Your Members' AI Agents Are Coming. Here's How VTC Plans to Let Them In.

More people are handing everyday tasks to a personal AI agent, and many of those tasks end up at a company's website. Until now there has been no shared way for that company to know an agent is visiting, who sent it, or what it should be allowed to do. Usually it's all or nothing: block the agent, or let it log in as the person and do anything they can.

On October 6, 2026, Sierra and Meta announced a way to fix that. On October 9 they published the first draft, Draft 0.1, of the Personal Agent Protocol, known as Poppy. Since October 18, Draft 0.1 has been frozen while work continues on Draft 0.2. Here's what it means, and how we're planning to approach it at VTC.

To be clear up front: VTC does not support Poppy today. What follows is a plan, not a live feature.

What Poppy is, in plain words

Poppy is a common set of rules between a person's AI agent and a company. According to Sierra's announcement, it works like this:

• One file to find you. A site publishes a single file at /.well-known/poppy.json. It tells agents how to work with the site, how people sign in and what an agent can do.

• Start as a guest. An agent can open a session without signing in, which can be enough to check whether something is in stock or read a returns policy. The agent identifies itself, so the company always knows it's dealing with an agent.

• Sign in, with limits. When a task needs the person's account, the person signs in on the company's own page through OAuth, the same standard behind "Sign in with Google" buttons. The agent then gets only the access the person approved.

• Three ways to get things done. The agent can then work through the company's regular website, through its APIs (using standards such as OpenAPI and MCP, the Model Context Protocol, which lets AI agents use an app's tools), or by talking to the company's own agent.

Poppy launched with partners including Shopify and Stripe, and Sierra has since announced 35 more design partners, including Notion, Zapier, Zendesk, Cloudflare and OpenAI. No community platform is among them, and as of October 20, none of the community platforms we checked (Circle, Mighty Networks, Bettermode, Discord, Whop and Heartbeat) publishes a Poppy file.

The draft is still a draft. Draft 0.2 is in progress and not yet published, and its changelog already lists changes that break code written for 0.1. The official kit for companies, including its validator, already follows 0.2. The project's Path to 1.0 page says a revision can break compatibility with earlier drafts until 1.0. Feedback and implementation reports go through the official GitHub repository.

Why a community is different from a shop

Most early examples are about shopping, where there are two parties: the customer and the business.

A community has an audience. When an agent posts, other members read it. When it reacts, it changes what people see first. If it earns points, it changes who looks like an expert.

Bettermode made this point well in its October 17 guide to getting communities ready for Poppy. We agree with their three core recommendations:

• Label posts made by agents, so members know what they're reading.

• Keep points and reputation for humans, so leaderboards reflect what people actually did.

• Report agent activity separately, so admins can see both what members do and what their agents do.

VTC's plan, step by step

Our approach is to start with reading, then add writing slowly, one action at a time, with Space admins in control. This is the order we're planning:

1. Publish a Poppy file for vtc.com and for every Space. Agents could then read public Space information as guests, the same things any visitor can already see.

2. Read-only access after sign-in. Once a member signs in and approves it, their agent could see that member's own Spaces, events and tasks, and nothing more.

3. Write actions, switched on one at a time by Space admins. We'd start with RSVPs, which are low risk. Next would come Bookings, so a member could say "book me with Jenny on Wednesday 2-4" and their agent would handle it. Posting would come last.

A few rules would apply throughout:

• Clear labels. Anything an agent posts would show as "Posted by @user's agent."

• No points for agents. Agent posts wouldn't earn points, so reputation in your network stays human.

• An Agents tab for admins. Network admins and Space admins would both get an Agents tab. Network admins would set what agents can ever do across the network, and each Space admin would choose what to switch on in their own Space.

• Agent activity reported separately. Admins would see agent activity reported separately from what members do themselves, so it's easy to spot misuse.

Why we're starting from a good place

VTC already runs an MCP server, and MCP is one of the standards Poppy builds on for API access. That gives us a head start. Poppy would add the missing pieces on top: how an agent finds a Space, says who it's acting for and gets the member's permission. We plan to build to Draft 0.2, not 0.1. In 0.2, each company has its own sign-in service, called an OAuth issuer, so every Space would get its own sign-in, and Spaces wouldn't share sign-ins or tokens. Our MCP server would use DPoP tokens (short for Demonstrating Proof of Possession). Each token is tied to a key only the member's agent holds, so a copied token is useless on its own. Because the draft may still change in breaking ways, we'll follow it closely and adjust as it evolves.

What you can do now

Nothing yet. If you run a network on VTC, it's worth thinking about which Spaces you'd want agents to read, and which actions, if any, you'd let them take for your members.

FAQ

Does VTC support Poppy today?

No. Everything in this article is a plan.

Will agents be able to see my private Spaces?

Only with a member's permission, and only the Spaces that member already belongs to. Under our plan, guest agents would see public Space information only.

Can an agent post in my community without me knowing?

Not under our plan. Posting would come last, only if a Space admin switches it on, and every agent post would be labeled.

Will agents earn points?

No. Agent posts wouldn't earn points. Points and reputation stay with people.

Where can I learn more about Poppy?

Read Sierra's announcement and the draft at personalagentprotocol.org.

Build a network that's ready for what's next

VTC gives your community, team or organization one home with Spaces, the right apps and no per-member fees, and we're planning carefully for the agents your members will bring with them.

Create your network on VTC today: https://vtc.com