What is the Personal Agent Protocol, and why Nox speaks it

Key points

• The Personal Agent Protocol is an open protocol, introduced by Sierra and Meta in October 2026, for personal AI agents working with businesses for one person.
• A business takes part by publishing a file at /.well-known/poppy.json. Nox checks that file against the business's own sign-in server before trusting it.
• Nox gives you a private, random ID at each business, so businesses can recognise you without being able to match you with each other.
• You sign in on the business's own page, or with your email or phone and a code, on a card in the chat. Nox never sees a password or a code.
• An order or change the business proposes comes to you on an OK card with the business's own terms, and the business does it only if you approve that exact version.

nox.cool now speaks the Personal Agent Protocol, an open way for a business to work with AI agents in the open. At a business that takes part, Nox uses the business's own system instead of its website, you sign in on the business's side without giving Nox a password, and every order the business proposes waits for your approval of its exact terms. It's available today in nox.cool's early access.

#Why do AI agents need a protocol at all?

Ask an AI agent to change a booking or reorder something today and it does what you'd do: opens the website, finds the page, fills in the form. That works, but badly for everyone:

• Businesses can't tell who's there. An agent looks like a person, or like a bot to be blocked. Many sites throw puzzles at anything that clicks too fast.
• Signing in is risky. The usual way is giving the agent your password, or letting it type a saved one. Either way, that password can do everything you can.
• Pages change. A redesigned checkout breaks the agent halfway through an order.
• Nobody agrees on what was approved. The agent says you said yes; the business has a form that was submitted.

nox.cool already handles the worst of this: Nox works on its own computer, its saved logins are typed by the computer (the AI never sees them), and it asks before anything important. But a business that wants to welcome agents had no standard way to do it. Now it has one.

#What is the Personal Agent Protocol?

The Personal Agent Protocol, Poppy for short, is an open protocol for how a personal AI agent works with a business for one person. Sierra and Meta introduced it in October 2026. Version 0.1 was published on 9 October and version 0.2 on 24 October; the protocol's authors are writing version 0.3 in the open.

It covers the whole visit, not just the conversation:

• Finding the business: a file the business publishes at /.well-known/poppy.json.
• Sessions and sign-in: how the agent proves which agent it is, how the business recognises the person, and how the person signs in.
• The business's systems: the APIs an agent may use, described in standard formats.
• Actions: an optional part called operations, where the business proposes an action with exact terms and the person approves that version.

The business stops guessing who's there, and you stop handing out passwords.

Here's how Nox uses each part, and what keeps you in charge at every step.

#How does Nox know a business takes part?

When you name a business in a task, Nox looks for its file first. Before trusting it, Nox checks it two ways, as the protocol requires:

1. The file must speak for the website that served it. A copy on another site is refused.
2. The business's sign-in server must list that website as its own. So one site can't claim another business's sign-in and collect its passes.

Nox also checks the version. Before 1.0, each version can change the rules, so Nox only uses businesses on version 0.2 and tells you plainly if a business uses another one. If a business doesn't take part at all, Nox carries on with its website as before.

#A private ID at every business

To work with a business, Nox has to tell it which person it's acting for, without telling it who you are. So nox.cool gives you a random ID at each business. It isn't made from your email, your name or anything else about you, and it's different at every business, so two businesses can't compare notes and work out it's the same person. The business recognises you across visits (a cart stays your cart) but knows nothing more until you choose to sign in.

Each ID also comes with its own private key, used to prove every request. Nox keeps the list of which ID is yours where, and never shares it.

#Every request proves it's really Nox

nox.cool publishes who it is at a public address: its name, logo and its public keys. Every time Nox asks a business for access, it signs the request with nox.cool's private key, which never leaves nox.cool. Calls to the business's systems also carry a fresh proof signed by your ID's key.

What that means in practice: if anyone copied a pass Nox holds for you, it would be useless to them without the key it's bound to. (A few older systems don't check keys yet; the protocol lets them take a pass that works at that one system only.) And businesses can tell, on every request, that it's nox.cool acting for one of its users, not a script pretending to be you.

#How do I sign in at a business through Nox?

Nox doesn't ask you to sign in until a task needs your account. Looking at stock or prices usually works signed out. When it does need your account, a card appears in the chat. Depending on what the business offers, the card does one of three things:

• The business's own page. One tap opens the business's sign-in page. You sign in there however you normally do and approve what Nox may do, then you're back in the chat. Nox checks the answer really came from that business before keeping anything.
• A link and a code. You open the business's link on any device and enter the code shown. Nox checks the link belongs to the business before showing it.
• Your email or phone, then a code. Only when the business asks for nothing secret. You type your email on the card, the business sends you a code, and you type the code on the card.

Whatever you type on these cards goes from nox.cool to that business only. Nox, the AI, never sees it. And if a business asks agents for a password, Nox refuses and asks you to sign in on the business's own website instead.

After you sign in, nox.cool keeps a pass from the business, sealed, that lets Nox start signed-in visits without asking again. It's useless without nox.cool's key, and you can cancel it at any time.

#How does Nox place an order?

This is the part the protocol calls operations, and it's where agents usually go wrong. Here's how it works:

1. Nox asks the business for an order. Asking is itself a change, so Nox shows you the request first ("order three 8×10 prints"), unless you've told it that's fine at this business.
2. The business proposes, but doesn't act yet. It answers with an operation: a plain-language summary, the terms (item, quantity, price, delivery), and how long the offer stands.
3. Nox reads it straight from the business and puts the business's own summary and terms on an OK card, the terms listed one by one, so you can see if they ever disagree with the summary.
4. You approve that exact version. Nox confirms it, and the business performs exactly what that version says, once. Confirming twice can't order twice.
5. If the business changes anything, a new size or a new price, it's a new version, and you're asked again.

The card never shows Nox's own retelling of the order: it's built from what the business sent. Nothing Nox or a message from the business says can approve it for you; only your tap on the card can. When the terms carry an amount, the card counts as money, so it asks for Touch ID or Face ID if you've turned that on in Settings. Decline, and Nox tells the business, so the offer can't be confirmed later by mistake.

#A real task, start to finish

Here's what a task looks like, from our own testing against a test business that follows the protocol to the letter. The task: "Check my rewards points, then order 3 prints of Yellow Poppy. I'm happy to sign in."

1. Nox looked the business up and checked its file against its sign-in server.
2. It read the business's API: who you are, rewards, orders.
3. Seeing that both rewards and ordering need your account, it asked to sign in once, with permission to make changes.
4. The sign-in card opened the business's page; signed in, Nox carried on.
5. It read the rewards: 1,250 points.
6. It asked before sending the order request, and the business answered with a proposal: 3 prints, $13.50.
7. The terms went on a second card. Approved, the business placed the order and said so.

The whole task took under a minute and cost between 20 and 35 cents across our runs. Nothing was ordered until the second approval.

#What can I control?

Everything lives in Settings › Connections › Businesses: every business Nox has worked with for you, whether you're signed in, and what Nox may do there.

• Read only: Nox looks, and never changes anything there.
• Ask first (the default): anything that changes something asks you.
• Allowed: changes run without asking, except an order or change the business proposes, which always asks, and anything that would send a card, bank or ID number or health details, which also asks.

Sign out cancels Nox's pass at the business too, not just here, and forgets your ID there: next time, it's a new one. Deleting your nox.cool account does the same at every business.

#What Nox doesn't do

To be clear about the edges:

• Most businesses don't take part yet. The protocol is weeks old. Everywhere else, Nox uses the website, with the same asking first.
• Nox doesn't talk to a business's own agent. The protocol describes that, but Nox works through the business's systems and your sign-in.
• Nox doesn't browse the business's website signed in through the protocol. When it needs the website, it uses it as before.
• No passwords through Nox. A business that wants your password from an agent is refused.

#Questions and answers

What is the Personal Agent Protocol? An open protocol for how a personal AI agent works with a business for one person: finding the business, proving which agent it is, signing the person in, using the business's systems and getting approval for actions.

What is poppy.json? The file a business publishes at /.well-known/poppy.json to take part. It names the business, its sign-in server, the ways to sign in and the systems agents may use.

Is it safe to let an AI agent sign in to my accounts? Through the protocol, you never give the agent a password. You sign in on the business's side, and the pass Nox gets is useless without nox.cool's key. Cancel it from Settings at any time.

Can an AI agent buy things without my permission? Not on nox.cool. Every order a business proposes waits for your approval of its exact terms.

#Try it

Sign in to nox.cool and ask Nox for something at a business you use, naming its website. Nox tells you whether the business takes part, and if it does, works with it this way. The short version of this release is in nox.cool now supports the Personal Agent Protocol.