A new subscription channel inside ChatGPT, Claude and Gemini

Research and process

I built the prototype first and treated it as the research instrument: every assumption the business case rested on became something I could break on purpose, before launch rather than in front of customers.

• Failure-first review. I planted the same wrong price in three places: the model's layout, the model's reply and the backend's own data. The engine rejected the first, flagged the second, and couldn't catch the third. That last result set the project's honest limit.

• Host fidelity study. I matched each chat app's real interface from screenshots, not memory: Claude's warm ground and reading column, ChatGPT's app card, Gemini's Material dark. A frame that is only chat-shaped turns a prototype into a mockup. Stakeholders reviewed flows as customers would see them in each channel.

• AI-assisted test harness. AI generated the cases: a seeded fuzzer that plants one violation per layout, and a live model composing layouts from a contract generated from the vocabulary. The harness runs every flow step × 6 session states × 4 layout sources, 1,344 cells in all, through the real engine. To prove the tests themselves worked, I switched rules off and watched them fail. That coverage is what lets a new offer or host ship without a new review cycle.

Key solutions

Risk decides the tier. The vocabulary has three tiers. Tier 1 is 15 display components the model arranges freely. Tier 2 is 7 controls, each wired to one of 19 fixed intents: no custom code, no arbitrary links. Tier 3 is certified: payment and confirmation. The model can request one, and the engine discards whatever it supplied and inserts the audited component. The model gets freedom where it helps conversion, in explaining, comparing and personalizing, and none where it could cost a sale or a customer's trust.

Prices are references, not values. The model writes offer.promoPrice, never $25.99. Every screen passes validation and reference checks before it renders; any failure shows a deterministic fallback, which is tested too. Promotions and price changes ship from the catalog and reach every assistant at once, with no prompt edits.

At the money moment, the agent steps out. Commits bypass the model entirely. Each purchase carries a single-use mandate tied to what was on screen, and a downgrade asks for a second identity check first. The permission prompt above it all belongs to the chat app, because a connector that could draw its own consent screen could grant itself consent. Trust at checkout is what turns a curious question into a paid subscription.

Same card, every host. The card borrows four things from the host: surface, hairline, corner radius and typeface. It never borrows the accent. A purchase button in another brand's color is a purchase that doesn't look like one, so a test fails the build if the card ever reads a host color. SiriusXM stays recognizable in someone else's app, which keeps the purchase attributable to the brand.

Tokens flow from Figma to the chat. Designers edit variables in Figma; Tokens Studio syncs them to GitHub as pull requests, and the build checks branding and 4.5:1 contrast on every host before the card ships. A brand or campaign change reaches all three channels in a single pull request.

Impact

For the business:

A new acquisition channel aimed at the buyers SiriusXM converts least, in the assistants they already use. Three hosts, one integration.

The same move that opens the channel also lowers cost to serve. Every call to the 800 number costs about $0.90, across millions of calls a year. Moving onboarding, plan questions, radio activation and billing disputes into chat projects a ~30% drop in calls once the system launches in Q4 2026: about $270,000 saved for every million calls.

Each deflected call is also a funnel moment:

• Radio activation (conversion): for a used-car trial, activation is the conversion step.

• Plan questions (consideration and upsell): comparisons and upgrades happen in chat.

• Onboarding (early engagement): faster time to first listen.

• Billing disputes (retention): save moments that protect churn, now at a record low of about 1.4%.

Beyond the call center:

• A path to chat commerce that billing, legal and brand can sign off on, because the guarantees are tests rather than promises.

• Three new distribution channels for the cost of one integration.

• A design system that works as a live rulebook for AI, with its own browsable docs that run the same checks as production.

For customers: answers shaped to their own car, usage and plan, in the conversation they started. Prices they can trust, and a clear, safe screen even when the model gets something wrong.

The honest limit: provenance, not truth. The engine proves the price on screen is the price the system holds, not that the catalog is right. And it governs the card, not the sentences around it: a scan flags a wrong price in the model's reply, but can't block it.

Adapting to the market: When ChatGPT retired in-chat checkout in March 2026, the strategy held. Payment is a certified slot, not a screen, so each host gets the best close it supports: a wallet where the chat app offers one, SiriusXM's checkout or app everywhere else. The used-car flow ships first, as stage one of the bet.

What I'd do differently

The gates prove a screen is safe, not that it's good. A layout can pass every check and still put a usage meter above the question it answers, or a disclosure away from its offer. I'd make layout coherence a checked rule from the first week, with the same standing as the price rule, because "safe but clumsy" is still a brand failure, and a conversion leak.

I'd also instrument the funnel from week one, with the same standing as the tests. The engine can prove every price on screen; I want the same proof for every step from first question to activation, so the growth case is as testable as the safety case.