Sierra and Meta's draft agent protocol: the permission model is the part to copy

On 6 October Sierra announced the Personal Agent Protocol, an open standard it is developing with Meta for how a consumer's AI agent deals with a business. On 9 October it published a first draft, called Poppy (Draft 0.1). Sierra sells customer-service agents, so read its framing as a vendor's view. The mechanics are worth learning from anyway.

A business publishes a file at /.well-known/poppy.json telling agents how to start a session and how customers sign in. The agent identifies itself and can begin as a guest, for example to check stock or a returns policy. When a task needs an account, the customer signs in on the company's own page using OAuth 2.0. Sierra's 6 October post says the customer chooses between read-only and write access. One session can span the website, the APIs (OpenAPI and MCP are named) and the company's own agent.

Caveats: the draft says any part can change before a stable version, in ways that break compatibility. Payments, push notifications and attachments aren't covered yet, agent identity is still described as having missing pieces, Decagon has a rival protocol (PACT), and reporting says Anthropic isn't on board. I wouldn't build a roadmap on it.

The idea underneath doesn't depend on this spec. Sooner or later some users of your product will be software acting for a person, and you'll have to decide what it may do. Three questions to answer in writing this week:

First, which actions are destructive, expensive or irreversible (deleting data, sending messages, spending money, changing account details)? Those deserve a separate permission, not a free ride on a login.

Second, can you tell an agent from a person? If your logs can't, you can't rate-limit it, explain what happened afterwards, or switch it off.

Third, what's the smallest grant that's still useful? Read-only is a perfectly good product for many agent cases.

For Murror this isn't abstract. A journal is about as sensitive as data gets, and if software ever asks to read it for someone, I want an explicit, narrow, revocable choice by the person, not inherited access. We offer nothing like this today, and I'd rather set the rules before the request arrives.

Which of your actions would you refuse to hand to an agent even if the user asked?