LupaRiel · PAP

English · rail hub · identity / session · 1 entry · snapshot 2026-10-31 · reviewed 2026-10-31

PAP

Open identity and session standard for personal agents. It does not settle: it complements x402, AP2, ACP, and MPP before money moves.

What it is. Personal Agent Protocol (“Poppy”): customers decide what access to give their personal agents, and companies set parameters for what those agents can do. The draft defines discovery (/.well-known/poppy.json), a session on the customer's behalf (it can start as a guest), OAuth sign-in on the company's own page, and one session across the company's website, APIs (OpenAPI, MCP), and agent. Built on OAuth, JWTs, HTTPS, OpenAPI, and MCP. Source: research/pap.md (announced 2026-10-06; draft 0.2 (0.3 on main) published 2026-10-24; not part of the payment snapshot).

Who maintains it. Open standard developed by Sierra and Meta; Sierra's 2026-10-06 announcement puts it as: “an open standard Meta and Sierra are developing”. Announced 2026-10-06 with Genesys, Instinct, Rocket, Shopify, Stripe, and Walmart (the 2026-10-09 post also lists NiCE); draft 0.1 published 2026-10-09 with 35 new design partners. Apache 2.0 license.

What it is not. Not a settle rail. Payment rails stay four: x402 · AP2 · ACP · MPP. PAP does not replace checkout or pay-per-request.

Note. Draft: the latest published version is 0.2 (2026-10-24), with 24 breaking changes from 0.1, and Draft 0.3 has been on main since 2026-10-29, still as a draft. Before 1.0 each 0.x version can break the previous one, so an agent only uses a poppy.json whose major.minor version it supports. 4 companies already publish poppy.json: Stacktree and PlanMyVisit (on 0.2), Ample Computer and Tilopay (on 0.1), and one personal agent reports 0.2 in production (Donna). That is what the companies and the agent report, with no independent audit beyond the poppy.json. Links to each poppy.json and issue are in the 2026-10-18 to 2026-10-21 updates. There is no Sierra reference implementation, and the spec's examples are fictional. Payments are still out of the draft (listed under open topics), and there are no live payments via PAP.

PAP does not settle. Payment rails stay x402 · AP2 · ACP · MPP. Compare rails: x402 vs AP2 vs ACP vs MPP · PAP. Full PAP table (Spanish): /pap/. All listings A–Z: /en/directory/.

Official docs

Methodology

How LupaRiel verifies entries
On rail hubs, the status is the one on that rail. On the home page and the Index, the most advanced among its rails.
Machine-readable catalog · /rieles.json
Spanish hub + full listing · /pap/

Protocol updates

2026-10-31. Six Draft 0.3 commits landed on main on 2026-10-30. The most relevant one recommends operator signatures with Web Bot Auth (#117). Numbers #112 to #120 come from a mirrored repo and are not public PRs, so the commits are cited. Issue #62 was opened, about what a PX can use to trust agent requests. It is still a draft and PAP still does not settle payments. Commit 14eba30 · Web Bot Auth (#117) · Commit 999722a (#113) · Commit 1de1990 (#120) · Issue #62
2026-10-30. Draft 0.3 was merged to main on 2026-10-29 (commit 3e9bada) and is still a draft: the latest frozen version is 0.2. Issue #61 was opened, proposing a payments extension with a Payment Provider role, bound credentials and signed approval attestations. PAP still does not settle payments. Commit 3e9bada · Draft 0.3 (#112) · Issue #61
2026-10-29. Six new open issues (#55 to #60): a Financial Assurance extension, a community demo, Companies under a URL path on a shared host, a Company agent run by another provider, a backchannel approval extension (CIBA, #59) and the site showing Draft 0.3 ahead of main (#60). The A-Comm Evidence Protocol (AEP) consortium, announced on 2026-10-28, proposes an evidence record that wraps AP2, ACP, UCP, x402, Visa TAP, MCP, A2A and PAP, and opens its second public comment round on November 2. PAP still does not settle payments. No new Companies. Issue #59 · CIBA · Issue #60 · Draft 0.3 · A-Comm · AEP consortium
2026-10-28. Issue #44, opened on 2026-10-27: a live witness for payment records. Its author publishes the design of an optional witness reference on grant and payment records, with two x402 payments as the worked example, one by her own agent and one by an unaffiliated reader who verified the receipt against the published keys. Issue #37, on using an x402 receipt as evidence, was closed as not planned on 2026-10-27. PAP still does not settle payments. No new Companies. Issue #44 · Live witness · Issue #37 · x402 receipt (closed)
2026-10-27. PAP publishes a community demos page (Cliffside Retail, Poppy Demo Agent, Print with Poppy and Poppy on Cloudflare Workers), noting that the spec authors have not reviewed or endorsed them. The validator now checks Token Exchange, invalid_target and the feedback endpoint. New issues #40 and #41 on Direct Conversation (section 7.10): whether the Company can write first and when the conversation closes. No new Companies. PAP demos · Issue #40 · Direct Conversation · Issue #41 · Direct Conversation
2026-10-26. PAP version 0.2 is published (dated 2026-10-24, frozen at /docs/0.2/spec) and Draft 0.3 started at /docs/spec. In Draft 0.3, Session Keys with DPoP replace session_id, each Company defines its own scopes with auth.scope_hints, Mediated Sign-In becomes transitional and Device Sign-In follows RFC 10027. New issues: an x402 payment receipt as evidence for the payments topic (#37) and two on standing permissions in Operations (#38 and #39). Tilopay (tilo.shop) declares a public MCP server with no authentication in its poppy.json, and stays on protocol_version 0.1. PAP changelog · PAP 0.2 spec · Issue #37 · x402 receipt · Issue #39 · standing permissions · Tilopay poppy.json
2026-10-22. Eight new issues against Draft 0.2 (#29 to #36), all open. Aaron Parecki, editor of the OAuth 2.1 draft, asks to align the spec with standard OAuth and AIMS terminology, with a ready PR in his fork (#35). Caiioo, an agent that runs on the user's devices, reports that a local agent cannot hold the private_key_jwt key without a cloud signer (#31), that it cannot act in the user's already signed-in browser (#32), and that HTTPS redirect_uris leave out desktop apps and extensions (#33), and proposes declaring data handling in poppy.json (#34). Another issue notes a user cannot have more than one agent on the same Personal Agent (#36). Draft 0.2 is still unpublished. Issue #35 · OAuth terminology (Aaron Parecki) · Issue #31 · local agents and private_key_jwt · Issue #34 · data handling extension · Issue #36 · more than one agent per user
2026-10-22. Tilopay moves its poppy.json to tilo.shop: tilopay.shop/.well-known/poppy.json now returns a 301 to tilo.shop/.well-known/poppy.json, with organization.domain tilo.shop, the same issuer (mcp.tilopay.com), and the same MCP API. Still on Draft 0.1. Companies by version: Stacktree and PlanMyVisit on 0.2, Ample Computer and Tilopay on 0.1 (LupaRiel re-probe on 2026-10-22). tilo.shop/.well-known/poppy.json (protocol_version 0.1) · LupaRiel · Latam
2026-10-21. First personal agent reporting Draft 0.2 in production: Donna (donna.sh), an assistant over WhatsApp and SMS, live since 2026-10-20 and tested against Stacktree. It implements discovery, agent identity with a key held in a KMS, signed-out sessions with a separate User ID and DPoP key per user and per company (so companies cannot link users), Device Sign-In over WhatsApp, Account Tokens, and Feedback. It does not implement Direct or Mediated Sign-In, web browsing, or conversations. It reports that an agent cannot tell from poppy.json whether an MCP server accepts DPoP, and that companies offering only Direct Sign-In, like Ample Computer, are out of reach for chat-based agents. PlanMyVisit (planmyvisit.to, by Autoura) now serves poppy.json on 0.2 with Device Sign-In, and Stacktree published Poppy Simulator, a test personal agent on Draft 0.2. 4 companies now publish poppy.json: Stacktree and PlanMyVisit on 0.2, Ample Computer and Tilopay on 0.1. 0.2 is still unpublished. Verified by LupaRiel on 2026-10-21. Issue #27 · Implementation report: Donna · planmyvisit.to/.well-known/poppy.json (protocol_version 0.2) · Stacktree · Poppy Simulator
2026-10-21. task_grants extension proposal (issue #28), from Donna's author: the agent asks the user to approve one single operation on the company's page, using OAuth Rich Authorization Requests (RFC 9396), instead of a broad scope like poppy:write that can last 30 days. It targets high-stakes actions, like payments or cancellations, where the company needs proof that the user saw and approved the terms, something the Operations extension does not define today. It is an open proposal, not part of the draft. Issue #28 · Extension proposal: Task grants
2026-10-20. Draft 0.2 is still in progress, not published. The changelog was reorganized into major changes, minor changes, and guides, with the same 24 breaking changes. Without breaking anything, it adds a separate audience for the browser assertion (section 9.4) and a guide for matching the spec, and the site added a videos tab. There are two third-party extension proposals: Referral, from TrueFinds, so a company can credit the agent that sent it a customer, like an affiliate link, and Push notifications, so a company can alert the agent when something happens, one of the open topics. Stacktree is still on 0.2, Ample Computer and Tilopay on 0.1. Verified by LupaRiel on 2026-10-20. personalagentprotocol.org · Changelog (Draft 0.2) · Issue #21 · Referral (truefinds.ai) · Issue #22 · Push notifications
2026-10-19. The spec moves to Draft 0.2, in progress, and 0.1 is frozen at /docs/0.1. The changelog lists 24 changes that break compatibility with 0.1. Among them: HTTPS required for every protocol URL, before 1.0 an agent only uses a poppy.json whose major.minor version it supports, one issuer per company, mandatory ES256 with full DPoP validation per RFC 9449, assertion aud equal to auth.issuer, and a distinct DPoP key per User ID. Without breaking anything, it adds a Feedback section so the agent can report tasks the company doesn't offer, anonymous browsing with a disposable User ID, and a SECURITY.md for private vulnerability reports. Stacktree is the first company already serving 0.2, with a feedback endpoint. Ample Computer and Tilopay are still on 0.1. The Claim Records extension proposal, for claims after a purchase, was kept out of the protocol and continues as a third-party extension. Payments remain an open topic. Verified by LupaRiel on 2026-10-19. personalagentprotocol.org · Changelog (Draft 0.2) · personalagentprotocol.org · Spec Draft 0.1 (frozen) · stacktr.ee/.well-known/poppy.json (protocol_version 0.2) · Issue #16 · Claim Records · Issue #20 · FundGen, agentic charitable giving
2026-10-18. Second company reporting Poppy in production: Ample Computer (ample.computer), a cloud where agents deploy apps, says it has served Draft 0.1 since 2026-10-17 (reported by the company, not independently verified, its poppy.json responds). It runs a separate Poppy issuer so existing MCP clients in ChatGPT and Claude keep connecting as before. It implemented signed-out Sessions, Direct Sign-In with its own scopes, Account Tokens, and sign-out, but not Device or Mediated Sign-In, conversations, or Operations. In LatAm, Tilopay, a payment gateway for Central America and the Caribbean, publishes a poppy.json with an MCP API to buy from its affiliated merchants: payment runs in its 3DS form and the agent never sees the card (CRC, USD, GTQ, and PAB). Stacktree, which reported Poppy on 2026-10-16, also charges via x402. Still Draft 0.1. Issue #15 · Ample Computer, live on Draft 0.1 · ample.computer/.well-known/poppy.json · tilo.shop/.well-known/poppy.json (formerly tilopay.shop) · stacktr.ee/.well-known/poppy.json · Issue #12 · Stacktree, live on Draft 0.1 · Stacktree publish ficha (x402) · papchecker.com · sites with poppy.json
2026-10-17. First company reporting Poppy in production: Stacktree (stacktr.ee) says it has served Draft 0.1 since 2026-10-11 (reported by the company, not independently verified, its poppy.json responds). It implemented signed-out Sessions, DPoP, Direct Sign-In, Account Tokens, and sign-out, but not Mediated Sign-In, conversations, or Operations. The draft added a Security considerations section (prompt injection between agents, secrets in the model context) and set the client assertion aud to the company's issuer. A Company implementation kit also shipped (JSON Schemas and a validator). Still Draft 0.1 and no Sierra reference implementation. Issue #12 · Stacktree, live on Draft 0.1 · stacktr.ee/.well-known/poppy.json · Commit e910c86 · Security considerations · Commit 95fcbf2 · Company implementation kit
2026-10-16. First batch of normative changes to the draft, driven by issues on the official repo: 13 changes merged on 2026-10-15 at 23:03 UTC and 2 more on 2026-10-16. Highlights: DPoP aligned with RFC 9449 (jti replay check and mandatory ES256), HTTP statuses and errors for Mediated Sign-In plus limits on where its credentials are kept (PR #53, which closed issue #5), account_mismatch on every sign-in type, rate_limited and extension_required formats, organization.domain must match the host serving poppy.json, Sessions for MCP clients that don't implement Poppy, and a Session staying tied to its account after sign-out. The site still says Draft 0.1 and there is no Sierra reference implementation yet. GitHub · personal-agent-protocol commits · Commit 46dafba · Align DPoP rules with RFC 9449
2026-10-15. The spec's official repo is now public: personal-agent-protocol/personal-agent-protocol on GitHub (Apache-2.0, created 2026-10-14). It is the source of the site and docs, not an implementation. Feedback now goes through GitHub issues, and day one already brought several security ones (unspecified client assertion aud, Mediated Sign-In, DPoP for MCP, Security Considerations). The Path to 1.0 page replaces open topics: payments, push notifications, and attachments remain outside the draft. Still no reference implementation from Sierra. GitHub · personal-agent-protocol (official spec, Apache-2.0) · personalagentprotocol.org · Path to 1.0
2026-10-14. Datalayer's SDK reached v0.24.0 (four releases since v0.20.0, the latest on 2026-10-14 10:49 UTC, in Python and npm). Sign-in now names the company and what it says it needs, a company can declare its other domains, replies from a company's staff are flagged, and an MCP server's rate limits come with their Retry-After. Per its README, conversation SSE streaming, handoff and close, and the Operations client/server are still not implemented (conversations use long polling). It is not Sierra's reference implementation, and payments remain outside the draft. GitHub · personal-agent-protocol v0.24.0 (2026-10-14) · PyPI · personal-agent-protocol 0.24.0
2026-10-13. Datalayer's SDK reached v0.20.0 (nine releases since v0.11.0, between 2026-10-12 and 2026-10-13 10:32 UTC). It adds displays to confirm an operation and show its outcome (PapConfirm and PapOutcome), a client that resolves and pins each company's address, sessions ending when a scope narrows or a password is reset, and per-agent rate limits. Per its README, conversation SSE streaming, device or mediated sign-in, Account Token exchange, and the Operations client/server are still missing. It is not Sierra's reference implementation, and payments remain outside the draft. GitHub · personal-agent-protocol v0.20.0 (2026-10-13) · PyPI · personal-agent-protocol 0.20.0
2026-10-12. Datalayer's SDK moved to v0.11.0 (v0.10.0 and v0.11.0 shipped on 2026-10-12, 06:04 and 09:55 UTC). It now targets draft 0.1 (2026-10-09 revision) and ships Operations v1 extension models, plus conversations with long polling and cursor recovery. Per its README, conversation SSE streaming, device or mediated sign-in, Account Token exchange, and the Operations client/server are still missing. It is still not Sierra's reference implementation, and payments remain outside the draft. GitHub · personal-agent-protocol v0.11.0 (2026-10-12) · PyPI · personal-agent-protocol 0.11.0
2026-10-11. First community SDK: Datalayer published personal-agent-protocol in Python and TypeScript (repo from 2026-10-10, v0.5.0 on 2026-10-11), targeting draft 0.1. It covers discovery (/.well-known/poppy.json), signed-out sessions with DPoP, Direct Sign-In, and basic conversations; it doesn't yet have conversation streaming, device sign-in, or the operations flow. It is not Sierra's reference implementation, still announced for next month. GitHub · datalayer/personal-agent-protocol · PyPI · personal-agent-protocol (v0.5.0, 2026-10-11)
2026-10-09. Payments are out of draft 0.1: the open topics page lists payments (“including how that works with existing payment protocols”), push notifications, and attachments as not covered yet. PAP is an identity and access layer, not a payment one. The design partners include owners of the other rails: OpenAI (ACP), Stripe (ACP and MPP, since the announcement), Mastercard (co-donated Verifiable Intent alongside AP2 to FIDO), Visa, Adyen, Cloudflare (Monetization Gateway with x402), PayPal, and Plaid. The draft's first extension is operations v1: the personal agent confirms an action before the company performs it, approval covers the exact terms, the action has one record across channels, and a retry never performs it twice. personalagentprotocol.org · Path to 1.0 · Open topics (Draft 0.1) · personalagentprotocol.org · Extensions (Draft 0.1) · Sierra · Sharing a draft of Personal Agent Protocol (2026-10-09)
2026-10-09. Sierra published draft 0.1 of Personal Agent Protocol (“Poppy”) and announced 35 additional design partners that will participate in the design process: Adyen, Atomic, Bank of America, BBVA, Chime, Cigna, Cloudflare, Comcast, DIRECTV, ElevenLabs, FOX, Gap Inc., GEICO, Hertz, Insurify, Klaviyo, Liberty Mutual, Mastercard, Nordstrom, Notion, Okta, OneSignal, OpenAI, PayPal, Plaid, SiriusXM, Synchrony, Target, United Airlines, Venmo, Visa, Wells Fargo, Zapier, Zendesk, and 1Password. They take part in the design; this is not production adoption. Next month, per Sierra: design workshops and a reference implementation. Sierra · Sharing a draft of Personal Agent Protocol (2026-10-09) · personalagentprotocol.org · Spec, Draft 0.1 (updated 2026-10-09)
2026-10-06. Sierra's announcement: “an open standard Meta and Sierra are developing along with industry partners at Genesys, Instinct, Rocket, Shopify, Stripe, and Walmart”. The 2026-10-09 post also lists NiCE among the companies in the announcement. Sierra · Introducing Personal Agent Protocol (2026-10-06) · Sierra · Sharing a draft of Personal Agent Protocol (2026-10-09)

Protocol updates with a cited source. They are not catalog rows and do not change the snapshot.

Sample entries

Personal Agent Protocol · announced · 2026-10-31

Identity-rail entries are not payment-settle rows. LupaRiel does not invent rows, prices, networks, or statuses. The complete listing stays on the Spanish hub.