A person hands a key to a robot carrying a parcel and travel ticket toward a business, beside a locked personal folder
AI-generated editorial illustration of a person authorizing an agent to handle a bounded task with a business. Conceptual image, not a deployed Poppy interface or a test result. Audit Commons (AI-generated editorial illustration) · Original AI-generated editorial illustration; reuse license pending

Discovery and Scoped Authorization

Following their October 6 announcement, Meta and Sierra published draft 0.1 of the Personal Agent Protocol, or Poppy, on October 9. Businesses advertise services through /.well-known/poppy.json. Agents identify themselves with HTTPS client identifiers and public keys; users authorize account scopes through supported sign-in flows.

The draft uses key-bound session tokens with DPoP proof of possession for APIs and conversations. MCP endpoints use resource-limited Bearer tokens, while browser access exchanges a signed assertion for session cookies. Draft 0.1 may change incompatibly. Sierra also announced additional design partners; participation supplies feedback rather than evidence of production deployment.

Evidence to Request from Implementations

Our editorial audit questions concern concrete implementations: which account scopes were granted, which service received each credential, and whether revocation blocks subsequent actions across every connected channel. A protocol document alone cannot answer those questions.

Review grant records, service-specific token audiences, browser sessions, and denial logs together. Read this alongside NIST's agent identity work and our agent action worksheet. Muse permission disclosures provide related operational context.