Agent Access Is Becoming Standard. Brand Choice Remains Unmeasured.

Personal Agent Protocol gives agent access and much of task execution a common technical framework. It says nothing about how an agent decides which business to approach. Sierra and Meta announced the protocol on 6 October 2026, with Genesys, Instinct, Rocket, Shopify, Stripe and Walmart as development partners. The specification is draft 0.1 under the Apache 2.0 licence, and its authors state that any part of it can still change.

In our earlier article, Chosen, Then Blocked: The Three Gates of Agentic Commerce, we described the path a brand must clear when an AI agent acts for a customer. Access asks whether the agent can reach the brand. Choice asks whether the agent selects the brand. Execution asks whether the agent can complete the task once it arrives. Poppy, as the protocol is known, addresses Access directly and much of the interaction behind Execution. Choice happens before the protocol begins.

Access becomes published policy

Under Poppy, a company publishes a file at /.well-known/poppy.json. It names the organisation and points to the company's sign-in server and whichever interfaces it chooses to offer: OpenAPI or MCP APIs, a website session endpoint, and a company agent. Users sign in through standard OAuth on the company's own page, or let the agent sign in with their credentials where the company allows it. Access is granted as scopes: read, write, or narrower scopes the company defines.

This gives companies a range of options between blocking agents outright and letting them act as the customer without limit. Each agent identifies itself through a published client identity, and companies may allow, block, register or rate-limit agents individually.

For measurement, a company's access policy becomes partly declared. Whether a brand publishes a Poppy file, which interfaces it offers and which sign-in types it supports can be read and compared across a sector. Which agents it admits is enforced at its own servers and will remain harder to observe.

Choice sits upstream of the protocol

Poppy's discovery step defines how an agent finds everything it needs to work with a company. It starts from the company's own domain, so the agent has already decided where to go. The draft defines no directory, search or ranking mechanism. Its published list of open topics covers payments, push notifications and attachments, with nothing on selection.

That earlier decision is where much commercial value is won or lost. When a customer asks an agent to find a warmer jacket, a better savings rate or a hotel near the venue, the agent forms a shortlist and picks. A brand with flawless Poppy integration gains nothing from a session that never starts.

Our AI Win-Rate research has found wide gaps between a brand's market position and how often AI systems recommend it. Poppy does not set out to address those gaps, and its effect on them is uncertain. Lower friction could help brands that agents previously struggled to transact with, or it could make an early selection more decisive. In either case, as the mechanics of reaching a business converge, selection becomes easier to isolate as a separate competitive variable.

Session records and attribution

Once connected, the agent works through whichever interfaces the company offers. A session ties one user's activity together across API calls, website browsing and conversations with the company agent, with web browsing optional for the company. Every API and conversation request carries a short-lived token bound to a key the agent holds. In conversations, every message is marked as written by a person or by an AI.

The result is a more consistent record of agent activity at each company. The specification states that a company always knows when a request comes from a personal agent, which agent it is, and which user it acts for. Payments, push notifications and attachments remain open topics, so for now that record stops short of the purchase in many journeys.

A session record is evidence of activity. It does not show that a recommendation caused a purchase, link activity across companies, or measure incremental commercial effect. Those questions need an attribution method. The AI Traffic Attribution Convention, which AIVO authors and which is in review with the Media Rating Council and IAB Tech Lab, sets out how AI-referred and agentic traffic should be counted. Poppy sessions, with their declared agent identity, give such a method a well-defined unit to work with.

What brands should do now

Brands should treat Poppy readiness as a developing requirement for agent access and task execution. They need to decide which agents to admit, what each sign-in type may grant, and which interfaces to expose. These are commercial and legal policy decisions as much as engineering ones.

The standards landscape is still forming. Stripe and Shopify have joined both Poppy and Visa's Trusted Agent Protocol. Brands should expect overlapping approaches to coexist, and should avoid tying their agent strategy to one protocol before the market settles.

Technical readiness answers only part of the commercial question. A brand also needs to know how often agents select it, which competitors they prefer, and how recommendations shift as a decision progresses. That evidence has to be gathered upstream, because session data exists only for the brands an agent has already chosen.

The three layers are distinct. Poppy governs how an agent reaches and works with a business. Attribution connects the resulting activity to a commercial outcome. Agentic Brand Control, the category AIVO has defined, measures whether the agent selects the business, against which competitors, and what happens to that recommendation through the decision journey. As the mechanics of agent interaction standardise, that decision layer becomes a more clearly defined competitive discipline.

Sources

Personal Agent Protocol specification, draft 0.1, updated 9 October 2026

Personal Agent Protocol: Open topics

Personal Agent Protocol overview

Introducing Personal Agent Protocol, Sierra, 6 October 2026

Sierra announces Personal Agent Protocol, The Next Web

Personal agent protocol introduced, Techzine

AIVO Journal, Chosen, Then Blocked: The Three Gates of Agentic Commerce