published a draft on October 9, 2026 that aims to identify personal AI agents to businesses and limit their account access. Bret Taylor and Clay Bavor introduced the Personal Agent Protocol, or Poppy, developed with Meta. The specification is labeled Draft 0.1.
The draft separates read and write permissions for customer accounts. Businesses can offer narrower scopes and must enforce them across websites, APIs and company agents. The technical description uses OAuth and short-lived session tokens, with cryptographic proof of possession for certain interfaces. These requirements do not generally guarantee that an agent stays within its task.
An optional Operations extension separates a proposed action from execution. Confirmation covers a specific revision of the terms, and retries are intended not to repeat the same business action. An earlier user permission can suffice if it covers the company, account, action and every term. It cannot substitute for fresh approval when the business explicitly requires that.
The extension states its own trust boundary: confirmation records which agent claimed to have user approval. It does not prove that the user actually saw or approved the terms. Businesses needing that evidence can ask the user to approve on their own website; the extension does not define this additional step.
Sierra plans workshops and a reference implementation over the next month. The release therefore describes a concrete technical proposal, not independently verified protection. Named design partners are expected to provide feedback; appearing on that list establishes neither production adoption nor a separate safety commitment from each business.