• 

• 

• 

• 

• 

• 

• 

• 

AgentGuard: A Secure Payment Gateway for AI Agents

Inspiration

AI agents are becoming capable of shopping, making decisions, and completing transactions on behalf of users. However, this creates a serious security risk. A malicious product page could contain hidden instructions that trick an AI agent into making unauthorized purchases.

We wanted to solve this problem by building a secure middle layer between AI agents and PayPal. Our goal was to give AI agents the freedom to complete legitimate purchases while keeping spending under the user's control. Instead of approving every action manually or giving an agent unlimited access to money, users can define clear rules and require human approval only when necessary.

What It Does

AgentGuard is an AI-powered payment security layer that connects AI agents to PayPal through the Model Context Protocol (MCP).

• Natural-language spending policies: Users can define limits such as weekly budgets, prohibited purchases, merchant restrictions, and approval thresholds.
• AI-powered policy generation: Google Gemini converts user instructions into validated policies, and the confirmation summary is generated from the same policy.
• Multi-layer payment protection: Every payment is checked against deterministic rules, the user's original task, and the content of the web page involved.
• Prompt-injection detection: AgentGuard identifies hidden or suspicious instructions in web pages, including hidden HTML elements, comments, alternative text, and invisible characters.
• Human-in-the-loop approvals: Risky payments can be paused for approval through Telegram or the dashboard.
• Secure PayPal transactions: Payments are authorized before capture, allowing funds to be held until approval. Unauthorized transactions can be blocked, and payment holds can be voided.
• Audit logs and policy simulation: Users can inspect payment decisions, review risk signals, and test new policies against the previous 30 days of activity.
• AI-powered insights: A monitoring dashboard highlights suspicious patterns, unusual refund activity, attack attempts, and budget concerns.

AgentGuard also integrates PayPal's Agent Toolkit, allowing legitimate operations while applying security checks to sensitive actions such as refunds and dispute acceptances.

How We Built It

We built AgentGuard using a combination of backend services, AI models, payment APIs, and an interactive dashboard.

Backend and database: We used TypeScript, Fastify, Prisma, and PostgreSQL to implement the payment security engine and store transaction records. An MCP server exposes tools for starting tasks, requesting payments, checking payment status, and retrieving remaining budgets.

Payment integration: We integrated the PayPal sandbox using Orders v2 for authorization, capture, void, and refund operations. We also used Vault v3, verified webhooks, the Reporting API, and the PayPal Agent Toolkit.

AI and security: Google Gemini processes natural-language policies and evaluates payment risks. Claude is supported as an alternative provider. AI responses use structured JSON validated with Zod. The deterministic policy engine makes the initial decision, and AI checks can increase the risk level but cannot override a policy block or independently lower the risk.

Frontend and analytics: We developed the dashboard using Next.js and Tailwind CSS. AG Grid Enterprise powers the audit log, while AG Charts and AG Studio provide visual insights, custom widgets, and anomaly monitoring.

Human approvals and deployment: We integrated a Telegram bot for payment approvals and deployed the application using Render and Supabase. GitHub Actions periodically pings the database service to help keep it active.

We also created an automated test suite with 89 tests covering the policy engine, risk engine, prompt-injection detection, policy compiler, Gemini adapter, and anomaly-detection rules.

Challenges We Faced

One of our biggest challenges was making AI useful without allowing it to become a security weakness. We addressed this by making deterministic rules the first layer of protection. AI can flag additional risks, but it cannot make a prohibited payment valid.

We also encountered PayPal sandbox limitations when saving a buyer's wallet without completing a purchase. We addressed the onboarding issue using a small $1 authorization that is immediately voided.

Another challenge involved Gemini's tool-calling requirements. We needed to preserve thought signatures across tool calls in our AG Studio adapter. Different free-tier model limits also required fallback strategies, and compatibility requirements between AG Grid and AG Charts meant upgrading both libraries together.

These challenges helped us improve the reliability and security of the complete system.

Accomplishments We're Proud Of

• Built a security layer that can block malicious payment requests before they reach PayPal.
• Designed a policy engine that combines deterministic enforcement with AI-based risk detection.
• Implemented authorization-first payments with human approval before capture.
• Created a dashboard that explains each decision through rules, risk signals, and clear audit records.
• Integrated anomaly monitoring that turns suspicious activity into actionable dashboard alerts.
• Developed and ran 89 automated tests across core security and AI components.

Our biggest achievement is demonstrating that an AI agent can complete legitimate tasks without receiving unrestricted control over the user's money.

What We Learned

We learned that AI agent security must extend beyond the agent's prompt and operate at the level where sensitive actions actually happen.

Even if an AI agent is tricked by malicious instructions, a separate payment security layer can still enforce the user's rules. We also learned that authorization followed by capture is a useful payment pattern for agentic commerce because it creates a clear opportunity for human review before funds are transferred.

Finally, building AgentGuard taught us how to combine AI, payment APIs, structured validation, deterministic security rules, and human oversight into one practical system.

What's Next?

We plan to extend AgentGuard with per-agent API keys and independent budgets, merchant-specific spending limits, and a browser extension that protects PayPal checkout flows initiated by different AI agents.

Our long-term vision is to make AI-powered commerce safer by ensuring that every transaction remains within the limits defined by its owner.

AgentGuard — Let AI handle the shopping. You stay in control of the money.

Built With

• ag-charts
• ag-grid
• ag-studio
• fastify
• gemini
• github-actions
• mcp
• next.js
• node.js
• paypal-agent-toolkit
• paypal-orders-api
• paypal-reporting
• paypal-vault
• paypal-webhooks
• postgresql
• prisma
• react
• render
• supabase
• tailwindcss
• telegram-bot-api
• typescript
• zod