Inspiration: Shopping agents are getting good at finding things to buy, but paying is where trust breaks down. Handing an agent your payment access means handing over everything, and a human approval step for every purchase defeats the point of automation. A single bad instruction, even one hidden inside a product page, could drain a balance. We wanted agents to spend real money safely, so we built a checkpoint that sits between the agent and the payment What it does: AgentGuard follows one principle: the AI proposes, your rules decide. The agent never pays directly. It submits a purchase request, and AgentGuard evaluates it before any payment step:
- Task match: does the item match what the user actually asked for?
- Hidden-instruction scan: is the product page trying to manipulate the agent?
- Budget: per-purchase limit and total budget
- Merchant: minimum rating and registered merchants only
- Category and return policy: approved categories only, and a return policy is required
The outcome is one of three:
- Approved:every check passes and the payment proceeds.
- Blocked:any check fails and no payment is attempted.
- Held for review:the purchase is safe but above the user's approval threshold, so it waits in an approval queue for a human decision.
If a check can't run, the system fails closed and blocks the purchase. Every decision is saved to an exportable audit ledger with the reasons.
How we built it:
- A web dashboard with an overview, a rules and settings page, an agent playground, an approval queue, and an audit ledger
- A rule engine that makes every allow, block, or hold decision, with no AI in the approval path
- A shopping agent that can only propose purchases
-- PayPal integration: Once a purchase clears every rule, AgentGuard creates and captures the order through the PayPal Developer Sandbox Orders API (
/v2/checkout/orders) and returns a verified transaction receipt ID. If any rule fails, the PayPal call is never made.
Challenges we ran into:
- Keeping the AI out of the approval decision, so a model mistake can never authorize a payment.
- Detecting instructions hidden in product pages without blocking legitimate listings.
- Designing the middle path: safe purchases that are still too large to auto-approve needed their own hold-and-review flow.
- Writing rejection reasons clear enough for both the user and the agent to act on.
Accomplishments that we're proud of:
- A full flow that approves, blocks, and escalates purchases, with results updating live on the dashboard
- A complete audit trail where every outcome can be traced to specific rules
- Controls simple enough that a non-technical user can set them in a minute
What we learned: The safest design is to separate who suggests from who decides. Keeping decisions in plain, testable rules made the system predictable and easy to explain, and the fail-closed default made it safe to experiment with.
What's next for AgentGuard:
- Live merchant reputation data instead of a fixed registry
- Spending limits across time windows and sessions
- Separate policy profiles for different agents
- Live payment processing beyond the demo environment
Built With
- fastapi
- groq
- json
- llm
- next.js
- paypalsandbox
- postgresql
- python
- react
- render
- restapi
- tailwindcss
- uvicorn
- vercel
