AI Agents Need Permission Too: What the New Poppy Protocol Means for Ecommerce Sellers

AI shopping agents have a basic identity problem.

Today, an agent often reaches a business the same way a person does: it opens a website, signs in, reads pages, clicks buttons, and tries to complete a task through an interface built for humans.

That creates immediate questions for the merchant:

• Is this traffic a customer, a bot, a scraper, or a legitimate agent acting for a customer?
• Who authorized the agent?
• What is it allowed to read?
• What is it allowed to change?
• How can that access be revoked?

Sierra and Meta are trying to answer those questions with the Personal Agent Protocol, a draft standard nicknamed Poppy.

Sierra published draft 0.1 on October 9, 2026. The design effort includes Shopify, Stripe, Walmart, OpenAI, Visa, Mastercard, PayPal, Cloudflare, Klaviyo, Target, 1Password, and dozens of other companies.

What Poppy is trying to fix

The core problem is that a personal AI agent should not need to impersonate its user just to interact with a business.

Poppy proposes a more explicit relationship:

customer → personal agent → identified connection → business → scoped permission

The current draft uses an OAuth-style authorization model. A business can advertise how agents should connect, the user can authenticate, and the relationship can move from guest access to authenticated read or write access.

That is a much cleaner model than giving an agent a password and hoping it behaves.

For ecommerce, identity and authority are separate problems

An agent being recognized does not automatically mean it should be allowed to act.

Identification answers: Who or what is this?

Authorization answers: What may it do?

Those two questions should stay separate.

A shopping agent may be allowed to read product information without being allowed to edit an account. It may be allowed to read an order without being allowed to cancel it. It may be allowed to prepare a return without being allowed to issue a refund.

This is the same operating principle we explain in Capability Is Not Permission in Ecommerce Automation.

The protocol is still a draft

Poppy is not a finished ecommerce standard.

The published roadmap still lists unresolved areas including payments, push notifications, attachments, and finer-grained permissions.

That matters because ecommerce is full of actions that are not simply “read” or “write.”

A write could mean changing an address, submitting a return, placing an order, cancelling an order, changing a subscription, or starting a financial transaction. Those actions should not necessarily share one permission level.

So sellers should view Poppy as an important direction, not a finished merchant implementation checklist.

Why this matters now

The web is already struggling with unidentified shopping agents.

Meta’s Muse has run into sites that block or challenge its traffic, while Amazon has explicitly objected to outside agents accessing its consumer experience without an approved integration.

At the same time, Shopify is moving the other direction by exposing structured product and checkout pathways to a broader ecosystem of agents.

Read our related coverage:

• Why Websites Are Blocking Meta Muse — and Why Ecommerce Needs a Better Way to Identify AI Shoppers
• Shopify Is Opening Its Product Catalog to AI Agents. Is Your Store Ready to Be Shopped by Software?
• Shopify Just Let Browser AI Agents Complete Checkout. What Merchants Need to Know.

What an independent merchant should want from any agent standard

1. Agent identity. The business should know an automated agent is involved.
2. User identity. The business should know which customer authorized the relationship when authentication is required.
3. Scoped access. Product browsing, order reading, account changes, and purchases should not all be one permission.
4. Revocation. The customer or business should be able to terminate access cleanly.
5. Approval boundaries. Consequential actions should still stop for confirmation where appropriate.
6. Auditability. The business should be able to tell what the agent requested and what actually happened.
7. Human handoff. When the automated path cannot safely continue, the user needs a clear way to take over.

This is not just a technical issue

Merchant teams will eventually need policy decisions too.

Will you allow unidentified browser agents?

Will authenticated agents be allowed to access order history?

Can an agent start a return?

Can it place an order if the buyer has previously approved a payment method?

Which actions always require fresh confirmation?

Those are business-governance decisions before they are coding decisions.

Use the right Nyansa Hub resource for the job

If you are deciding whether an AI connection is safe enough to allow into a live ecommerce system, start with the 12-Point AI Agent Safety Checklist.

If an automation already exists and you want to inspect its controls, use the Ecommerce Automation Safety Audit.

If agent access is becoming a recurring operational concern, use the Safe Ecommerce Automation Toolkit.

If you are implementing agent permissions, verification, and recovery in software, use the Safe Ecommerce Automation Coding Build Kit. For the complete governance-to-implementation path, use the Safe Ecommerce Automation & Coding Bundle.

The bigger shift

The future of agentic commerce probably cannot depend on AI agents quietly pretending to be human shoppers.

Businesses need to know when an agent is present. Customers need to control what that agent may do. Platforms need an explicit path for permission, revocation, and accountability.

Poppy is one of the clearest attempts yet to formalize that relationship.

For ecommerce operators, the practical lesson is already usable: identify the agent, authenticate the user when needed, and make authority explicit before the action occurs.

Sources and context: Sierra’s October 9, 2026 Poppy draft announcement and the Personal Agent Protocol roadmap. Poppy is currently a draft and may change substantially before a stable release.