Shopify enables Poppy across stores as Sierra releases version 1.0
Automatic discovery gives personal agents a new store entry point, but merchants still need to test permissions and measure whether it brings customers.
Sierra released Personal Agent Protocol version 1.0, known as Poppy, on November 13, saying every merchant on Shopify’s platform now automatically publishes a discovery file without additional implementation.
Sierra reported 60 design partners joining, bringing the total above 100, including Intuit, Salesforce and Zoom. For merchants, discovery isn’t checkout: Sierra says Poppy introduces an arriving personal agent and describes available interactions; Shopify’s existing Universal Commerce Protocol (UCP) handles product discovery, carts and checkout.
According to Sierra, Shopify co-authored a commerce extension supporting guest shopping, customer-account sign-in and customer approval before certain actions. It connects to UCP Ask, letting shoppers’ agents talk directly to stores’ agents.
The specification places the discovery document at /.well-known/poppy.json, containing a protocol version, organization details and at least one channel: an agent, APIs or a website. Session identity doesn’t authorize customer-account access. Account access uses OAuth; signed-out APIs need no OAuth server. Without a browser-session endpoint, agents browse as ordinary signed-out visitors unless browser access is disabled.
The Next Web flags a qualification: despite the 1.0 release, the specification labels itself draft 1.0. It also references release candidate 0.4 and allows fixes that aren’t backward compatible.
Ora says its protocol checker evaluates 49 requirements with at most six requests to company endpoints, following discovery, sign-in metadata, APIs and conversation endpoints. It never signs in, joins a session or sends a token. That limits what a check can establish about account-authorized shopping.
Approval boundaries appear in implementations. Descope says GoFundMe and GoodRx implemented Poppy with Envoy; GoFundMe keeps donors distinct from agents, with donors approving donations from their phones. Sierra says Mercury lets agents check balances and initiate payments or transfers, but requests must pass account approval policy before money moves. Turkish Airlines, Sierra says, lets agents retrieve bookings with a reference number and surname and find business-class upgrades that customers approve before paying.
Sierra also says Meta’s Muse now looks for Poppy first on every site it visits. That establishes discovery behavior, not additional Shopify traffic or sales. Like OpenAI’s verified business agents in ChatGPT, the development raises a customer-discovery question rather than proving an acquisition channel.
For small-team Shopify owners, the practical next step is to test which product, account and shopping actions agents can discover and complete, review customer permissions, and track agent-referred visits and orders separately before changing acquisition plans. Automatic availability isn’t evidence of customer demand.
Sources
— END —