For the past few years, support teams have been building AI agents to talk to customers. This week the industry took a concrete step towards the other side of that conversation: AI agents that act for customers, contacting your business on their behalf. How you recognise those agents, what you let them do and when you insist on a human is about to become an operational question rather than a thought experiment.
What Was Announced
On October 6, Sierra’s Bret Taylor and Clay Bavor announced the Personal Agent Protocol, an open standard that Meta and Sierra are developing with partners including Genesys, Rocket, Shopify, Stripe and Walmart. Three days later they published a draft of the protocol, nicknamed “Poppy”, and named 35 additional design partners, among them Bank of America, Cigna, Comcast, OpenAI, PayPal, Target, United Airlines, Visa and Zendesk.
The problem it tackles is familiar to anyone who has watched an automated tool try to use a website built for people. Today, personal agents mostly load pages and click through forms, and when that fails they fall back to phone support or web chat. That is slow for the customer and opaque for the business, which often cannot tell that a bot is on the other end.
How the Draft Works
Based on the two announcement posts, the draft is built around a handful of ideas:
| Building block | What it means for a business |
|---|---|
| Discovery | Agents start at your website and read a published file describing what you offer and how to reach it |
| Guest access | An agent can check things like stock or a returns policy without signing in |
| Sign-in and consent | Account access goes through OAuth on your own sign-in page; the customer chooses read-only or write access |
| One session across channels | Questions asked before sign-in and actions taken after it belong to the same visit |
| Your choice of channel | You decide whether agents use your website, your APIs (MCP or OpenAPI) or your own conversational agent |
| Self-identification | “The personal agent identifies itself, so the company always knows when an agent is acting for a customer” |
Payments and proactive notifications, such as telling an agent that a flight is delayed, are described as future extensions rather than part of the first draft.
The Agents That Don’t Introduce Themselves
A standard only helps when agents follow it. On October 8, Sierra described fleming-1, a model that detects when the caller on a phone call is another AI agent by scoring the audio for signs it was machine-generated. Its framing is useful for any support leader: some automated callers may be customers who delegated a task, while others may be fraudsters “testing account security at scale.”
Sierra says the model is tuned to be conservative so it does not flag real people, and it publishes no accuracy figures. Detection gives you information, not a verdict. What happens next is a policy decision your business has to make.
Don’t Lose Sight of the Humans
Coverage of a contact-center summit this week offers a timely counterweight. SiliconANGLE reported Five9 research, cited by CEO Amit Mathradas: 99% of business practitioners deploying AI believe their contact centers have improved, but only 66% of actual users agree, and more than half of those users point to being unable to reach a human.
Agent-to-agent automation will only widen that gap if the escape hatch disappears. Whatever channel an agent uses, a customer who wants a person must still be able to get one quickly, with the context carried over.
How to Prepare
1. Decide what agents may do, by risk
Start with a simple policy: what a signed-in agent may read, what it may change and what always needs the customer’s direct confirmation. Refund thresholds, address changes and account closures are good candidates for the last group.
2. Measure agent traffic before you optimise for it
You cannot plan for a channel you cannot see. Begin by tagging contacts you believe come from agents, through self-identification where it exists and detection where it doesn’t, and track their volume and outcomes.
3. Make your policies machine-readable
Agents reading your returns page will quote whatever it says, literally. Clear, dated, unambiguous policy content helps your own AI agent, human agents and visiting agents equally.
4. Keep identity and authority separate
An agent that has proven who it represents has not necessarily proven it may perform a given action. Treat authentication (who) and authorisation (what) as separate checks, just as you would for a human caller.
5. Follow the draft, and give feedback
The specification is a draft, with design workshops and a reference implementation planned over the coming month. If agent-initiated contacts matter to your business, now is the time to shape the rules.
The Bigger Picture
Customer service has always assumed a human on the other end. That assumption is starting to break, and the Personal Agent Protocol is the first broad attempt to replace guesswork with a shared set of rules. The businesses that adapt best will treat agents as a new kind of customer channel: one that deserves clear permissions, honest identification and, always, a route back to a person.