Poppy: Shopify wrote your store's introduction to AI agents

You spend months on positioning, the homepage and product copy. Then a visitor shows up who reads none of it. It only asks at the door: who are you, and what am I allowed to do here? Since yesterday, a file answers that question for every Shopify store. The brand didn't write it. Shopify did.

What happened

Sierra, the AI customer service company run by Bret Taylor and Clay Bavor, released version 1.0 of the Personal Agent Protocol, Poppy for short, on November 13. It defines how a personal AI agent identifies itself to a business, which permissions the customer grants, and how it works through the company's website, APIs or the company's own agent. Sierra says more than 100 design partners are on board, 60 of them new. Shopify switched Poppy on for every merchant, no work required. And Meta's Muse agent, which The Next Web says more than 10 million people have set up, now checks for the file first on every site it visits. Shopping and checkout run on Shopify's Universal Commerce Protocol (UCP).

The default is the strategy

I checked it myself today, November 14, around 12:30 CET, pulling /.well-known/poppy.json from two Shopify stores: Allbirds and the German brand Snocks. The two files are identical except for name and domain. One permission, "prepare checkout", flagged as irreversible and involving personal data. The same boilerplate sentence, including a nudge that existing customers may get discounts. For the agent interface, only Shopify's standard UCP endpoint. No own API, an empty web section. Both files also report protocol version 0.4, not 1.0.

So an agent's first encounter with your store is a template, and it reads exactly the same for Snocks as for Allbirds. Sounds like plumbing. It isn't. My rule with platforms: every feature that ships switched on is a value transfer. The platform decides, you own the consequences, and often you don't notice. With AI ad features, Meta's and OpenAI's terms spell it out: the advertiser carries the responsibility. With agent access the same thing is now happening quietly in the background.

The interesting part: Poppy is a permissions protocol, not a persuasion protocol. An agent learns what it may do, not why it should buy from you. The case for buying comes from your product data via UCP. Once personal agents become the gatekeeper, the prettiest store doesn't win. The store whose data and rules an agent understands fastest does.

The catch

Which agents a store lets in at all is explicitly left out of the spec. The company decides, or its platform does. And Poppy is one approach among several: Visa and Mastercard are building their own agent IDs, and Amazon would rather you use its own agent than Muse (see my piece on Amazon's product graph). Betting on a standard today is still a bet.

What I would do now

• Open yourdomain.com/.well-known/poppy.json in a browser today. If something is there you've never seen, it belongs on marketing's agenda, not just IT's.
• Clean up product data: titles, variants, prices, shipping and return rules, clear enough that an agent understands them without ever seeing your homepage.
• Name one person who decides what agents may do with you: guest checkout, sign-in, which agents. Same lesson as Muse on the phone: if you don't decide, you get the default.

Bottom lineSince yesterday your brand has a business card for AI agents, and Shopify wrote what's on it.