A patient calls a health system, confused by a medical bill. They speak with an AI agent named Kora. Instead of being transferred to a human or navigating a phone tree, the patient resolves the balance in the same conversation. At the moment of payment, the agent shifts into a secure mode. The patient enters card details on the phone keypad. The digits route to Stripe, the payment clears, and the agent comes back on the line to confirm it and send a receipt. The agent never sees the card number, only payment status and the last four digits.
The workflow went live October 20, per a Sierra blog post describing its Stripe integration, and it is the clearest sign yet that the money layer of agentic commerce is arriving through product integrations rather than the protocols meant to govern it. Cedar, which helps health systems and physician groups with medical billing, was one of the first companies taking payments over the phone this way. \”Medical bills create a moment of real anxiety for patients, and historically, getting a question answered and actually paying the bill have been two separate, disconnected steps,\” said Dugan Winkie, Cedar’s chief strategy officer. \”Working with Sierra and Stripe, we’ve closed that gap. A patient can call confused about a charge and leave the conversation with clarity and a resolved balance, in the same call.\”
Between October 13 and 16, JPMorgan, Bank of America, Citi and Schwab locked third-party AI agents out of customer accounts, and the pattern underneath was the same one that produced this month’s bank lockouts: an agent holding a customer’s credentials is an agent the bank cannot tell from a thief, and the liability for what it does lands somewhere nobody has agreed on. Sierra’s answer is to make the question moot for the credential itself. The architecture, introduced in April as the first Level 1 PCI-compliant payment capability for AI agents and verified through the Visa Global Service Provider Registry, routes keypad digits directly to the payment processor in secure payment mode. The prompts in that mode follow a predetermined, server-validated sequence rather than anything the model generates. Cardholder data stays isolated from Sierra’s platform, and the agent receives only status and the last four digits. \”PCI compliance is non-negotiable for us, but so is delivering a seamless customer experience,\” said Wayne Thorsen, COO of SiriusXM, which runs payment calls through the same flow. \”SiriusXM listeners call every day to update their payment information or pay a balance. With Sierra’s secure voice payment flow, customers can resolve payment needs easily – without requiring a live agent or a frustrating IVR experience – while meeting the strict PCI compliance standards our business demands.\”
Strip away the mechanism and the shape of the transaction is older than the agent: a human keys card digits into a phone while software waits. That is agent-facilitated payment, not agent-initiated payment. The distinction is the whole distance between this launch and the thing the banks were locking doors against. A credential the agent never holds cannot be stolen from the agent. But the agent still initiates the payment flow, frames it, and confirms it, and the banks’ sharper question – who is liable when software drives a transaction the customer only dimly follows – does not disappear because the card number stayed out of the model’s context window.
Sierra reports that 71.3% of calls where patients start a payment with Kora end in a successful payment, and that an unnamed financial-services firm hit an 85% resolution rate automating card activation over voice. Both figures are vendor-reported, scoped to the named deployments, and come with no published methodology. The structure they imply is worth naming anyway: the assisted version of agent commerce, where software runs the conversation and the human runs the money, is the part that is working now.
The ordering here is the same one this beat has watched for a month. The Personal Agent Protocol that Sierra and Meta announced October 6 handles authentication and consumer control, and explicitly leaves payments to later: \”Payments extensions could let a personal agent complete a purchase without sharing credit card information.\” The money layer was a roadmap sentence. It arrived this week as a Sierra product integration with Stripe, and Sierra says it is working with Stripe and other partners on how payments should work when a personal agent acts on someone’s behalf – announced, not shipped.
One disclosure on the record itself: there is no Stripe newsroom release for this partnership. The announcement lives on Sierra’s blog alone, and the claim that Sierra is now listed in the Stripe App Marketplace, so businesses can connect an agent to their Stripe account without a one-off integration, is Sierra’s own. Stripe’s agent-payment pages do not mention Sierra or phone flows. A one-sided record is not a red flag, but it is a fact about how much of this story is currently attested by the company taking the money.
For now the money layer of agentic commerce has arrived where few protocol maps drew it: down a phone line, through a keypad, into Stripe, with the agent watching the status and the last four digits and nothing else. The credential problem is answered. The liability problem is untouched, and it is the one the banks actually named.
