AegisFlow

Your AI agent just tried to pay $480 to a stranger. AegisFlow stopped it in under a millisecond, on a laptop.

Comment

Inspiration

Picture this. You give an AI agent your PayPal and ask it to restock some cables. It finds a "great deal", pastes the customer's phone number into the order note, and pays a payee it has never seen in a country flagged for fraud. Nothing about that is science fiction. Agents already act this fast, and most of them have no brakes.

I'm a student in Pakistan building on an M2 MacBook Air, and I kept asking one question: what would it take for me to actually trust an agent with money? My answer had three parts. It should never leak private data. It should never break a spending rule, no matter how confident it sounds. And when something goes wrong, I should be able to prove exactly what it sent. I also wanted every check to run locally and fast, because a safety check that slows you down is a safety check people switch off.

What it does

AegisFlow is a checkpoint between an autonomous agent and the PayPal Orders v2 API. The agent can try anything. Only orders that pass every check ever reach PayPal. When the agent tries to create an order, AegisFlow:

  1. Scrubs personal data out of the order inline. Emails, phone numbers and card numbers become [REDACTED] before anything is signed or sent.
  2. Scores the order with a small risk model that runs on the Apple Neural Engine. It looks at the amount, the payee, the country risk, recent order velocity and whether any sensitive field slipped through.
  3. Checks the order against Cedar policies. One rule blocks any order over $50.00 unless it carries a verified receipt, another blocks risky orders.
  4. Signs the canonical order body with Ed25519 and attaches the signature as custom_id (c2pa:ed25519:...), then verifies it again before submitting.
  5. Sends allowed orders to PayPal Orders v2 (OAuth token, create order, capture). Blocked orders never leave the machine.

Every order shows up live in an AG Grid table in the dashboard, with the Cedar decision, the risk score, the redaction count and the receipt. A pipeline timeline shows how long each stage took for each order, in microseconds. You can open any row and inspect the signed receipt JSON.

In the demo the test orders behave like this: a $42 order from a known payee is allowed and goes through, a $480 order to a new payee in a high-risk country is denied, and a $25 order where redaction was switched off is denied because a raw card number was still in the payload.

How we built it

  • Rust workspace. adapter-paypal holds the order middleware, aegis-governance holds Cedar, redaction and the Ed25519 receipts (ed25519-dalek), and aegis-daemon is an Axum server with a WebSocket feed for the dashboard.
  • Risk model. A small CoreML FP16 model trained on synthetic sessions. Apple's MLComputePlan reports all 36 of its operations running on the Neural Engine. It looks at the last 64 events of a session, so a burst of orders raises the risk even when each order looks fine alone.
  • Policies. Written in Cedar with a strict schema, in policies/aegis_rules.cedar. Evaluating a request takes 4.21 microseconds at the median.
  • Dashboard. Plain HTML, CSS and JavaScript with AG Grid Community for the orders table and a custom SVG timeline.
  • PayPal. The middleware speaks PayPal Orders v2 (OAuth2 client credentials, create, capture, PayPal-Request-Id idempotency). With Sandbox credentials it calls the PayPal Sandbox. Without them it uses a local Orders v2 emulator that I built into the server, because I could not open a PayPal account from Pakistan. Every emulator response is labelled as local.

Measured on my M2 for each order: redaction 19 microseconds, Ed25519 signing 18 microseconds, verification 40 microseconds, the whole prepare step 275 microseconds at the median.

Challenges we ran into

  • PayPal account sign-up does not work from Pakistan, so I could not get Sandbox keys. I built a local Orders v2 emulator that follows the published API shapes so I could still test the full HTTP flow.
  • Getting the risk model onto the Neural Engine was harder than expected. Small models stay on the CPU no matter what you ask for, so I had to redesign the network until MLComputePlan placed every operation on the Neural Engine and it was still faster than running on the CPU alone.
  • Redaction has to happen before signing, otherwise the receipt proves the wrong thing. Ordering those steps correctly and testing it took a few tries.

Accomplishments that we're proud of

  • A bad order never leaves the laptop. In the demo the $480 order to a new payee and the $25 order with a raw card number are both stopped before any network call. The $42 order goes through with a receipt anyone can verify.
  • It is faster than a blink. The risk model plus the Cedar decision take 0.195 ms at the median. An agent can call this on every single order and nobody will notice.
  • You can see everything. Every order lands in an AG Grid table with its decision, risk score, redactions and signed receipt, and a timeline shows each stage in microseconds.
  • The numbers are real. Every number in the dashboard and the README comes from a measured run on my M2. Nothing is typed in by hand.

What we learned

  • On-device AI is fast enough to sit in the payment path, but you have to check where the model actually runs. The Neural Engine only picks up models with enough work in them.
  • Deterministic policy rules are a good partner for a learned risk score. The model catches odd patterns, and Cedar makes the hard limits easy to read and audit.

What's next for AegisFlow

  • Run the full flow against the real PayPal Sandbox as soon as I can get access.
  • Add more Cedar rules for refunds and subscriptions.
  • Let a team approve risky orders from chat (the approval flow already exists for code changes).

Tools used (model or AI service)

  • On-device risk model: my own CoreML FP16 model, running on the Apple Neural Engine.
  • NVIDIA Nemotron (through OpenRouter) and Tavily search, used by the code-repair side of AegisFlow.
  • I used Claude Code as a coding assistant while building the project.

Testing instructions

Needs a Mac with Apple Silicon (the risk model runs on the Neural Engine).

git clone https://github.com/whatever0148-cmd/AegisFlow && cd AegisFlow
bash harness/console.sh

Open http://127.0.0.1:4173 and click the four order cards in Panel 2. No keys are needed: without PayPal credentials, orders go to the built-in local Orders v2 emulator. To use the real PayPal Sandbox, add PAYPAL_CLIENT_ID and PAYPAL_CLIENT_SECRET in the Settings drawer.

Built With

Share this project:

Updates

Submission history