Agent-Mandate

Inspiration AI agents can already spend money. The hard part is letting one buy paper without letting it empty your account. Giving a model a wallet means trusting it to respect limits it can be talked out of. We wanted the opposite: a human signs the limits once, and a deterministic guard enforces them no matter what the model does. What it does Agent Mandate gives an AI agent signed, scoped, revocable spending authority on PayPal. A human issues a mandate — total budget, per-transaction ceiling, merchant allowlist, approval threshold, expiry — signed with Ed25519. The agent plans the purchase and calls PayPal tools; every call passes through a guard that resolves the real order amount and merchant before deciding. Allowed, escalated and denied calls all land in an audit ledger. Anything above the threshold is parked until a human approves that exact order, and the approval is consumed so it cannot be replayed. Revoke the mandate and the agent stops immediately. How we built it TypeScript on Node 22, Express API, React 19 console, zod validation, the PayPal Agent Toolkit behind a guard layer, and Gemini through the AI SDK. The guard classifies all 47 PayPal tools, fails closed on unknown ones, reserves budget before a capture and releases it on failure. Tests cover signature forgery, tampered claims, revoked and expired mandates, budget races, concurrent approvals and the invariant that the spend counter equals the committed ledger. The hosted demo replays a real Gemini run for free, and a live chat lets judges ask for any item in their own language against simulated PayPal, with a fresh mandate and ledger per chat. How PayPal is used The agent uses PayPal's own tools to create orders and capture payments. The guard reads amounts and merchants back from PayPal rather than trusting the model's numbers, and the live sandbox path uses the PayPal JS SDK for payer approval. The hosted demo simulates the payment rail so no credentials or money are involved. How AI is used Gemini chooses which PayPal tool to call and explains each decision in the visitor's language. It never sees a payment tool in the chat, only a proposal tool: it can name any item and quote a price, but the server validates the quote and the guard enforces the mandate. Challenges Approvals that outlive their payment, budget races between concurrent captures, and prompt injection trying to widen the mandate. Each became a test and a structural fix: order-bound single-use approvals, reservations, and a guard that never reads limits from the model. Accomplishments One run shows all three outcomes — allowed, escalated and approved, denied — with a verifiable signature. The hosted live chat buys arbitrary items with the real model, and the whole thing runs with no PayPal credentials on the public server. What we learned The model should propose, never authorize. Deterministic policy plus a human approval is what makes agent commerce auditable. What's next Merchant-side trust scoring, multi-agent mandates, and real PayPal production rollout with the same guard.