Introduction
Customer experience has long assumed that the customer initiates the interaction. Personal AI agents could change that by investigating problems, comparing options and completing transactions on a customer’s behalf.
Sierra and Meta’s Personal Agent Protocol, known as Poppy, is an early attempt to support these interactions. It raises an important question for CCaaS providers: are they prepared not only for the AI agents they deploy, but also for the agents their customers bring?
The Next Shift in Customer Experience Is Already Underway
Over the years, businesses have created better ways for customers to reach them, including IVRs, websites, apps, chatbots, omnichannel contact centres and, most recently, agentic AI designed to solve problems rather than simply answer questions.
Now the customer side of that interaction is changing too. What happens when customers start using their own AI agents?
This week, Sierra and Meta introduced the Personal Agent Protocol (PAP), which Sierra calls Poppy. Genesys, NiCE, Shopify, Stripe and Walmart are also involved, and Draft 0.1 of the specification was released on 9 October. The proposal is still at an early stage and may not be adopted, but it raises questions that CCaaS providers should begin considering now.
In my earlier article, 'When Your Customer Is a Bot: What Happens When AI Agents Call AI Agents?', I explored the challenges that arise when personal AI agents interact with enterprise AI agents, particularly around identity, authorization, governance and accountability.
The Poppy proposal takes that discussion a step further. Although it is still early and not yet a standard, it shows that the industry is beginning to address these issues.
The Customer May No Longer Make the Call
Imagine that your internet bill suddenly increases. Today, you would visit the provider's website, start a chat or call the contact centre, sign in and explain the problem.
Now imagine asking your personal AI assistant to find out why the bill increased, compare plans and suggest a better option. With the right permissions, it could communicate directly with the provider's systems or AI agent, then return with an answer for your approval before making any changes.
The customer remains involved but may no longer handle the interaction. That matters for platforms built around people initiating calls, chats or digital journeys themselves.
What Poppy Proposes
Poppy gives customer-controlled agents a standard way to connect with businesses, establish sessions and act on a customer's behalf. Companies indicate the capabilities they support, such as sign-in options, APIs, a website and their own AI agent. A personal agent can begin as a guest for simple tasks, then ask the customer to sign in with OAuth for read-only or write access to an account. The business decides which actions are available. One session can span the website, APIs, and the company agent, so the customer doesn't need to start again in each channel.
An operations extension allows an agent to do more than ask questions. The customer agrees to the precise terms, the company completes each operation only once, and both sides can track its status. The model also allows a case to be transferred to a human when needed.
Sierra's initial roadmap includes design workshops and a reference implementation. Later steps may include more detailed permissions, push notifications and payments.
Why Genesys Is Paying Attention, and NiCE Is Too
Genesys describes Genesys Cloud as an orchestration layer that brings together AI agents, people, apps and workflows rather than handling each contact separately. It runs Sierra agents alongside its own Agentic Virtual Agents and supports A2A interoperability with Salesforce and ServiceNow.
At Sierra's launch, Tony Bates, chairman and CEO of Genesys, said that "personal AI is creating a new front door to the enterprise." A personal agent could therefore become another entry point to the customer journey, with Genesys managing the systems, specialised AI agents and human escalation.
This is a strategic direction, not a feature ready for release. Genesys has not announced a production Poppy integration. NiCE is also involved and says it is co-developing the protocol. Support for the same draft from the two largest CCaaS vendors suggests that the industry is focused on defining boundaries as well as competing.
Should We Be Underestimating the Timeline?
Some argue that CCaaS providers do not need to worry about personal agents yet. There is good reason for caution: identity, delegated authority and reliable transactions remain difficult problems, and the pace of adoption is unclear.
Predicting when personal agents will become common in contact centres is one question. Deciding when architecture teams should begin preparing for them is another.
Companies can choose when to introduce AI into their own operations, but they cannot control when customers begin using it. A personal assistant does not need to wait for Poppy to contact customer service. It can already use a website, chat or phone number. These capabilities are also likely to appear in the assistants, browsers and devices that customers already use, making adoption harder to predict than a typical enterprise software rollout.
I recently tested this myself using Meta’s Muse personal AI assistant and my MB Cloud Consulting website, mbcloud.ai. I instructed Muse to visit the site, provide my contact details and request a follow-up. I watched as Muse navigated the site and entered the information in real time.
Muse first tried to use Chatbase, the AI assistant embedded on the site. Because lead capture was not configured in Chatbase, it directed Muse to the Contact page. Muse then completed the website’s Contact form, and I received a confirmation email.
This was not a demonstration of PAP, and Chatbase did not collect the lead. I also do not know whether Chatbase identified Muse as an AI agent. The experiment showed that a personal agent can already use existing digital channels to initiate a business interaction and request follow-up.
If contact centre reports begin to show that most traffic comes from agents, redesigning systems for identity, authorization and escalation will probably be much harder by then.
Some Requests Will Never Reach a Queue
A personal agent could check an order, change a booking or request a refund directly through an enterprise API. Some requests will still require coordination, exception handling or a human touch. The architectural question is where these processes will be managed. Will CCaaS continue to coordinate them, or will CRM, commerce and back-end systems take over?
Metrics will need to change too. Average handle time and customer effort were designed for human interactions. When AI agents communicate with each other, authorized outcomes, transaction integrity, exception rates and cost per resolved task become more relevant.
Customer loyalty may change as well. Bates says personal AIs make it much easier to compare, negotiate and switch providers. When assistants handle that work, the barriers that have kept customers from leaving may weaken, requiring businesses to compete more directly on value.
Governance Is Bigger Than Authentication
As Tony Bates, chairman and CEO of Genesys, stated, "Technical capability does not mean that one has authority." If a customer authorizes an assistant to negotiate a better mobile contract, can that assistant agree to a two-year commitment or a termination fee? Can it change the payment method or cancel a service?
Identifying an agent is not the same as knowing whom it represents or what it is authorized to do. Organizations should separate permissions for retrieving information from permissions for conducting transactions, set limits, maintain audit trails and know when to seek fresh customer approval. They also need to handle legitimate automated calls without treating every synthetic voice as fraudulent, while protecting against impersonation and large-scale automated requests. Moving a case from one agent to another, or to a human, while preserving context and permissions can be as important as the initial connection.
One Standard or Several
Poppy is not emerging in isolation. MCP connects AI to tools and data, while A2A supports communication between agents. When Poppy launched, Decagon released PACT, a consent and trust protocol based on A2A and OAuth, and joined the Poppy working group. Commerce protocols such as UCP overlap in some areas, although Sierra describes Poppy as complementary.
I expect several complementary standards to emerge, just as the internet uses different protocols for identity, communication and payments. Customers will not choose an assistant based on the standard used by their bank or telecom provider. Businesses and their platforms will need to make those standards work together.
What CCaaS Providers Should Do Now
The answer is not to bet everything on one draft protocol. Businesses should prepare for a future in which some interactions begin with personal agents that may use different standards but still follow the same governed processes.
That preparation includes determining how the business identifies authorized agents, exposes appropriate capabilities, verifies permissions, prevents duplicate transactions and maintains audit trails. Most importantly, identity, delegated authority and business policy should remain separate from the protocol used for the interaction.
We have spent years making it easier for customers to contact businesses. Now we may need to prepare for customers to let artificial intelligence handle that task instead.
Are CCaaS providers spending too much time thinking about the AI agents they want to deploy, and not enough about the AI agents their customers will bring?