Skip to content
Sill Docs

Agentic checkout (Stripe ACP)

With Stripe’s Agentic Commerce Protocol (ACP), an AI agent buys from your store through Stripe: Stripe runs the checkout and the payment on your Stripe account. Sill’s role on this path will be to apply your guardrails before Stripe charges, and to keep a signed record of the decision and of what was charged.

It differs from Sill’s signed-mandate path, where the agent sends the order to Sill directly. Here Stripe calls Sill, and Stripe owns the payment.

Who does what

Section titled “Who does what”
PartyRole
BuyerPays with their card or wallet inside the agent’s checkout.
Agent platformCreates a single-use Shared Payment Token from the buyer’s payment method, limited to an amount, a currency and an expiry, and gives it to your store.
StripeCharges the token on your Stripe account and pays you out.
SillApproves or declines the order against your guardrails before the charge, and records the decision.

Sill never sees the buyer’s card and never creates, holds or charges the token itself.

How a purchase will flow

Section titled “How a purchase will flow”
sequenceDiagram
    autonumber
    participant Agent as Agent platform
    participant Stripe as Stripe (your account)
    participant Sill

    Agent->>Stripe: Checkout with a Shared Payment Token
    Stripe->>Sill: Approve this order? (answer within 4 seconds)
    Sill->>Sill: Run your guardrails
    alt Approved
        Sill-->>Stripe: approved
        Stripe->>Stripe: Charge your account
        Sill->>Sill: Signed record of the decision
        Stripe->>Sill: Payment events
        Sill->>Sill: Signed record: agent, spend limit, amount charged
    else Rejected or escalated
        Sill-->>Stripe: declined, with the reason
        Sill->>Sill: Signed record of the decline
    end
  1. Before the charge. Stripe asks Sill to approve or decline the order. Sill checks that the request really comes from Stripe, finds your site from your Stripe account, runs your active guardrails and answers. A decline means Stripe does not charge. A site with no published guardrails is always declined.
  2. After the charge. Stripe’s payment events give Sill the agent’s identity, the spend limit on the token and the amount actually charged. Sill adds these to a second signed record linked to the decision.

No human review on this path

Section titled “No human review on this path”

Stripe waits at most 4 seconds for Sill’s answer, which is enough for automated rules but not for a person. So rules behave like this:

  • A reject rule declines the order; Stripe does not charge.
  • An approved order is charged.
  • An escalate rule also declines the order, with a reason ending in hitl_required (for example r05:hitl_required), because there is no time to hold it for review.

If you rely on escalation for large orders, expect those orders to be declined on this path rather than held. See Human in the loop for how escalation works on the signed-mandate path.

See also

Section titled “See also”