Every few years a quiet technical standard changes how an entire industry does business, as SMTP did for email and EMV did for payments. This month Sierra, working with Meta, Genesys, NiCE, Shopify, Stripe, Walmart and others, published a draft of something that could play a similar role for customer experience. It is called the Personal Agent Protocol, nicknamed Poppy, and it describes how a customer’s own AI agent identifies itself to a company, earns permission, and gets work done on that customer’s behalf.
For those of us who have spent careers in contact centers and customer experience, this deserves more than a passing glance, because Poppy is not another chatbot framework and instead addresses the question that every service leader will face within the next two years, which is what happens when the customer arrives with an agent of their own.
What Poppy Actually Is
Poppy is a draft open standard for the relationship between a customer’s personal AI agent and a business. Its guiding principle is that customers decide what access their agents receive, while companies set the boundaries for what those agents are allowed to do. That resolves a tension that has been building all year, since until now companies have faced a blunt choice between blocking third-party agents entirely or handing them full account access. Amazon, for example, blocked Meta’s Muse agent in September, which shows how real the friction has become.
Poppy is built from components the industry already trusts, relying on OAuth, JSON Web Tokens, HTTPS, OpenAPI and the Model Context Protocol, so companies are not asked to adopt exotic new infrastructure. The draft is still moving quickly, with early reporting showing the version shifting between 0.1 and 0.2, and payments, push notifications and attachments remain open topics. Anyone building against it today should treat it as a direction rather than a finished standard.
How It Works and Where It Connects
Poppy has five building blocks. The first is discovery, where a company publishes a single file at a well-known address on its domain, called poppy.json, which tells any agent how to connect, how customers sign in, which scopes are available, and which channels the company supports. The second is the session, in which an agent opens a session on behalf of its customer and identifies itself, and the session can begin as a guest so that the agent can check stock or read a returns policy without anyone logging in.
The third is sign-in, and when a task requires an account, the customer authenticates on the company’s own page through OAuth, and the agent receives a token limited to the access the customer approved, typically read, write, or narrower scopes the company defines. The fourth is continuity, because one session carries across the company’s website, its APIs and its conversational agent, so a cart started in a browser can be finished by an agent without anyone starting over. The fifth is the task channel, through which a company can let agents browse its regular pages, call its APIs through OpenAPI or remote MCP servers, or talk to the company’s own AI agent for conversational work.
Session tokens are bound to the agent’s cryptographic key, so a copied token is useless without it. Each company sees a different pseudonymous customer identifier, which prevents records from being matched across businesses. Access is revocable, and the draft describes a path for the customer’s agent to request a human at the company. The weakest area is a mediated sign-in option where the agent handles credentials directly, which I expect security teams to restrict.
The integration points are where the real work lives. Poppy connects to an existing OAuth authorization server, to the APIs that already power mobile apps, to MCP servers, and to whichever AI agent or virtual assistant a company already runs. It complements MCP, which governs how agents call tools, and sits alongside commerce protocols from Visa, Stripe, OpenAI and Google. The live demonstration at Sierra Summit made the idea concrete. Meta’s Muse agent found Rocket’s mortgage agent, the customer approved access and signed in, the two agents negotiated terms, and a preapproval letter arrived within moments.
Why the Customer Experience Industry Should Care
Genesys chairman and CEO Tony Bates described personal AI as a new front door to the enterprise, and I think that phrase captures the shift precisely. For two decades we have designed experiences around channels the company controls, such as the phone, the chat window, the app and the website. Poppy introduces a channel the company does not control, where the customer’s delegate shows up with intent, authority and patience that never runs out.
The opportunity is considerable when you consider the work customers dread, such as disputing a charge, rebooking a canceled flight, or filing a warranty claim. A personal agent can gather documents, wait through queues, and follow up relentlessly, which means customers may finally resolve issues that today they abandon.
A PYMNTS Intelligence survey of 5,241 consumers found that 56 percent would let an agent search and compare products, and 35 percent would give access to saved payment credentials. The same research found that only 23 percent of merchants could clearly identify AI-driven traffic. That gap between customer willingness and business readiness is where competitive advantage will be won or lost.
Genesys also cited a Gartner prediction that by 2028, 80 percent of organizations will see AI agents consuming most of their APIs, up from under 20 percent in 2026.
The Challenges Contact Centers Will Face
The first challenge is identity and attribution. Every interaction will need to be recorded as an action taken by a specific agent, for a specific customer, within a specific session. When a dispute arises over whether a customer really authorized a cancellation, the logs become the evidence. Teams without structured interaction logging will be unable to answer basic questions in that moment.
The second challenge is the risk that comes with write access. Reading an account is low stakes, while canceling an order or closing a policy is not. An agent acting on an ambiguous instruction can generate a wave of tickets, refund requests and complaints that look like system errors but are really intent errors. Companies will need previews, confirmations for destructive actions, and narrow scopes.
The third challenge is that many APIs are simply not ready. Many enterprise integrations rely on shared keys rather than per-customer OAuth, and retrofitting them is real engineering work. The standards landscape also remains crowded, with Visa’s Trusted Agent Protocol, the Agentic Commerce Protocol and the Universal Commerce Protocol all in play.
The fourth challenge is operational and human. Virtual agents and human agents will increasingly receive requests that originate from another agent, and those requests read differently. They are precise and fast, and they will expose every inconsistency in policy and knowledge content. Personal agents that cannot finish a task on a website may also fall back to chat or phone, so contact centers could see a new category of contact that arrives with delegated authority but still needs a human to resolve an exception. Quality assurance, workforce planning and handle-time metrics were designed for human customers and will need rethinking.
The fifth challenge is fraud and abuse. A protocol that makes it easier for good agents to act also makes it easier for bad actors to impersonate them, so allowlists, revocation, rate controls and monitoring become part of the customer experience toolkit. The public draft does not yet describe audit mechanisms in detail, so companies should not assume the protocol provides them.
How Leaders Should Think About It
The most useful reframing I can offer is that Poppy is a decision about how much of your customer relationship you are willing to conduct through a counterparty you do not own.
Start by separating three questions. The first is whether you will let customer agents in at all, and for which tasks. The second is how much autonomy you will grant, which is a risk decision that belongs to operations, legal and security together. The third is whether you want to participate in shaping the standard. With more than three dozen design partners across banking, airlines, insurance, retail and payments, the people writing the rules are already at the table.
I would also resist the temptation to treat this as a threat to be blocked. Blocking agents may feel safe, yet customers will route around friction. The better posture is controlled openness, where you decide which journeys are agent-ready, grant narrow permissions, and expand as trust is demonstrated.
How to Decide and Prepare
Begin by identifying the five or so tasks your customers perform most often, such as checking order status, changing an appointment, disputing a charge, rebooking or filing a claim. Evaluate each for agent readiness by asking whether it can be completed through a clean API with structured inputs and explicit errors.
Next, expose those tasks as typed and permissioned tools, through OpenAPI or MCP, with separate read and write scopes. Add OAuth sign-in and a visible way for customers to revoke an agent. Require previews and explicit confirmation for anything destructive or financial, and keep payments out of scope until the commerce extensions mature.
Then build the observability to support it. Log every agent action with the customer, the agent and the session identified, and capture outcomes so you can measure whether agent-originated contacts resolve better or worse than human-originated ones. Add a path for escalation to a human and decide in advance which situations demand it.
Prepare your people as well. Train supervisors and quality teams to recognize agent-originated interactions, update knowledge content so that policies are unambiguous, and revisit metrics so that a fast, accurate agent interaction is not mistaken for a problem. Finally, assign a single owner, since this work crosses digital, contact center, security and legal.
Watch the specification rather than betting on it. Sierra plans design workshops and a reference implementation over the coming month, and the draft will keep changing. The smartest move is to invest in the durable foundations, which are clean APIs, strong identity, careful scoping and thorough logging, because those pay off regardless of which standard prevails.
The Opportunity in Plain Sight
Mobile apps, social care and digital messaging each rewarded the organizations that prepared before demand arrived, while late movers spent years catching up. Personal agents are the next entry in that sequence, and Poppy is the first serious attempt to make the relationship between customers, their agents and companies safe, auditable and open.
The question for your leadership team this quarter is not whether customers will arrive with agents. It is whether your organization will be ready to say yes to them, on terms you have chosen, with controls you trust and a human ready when judgment is needed.
