AGENT GATE — Human-Controlled AI Payments

Inspiration

AI agents are becoming capable of researching products, recommending purchases, and initiating transactions. But giving an AI agent unrestricted payment authority introduces serious risks.

What happens if an agent misunderstands a request? What if a payment API times out after completing a transaction? Could the agent accidentally charge the customer twice?

We built AGENT GATE to address these problems.

Our guiding principle is simple:

AI proposes. Policy decides. Humans approve. PayPal executes. Evidence verifies.

What it does

AGENT GATE is a human-controlled payment authorization prototype for AI-powered commerce.

Instead of allowing an AI agent to execute payments directly, AGENT GATE introduces several safeguards:

AI-generated proposals: A local AI model can prepare a structured transaction proposal.
Deterministic policy enforcement: Payment requests are checked against predefined limits and restrictions.
Human approval: Explicit authorization is required before payment execution.
PayPal Sandbox integration: Approved transactions can be processed through PayPal's Sandbox APIs.
Durable transaction records: State transitions and evidence are stored for later inspection.
Duplicate-payment protection: The system blocks unsafe repeated capture attempts.
Evidence-based reconciliation: When a payment outcome is uncertain, the system checks the existing transaction instead of blindly executing it again.

The AI assists with decisions but does not receive unrestricted financial authority.

How we built it

AGENT GATE V14 was developed as a lightweight Python application using:

Python for the application and policy logic
PayPal REST APIs in Sandbox mode
SQLite for durable transaction state
Ollama and Qwen3 for optional local AI-generated proposals
Python unittest for automated regression testing

The architecture separates AI-generated information from trusted authorization and payment execution.

A proposal must pass deterministic checks before it can advance to a human approval stage. Payment execution and reconciliation are handled separately from the AI model.

The implementation is intentionally lightweight, making the design understandable and reproducible without requiring a large cloud infrastructure.

Challenges we faced

1. Preventing AI from becoming the payment authority

AI-generated suggestions are inherently untrusted. We designed a clear boundary between recommendations, policy enforcement, human authorization, and actual payment execution.

2. Handling uncertain payment outcomes

The most important challenge was dealing with a transaction that could have completed externally even when local verification had not yet succeeded.

In a real PayPal Sandbox test using the V12 implementation, the capture operation produced a completed PayPal transaction, but immediate local verification remained inconclusive.

Instead of repeating capture, AGENT GATE performed reconciliation against the existing transaction.

The same case was subsequently verified as COMPLETED on PayPal and CAPTURED locally.

This demonstrated the importance of verifying existing payment evidence before attempting another financial operation.

3. Maintaining trustworthy evidence

We separated actual PayPal Sandbox execution evidence from simulated and automated test results.

The historical V12 payment result is preserved as historical evidence. V14 includes subsequent implementation improvements and regression tests; we do not claim that the historical payment was newly executed using V14.

Accomplishments

Demonstrated a complete human-authorized payment flow in PayPal Sandbox using V12
Verified recovery from an inconclusive payment outcome without a second capture
Developed V14 with additional provenance and regression protections
Passed the V14 local automated regression suite
Released the source code under the MIT License
Prepared a demonstration showing actual local application operation and clearly identified historical Sandbox evidence

What we learned

The hardest problem in agentic commerce is not simply enabling an AI to call a payment API.

It is ensuring that an uncertain AI decision or network response cannot silently become an unauthorized or duplicated financial action.

We learned that durable state, explicit human authority, deterministic rules, and reconciliation are essential components of trustworthy AI-powered payments.

What's next

AGENT GATE is currently a Sandbox-only research prototype, not a production-ready payment platform.

Potential future improvements include stronger user authentication, webhook verification, distributed idempotency, production-grade authorization controls, additional payment-provider integrations, and independent security testing.

Our long-term vision is to make AI-assisted commerce safer while keeping humans in control of financial commitments.