Author: Hualin Wuwang
Editor: Jingyu
The era of Agents "consuming" on behalf of users has finally arrived.
On November 13, 2026, US time, two companies held two launch events on the same day. On one side, enterprise conversational agent company Sierra partnered with Meta to officially release the personal agent protocol Poppy v1.0, solving the problem of how assistants "get in the door"; on the other side, OpenAI launched ChatGPT Wallet for the personal assistant dots, solving the problem of how assistants "pay".
Opening the door and checking out on the same day is itself intriguing enough. What is more noteworthy is the same batch of names standing behind both sets of solutions. Visa and Mastercard appear on both lists at the same time, while companies that control e-commerce and payment infrastructure, such as Shopify and Stripe, stand among Poppy's core partners.
The next competition among Agents may appear on the surface to be giants fighting for the entrance, but the hidden line underneath is an early occupation of positions around commercial channels.
Personal Agent Protocol, PPP
Sierra and Meta jointly release the personal agent protocol Poppy v1.0 | Image source: Sierra official blog
In the past, personal assistants accessing enterprise websites could only be like invisible visitors. Merchants could not see who was coming, and were even less willing to hand over sensitive operations such as checking orders, changing addresses, booking flights, or financial pre-approval to them.
The core of what Meta and Sierra'sPoppy aims to solve is trust. It allows enterprises, when receiving a request, to use cryptographic means to confirm three things—which assistant is knocking on the door, which user it represents, and exactly how much permission it has.
The core of the Poppy protocol is the "doorplate," the "foundation," and "two-way authorization."
"Doorplate." Enterprises that adopt Poppy will place a configuration file under the standard website path /.well-known/poppy. You can think of it as a visitor guide posted at the shop entrance, clearly stating which communication endpoints are open, how to log in, and which operations are allowed. When an assistant comes calling, it no longer has to guess how to click webpage buttons; by checking the doorplate first, it can act according to the rules.
"Foundation." Poppy does not overturn the Internet's existing communication methods. It is built directly on OAuth authorization, HTTPS encrypted transmission, OpenAPI, and the Model Context Protocol. If a user is only checking product prices, the assistant can converse as an anonymous visitor; once account operations are involved, it must go through authorized login so the enterprise can verify identity.
"Two-way authorization." On the user side, users can decide whether to grant the assistant read-only permission or allow it to modify information and make transactions; on the enterprise side, enterprises define how far external assistants can go on their own turf. Only when both sides nod does an interaction count as established.
Judging from the release information, Sierra and Meta's joint push for this protocol can be said to be very complementary. Founded by former Salesforce co-CEO Bret Taylor and former Google executive Clay Bavor, Sierra's main business is helping enterprises build their own customer service agents, naturally sitting on the "receiving side"; Meta's personal assistant Muse is a typical "visiting side," needing to knock on the doors of countless websites. The receiving side and the visiting side each contributed half the effort, and only then did this standard come to land. At present, when Muse visits participating sites, it already defaults to first looking for and invoking the Poppy protocol.
What open protocols fear most is the cold-start problem of which comes first, the chicken or the egg. What truly helped Poppy cross the threshold this time was e-commerce infrastructure giant Shopify.
At the same time as the protocol was released, Shopify directly automatically enabled and generated Poppy discovery files for every merchant in more than 175 countries around the world, without requiring any manual configuration from merchants. In addition, among more than 100 design partners were representatives from various industries such as Delta Air Lines, 1Password, Okta, and Cloudflare, so this access control system had already spread to considerable coverage on day one.
An Agent That Does Not Touch Cash
Having solved the problem of getting in the door, the next hurdle is paying.
When it comes to letting an Agent open one's wallet, most people's instinctive reaction is resistance. The design starting point of OpenAI's ChatGPT Wallet is very clear: it lets the Agent push a transaction to completion, but from beginning to end it never touches real fund information.
In the actual shopping process, users can have their dot search for products, compare prices, add items to the cart, and prepare the checkout page. But as soon as it reaches the payment step, dot must stop and return the decision to the human. After the user personally verifies the product list, total amount, and selected bank card, authorization must be completed through biometric methods such as facial recognition or fingerprint scanning before the transaction is released.
OpenAI personal assistant dot (Rufus) initiates "Review purchase" checkout confirmation in the conversation | Image source: OpenAI
The more critical security design is hidden in the background. Whether it is the dot doing the legwork or the merchant receiving the money, throughout the entire transaction they never see your real credit card number. After the user authorizes, the partner card network generates a one-time payment credential containing a temporary card number, security code, and expiration date. The merchant only receives this string of temporary information; your real card number never appears.
To realize this mechanism, OpenAI brought in American Express, Mastercard, and Visa for joint development, fully preserving the original credit card points, benefits, and chargeback protection. OpenAI also specifically drew a line at the release,emphasizing that ChatGPT Wallet is absolutely not a crypto wallet, nor does it use blockchain or stablecoin payments, and runs entirely on traditional fiat banking and card network infrastructure.
Judging from public information, the commercial motives of all parties are clear. For OpenAI, if a personal assistant can only give suggestions and throw links, it will forever remain at the shopping guide stage; only by keeping the checkout loop within the conversational ecosystem can dots change from advisers into deal closers. For traditional card networks, once agents become a new consumption entrance, no one wants to see transaction traffic cut away by new payment networks. Through this cooperation, the three major card networks naturally connected the new channel back to their own clearing networks.
Even so, OpenAI's first step remains quite restrained.
ChatGPT Wallet is initially available only in limited release to ChatGPT Pro subscribers in the United States aged 18 and over, and supports eligible U.S.-issued bank cards, including cards issued by Amex, Visa, Mastercard, and Chase. Judging from public information, starting with paid users is most likely an attempt to proceed more steadily on risk control.
When Giants Join Forces
Putting these two pieces of news side by side on the same table reveals a rather interesting intersecting picture.
Among Poppy's first batch of core partners, Shopify, Stripe, PayPal, Visa, and Mastercard are all on the list; turning to ChatGPT Wallet, the developers backing it are Amex, Visa, and Mastercard. The only ones truly spanning both sides are Visa and Mastercard, which are both on Poppy's list and are development partners for Wallet.
An even more intriguing detail is that OpenAI's own name is also prominently listed among Poppy's more than 100 design partners.
Among the first batch of more than 100 design partners of Personal Agent Protocol, OpenAI, Visa, and Mastercard are all included | Image source: Sierra
On the consumer side of the market, Meta's Muse and OpenAI's dots are the most direct competitors, both desperately competing for the first entry point users open every day. But once it comes to the enterprise access layer, the two giants sit down at the same conference table, preparing to share the same access card. The reason is not hard to understand: airlines or retailers would find it very difficult to maintain a separate set of incompatible interfaces for every model vendor. On the consumer side, each can compete in its own way for entry points, but on the business side, they must jointly build the same pass.
There is also a signal in the technical route. Automated transactions between agents were once seen by many as a potential scenario for stablecoins. But judging from this round of implementation, existing financial and e-commerce infrastructure has chosen the gradual route of "standard authorization protocols plus one-time virtual card credentials," temporarily setting crypto solutions aside. Connecting first to mature risk control and clearing rails and getting transactions running is the least troublesome path for the traditional commercial system.
Of course, public information still leaves one suspense.
Poppy and ChatGPT Wallet have not yet stated whether they are already connected. In the future, when a user's dot walks into a Shopify store that has enabled the Poppy protocol, whether it can smoothly complete the handshake and then pay with Wallet remains to be verified later.
The Agent's Autonomy Stops Before the Shopping Cart
Looking at Poppy's two-way authorization and ChatGPT Wallet's mandatory biometric authentication together, the common bottom line drawn by the industry becomes clear—Human in the loop.
Whether it is reading data, modifying orders, or actually deducting money, the assistant's autonomy stops precisely in front of the shopping cart. It can compare prices across the entire web for you and fill in the checkout fields, but the one who finally flips the switch to confirm must still be the user.
This design preserves safety, but it also leaves several unanswered questions.
For example, the gray area of who bears transaction responsibility. If the assistant misunderstands your intent when selecting products, or is induced to place an order by hidden malicious prompts while browsing web pages, even if you ultimately scan your face, whether the bank's existing chargeback protection can cover "mistakes made by the assistant" has not yet been defined in public information.
The coverage and threshold for being able to participate in protocol transactions still remain. Shopify has brought along a huge number of merchants, but how long will it take for the countless long-tail websites on the internet to hang up the Poppy sign? On the other hand, ChatGPT Wallet is currently open only to Pro subscribers in the United States, and how long other markets and ordinary users will have to wait remains unknown.
Moreover, mandatory biometric authentication for every transaction does indeed max out the sense of security. But imagine that in the future you are used to having your assistant order coffee and buy daily necessities every day, and every small matter requires taking out your phone to scan your face once. The peace of mind promised by fully automated agents would instead become new operational friction in high-frequency scenarios.
At the current stage, when assistants are not yet perfect and social trust has not yet been established, letting people firmly hold the final"click to confirm" power may be the cost the industry must pay to obtain an entry ticket, and it also determines the pace of commercialization of personal assistants.
Next time, when you ask an AI assistant to change a delivery address and pay for it along the way, it will finally no longer be turned away at the door as a crawler. It presents its compliant identity, walks into the store, understands the sign, fills the shopping cart, then stops on the checkout page, hands the phone to you, and waits for your face to align with the camera.
Today's face scan is the last threshold before people hand trust over to assistants. But one day, when everyone is accustomed to letting programs run errands for daily consumption, will this confirmation become a mere formality that people casually click away? Just like the authorization agreements that all websites and citations ask you to sign—almost no one truly understands them, nor is willing to read them carefully.
