Real PayPal sandbox capture: USD 42 of snacks allowed by the spending mandate.
Mandate editor: six spending checks and a USD 100 human-approval threshold.
Tamper demo: editing row 2 breaks verification at row 2; earlier decisions remain visible.

Inspiration

AI purchasing agents can restock supplies, buy ad credits, and pay for services. But a spending instruction in a prompt is not a finance policy. Teams need an enforcement point before payment, human review for larger purchases, and a record of why money moved.

AgentGuard explores that boundary: AI understands the request. Code decides. PayPal executes.

What it does

AgentGuard is a local, working spend-policy prototype for teams experimenting with AI purchasing agents.

Set a mandate. Finance defines six checks: monthly budget, per-transaction cap, approved vendors, category limits, spending velocity, and a human-approval threshold.
Extract intent. OpenRouter's nvidia/nemotron-3.5-lightning:free model turns a plain-English request into vendor, amount in integer cents, and category. The output is treated as untrusted and validated.
Decide deterministically. Hard policy violations produce DENY. Requests at or above the approval threshold produce ESCALATE. Otherwise the request is ALLOW. Budget and velocity checks use recorded spending, not a zeroed demo counter.
Execute through PayPal. ALLOW creates a sandbox order with intent: AUTHORIZE, uses the embedded authorization returned by the card-order flow, and captures the approved amount. An escalated request waits for a human to approve or reject it. A policy denial does not call PayPal.
Verify the trail. Decisions are appended to a SHA-256 hash-chained SQLite ledger. The auditor page verifies it and includes an explicitly labeled demo control that alters a row to demonstrate detection.

The submitted screen recording shows real OpenRouter extraction and PayPal sandbox captures: a $42 purchase is allowed, an unapproved vendor is denied, a $150 purchase waits for approval, and editing row 2 breaks ledger verification at row 2. Network waits are condensed. Narration is AI-generated. No real funds move.

How we built it

Next.js 15, React, and TypeScript: mandate editor, decision dashboard, audit view, and API routes.
PayPal developer platform: OAuth2 client credentials, Orders v2 order creation with authorization, and Payments v2 capture. PayPal is the execution path, not a decorative checkout link.
OpenRouter / NVIDIA Nemotron: natural-language intent extraction only. The LLM does not make the policy decision or edit the mandate.
Node.js built-ins: node:sqlite for the durable ledger, node:crypto for SHA-256, and node:test for automated checks. Amounts use integer cents.

The UI runs locally against PayPal's free sandbox. The source repository is public and MIT-licensed.

Challenges we ran into

PayPal card-order semantics. Authorizing a card at order creation returns the authorization inside the create response. A second authorize call is wrong for that flow. We tested the real sandbox and used the embedded authorization; PayPal-Request-Id accompanies order creation.

Slow or unreliable model responses. The free model's latency varied. We added bounded timeouts and a single retry for transient extraction failures. Invalid intent fails closed rather than inventing a purchase.

Accurate policy context. Monthly budgets and velocity must count actual captured spending. The policy context comes from ledger ALLOW records, with UTC month boundaries and normalized vendor/category comparisons.

Visible failure states. Dependency errors are not reported as successful payments. Failed captures are recorded; escalated approvals remain retryable on capture failure.

Accomplishments

A coherent workflow: mandate editor → natural-language request → policy outcome → human review when needed → PayPal execution → audit view.
Real PayPal sandbox capture IDs visible in the recorded application.
93 automated tests passing, and TypeScript typechecking passing during submission preparation.
Tests cover policy boundaries, intent parsing, validation, approval paths, capture errors, and chain integrity. External services are mocked in the automated suite; the recorded demo separately exercises the real sandbox and model.
No product-code changes or mocked API responses were needed to record this submission.

What we learned

Put money calculations in integer minor units. Validate before making external calls. Measure model latency rather than guessing. Keep the language-model interpretation layer separate from the deterministic authority that permits spending. And distinguish tamper evidence from a stronger security guarantee.

Running and testing

Repository and setup: https://github.com/amgainprabesh/agentguard

Use Node.js 24 or newer:

Clone the repository and run npm install.
Copy .env.example to .env.local. Create a free PayPal Developer sandbox application and enter its Client ID and Secret. Add an OpenRouter API key for the configured model. The README links to both services; no production payment credentials are required.
Run npm run dev and open http://localhost:3000.
Run npm test and npm run typecheck. The automated tests do not need API credentials.

The decision dashboard already uses a sandbox test card. For the video's sequence, set the approval threshold to $100, then request $42 of snacks from acme.com, $20 of snacks from evil.com, and $150 of ads from globex.com. Approve the last request, open the audit view, and run its tamper demonstration. Use a fresh demo ledger; the README explains reset and repair commands. Those commands intentionally alter demo data.

Limitations and what's next

This is a localhost sandbox prototype, not production payment infrastructure. There is no account-level authentication; pending approvals are held in memory; concurrent budget checks need transactional reservations and stronger payment-retry idempotency. A hash chain detects simple row changes but is not externally anchored and cannot stop a database administrator from rewriting or deleting the entire ledger. Model output cannot rewrite the rules, but intent extraction can still be wrong or influenced by prompt injection. Known dependency/security limitations are documented in the repository.

Next: authenticated per-agent mandates, durable approval queues, concurrency-safe budget reservations, tokenized payment methods, PayPal webhook reconciliation, and externally anchored audit checkpoints.