Inspiration## Inspiration
The emergence of autonomous agentic commerce introduces an unprecedented security vulnerability: indirect prompt injection. When autonomous AI shopping agents navigate third-party product catalogs, parse untrusted web markup, or digest seller reviews, adversaries can embed prompt injections designed to hijack the agent’s logic. The hijacked agent can easily be coerced into draining balances, rerouting payouts to unauthorized merchant accounts, or running infinite rogue purchase loops.
Treating probabilistic Large Language Models as direct custodians of financial credentials (such as PayPal API keys or sensitive authorization tokens) is fundamentally flawed. We built AegisMandate to solve this core dilemma—establishing an immutable, deterministic containment plane that permits cognitive AI agents to find deals and formulate purchase proposals while mathematically barring them from holding payment credentials or executing financial transfers directly.
What it does
AegisMandate enforces an untrusted-by-default, Two-Gate Dual-Plane Containment architecture between cognitive AI shoppers and payment rails:
Dual-Plane Separation:
- Cognitive Agent Plane (Untrusted): AI agents operate inside an isolated sandbox with zero access to PayPal keys. The agent is strictly constrained to proposing structured purchase intents (
PurchaseIntent). - Mandate Control Plane (Deterministic): An isolated control runtime that holds the real financial authority and policy enforcement logic.
- Cognitive Agent Plane (Untrusted): AI agents operate inside an isolated sandbox with zero access to PayPal keys. The agent is strictly constrained to proposing structured purchase intents (
Two-Gate Security Enforcement:
- Gate 1 (Deterministic Policy Evaluation): A strict 13-rule policy engine verifies merchant identity via an authorized registry, validates payee cryptographic fingerprints, cross-references catalog price baselines, and checks current budget quotas. Malicious injection attacks (such as unauthorized $500 transfers to attacker storefronts) are denied instantly (0 outbound network calls to PayPal).
- Gate 2 (Human-in-the-Loop Step-Up Verification): Low-risk transactions under the micro-approval threshold ($30.00) flow automatically to order creation and capture. Mid-tier transactions ($30.00–$80.00) enter a deterministic step-up queue requiring canonical SHA-256 payload authorization from the owner before any PayPal session is instantiated.
Tamper-Evident SHA-256 Audit Ledger:
- All state transitions, fund reservations, and capture completions are committed using SQLite
BEGIN IMMEDIATElocks into an append-only ledger linked by sequential SHA-256 cryptographic hashes. - If an unauthorized party or compromised container modifies a single character in the database, the interactive Ledger Integrity check immediately identifies the corruption (
TAMPERED).
- All state transitions, fund reservations, and capture completions are committed using SQLite
How we built it
- Backend & Policy Engine: Implemented using Node.js, TypeScript, and Fastify, executing rule-based deterministic finite-state validation without relying on probabilistic model outputs for financial security boundaries.
- Payment Processing: Integrated with the PayPal REST API (Orders v2 Sandbox) for compliant two-phase order creation and fund capture, executed solely by the isolated Control Plane.
- Cryptographic Storage: SQLite with Write-Ahead Logging (WAL) and strict
BEGIN IMMEDIATEisolation, maintaining a sequential SHA-256 cryptographic hash-chain across all recorded transactions. - Interactive Control Dashboard: Engineered with React, Vite, and Tailwind CSS, featuring real-time budget telemetry, an interactive attack simulation suite, and cryptographic ledger verification tooling.
- Verification & Testing: Comprehensive end-to-end testing via Vitest (240+ passing unit and integration tests) and automated browser verification via Playwright.
Challenges we ran into
- Preserving Agent Autonomy Without Sacrificing Determinism: Ensuring the AI shopper retained flexible product discovery capabilities while maintaining a zero-trust perimeter where it cannot alter budget ceilings, merchant payees, or TTL timestamps.
- Ledger Concurrency & Anti-Tampering Guarantees: Preventing double-spend race conditions across concurrent purchase intent submissions while maintaining sequential SHA-256 hash continuity. Solved via SQLite atomic transaction locking and canonical JSON serialization.
- Headless Payment Automation: Automating buyer approval flows within the PayPal Sandbox using Playwright without triggering anti-bot hurdles or exposing production secrets.
Accomplishments that we're proud of
- True Zero-Credential Exposure: Autonomous AI shopping agents complete realistic multi-item purchases without ever having access to PayPal credentials or payment APIs.
- Total Indirect Prompt Injection Immunity: Verified deterministic gapping that thwarts prompt injection exploits before any outbound payment connection can occur.
- Robust Quality & Rigor: Built an end-to-end verified codebase backed by 240+ unit and integration tests with zero linting, type-checking, or secret-scanning alerts.
What we learned
Financial safety for autonomous AI cannot rely on prompt engineering, system instructions, or model alignment. Probabilistic models require mathematical, deterministic containment planes at the runtime and protocol level to guarantee asset protection.
What's next for AegisMandate
- FIDO2 / WebAuthn Step-Up Signatures: Incorporating hardware security keys (Passkeys/YubiKeys) for human owner approvals on high-value step-up purchases.
- Decentralized Ledger Receipts: Publishing periodic cryptographic hash roots to verifiable public data registries or decentralized identifiers (DIDs) for non-repudiation.
- Hierarchical Fleet Mandates: Scaling from single-shopper containment to partitioned enterprise agent fleets operating under bounded budget allocations.
Log in or sign up for Devpost to join the conversation.