Agentic-Checkout

An AI shopping agent that finds gifts and builds your cart, but can't spend without your approval. Server-side guardrails enforce your budget, and PayPal handles the payment.

Comment

Inspiration

AI agents can already search catalogs and fill carts, but nobody trusts them with a payment method. A model can misread a price, overspend, or be steered by text hidden in a product listing. We wanted to find out what it would take to let an agent shop for you without handing it your money.

What it does

You ask in plain language, for example "Find a gift for my sister under $50, arriving by Friday." The agent searches the catalog, picks a product, and proposes a cart with a short reason for its choice.

It can't charge anything itself. Server-side guardrails check the cart against your spending mandate: a budget cap and allowed categories. The total is recalculated from the catalog, never taken from the model. If the cart passes, you approve it and pay through PayPal. The server creates and captures the order, and every step goes into an audit log.

How we built it

  • Agent: Claude Haiku 5.5 on Amazon Bedrock, using the Converse API with tool use. The tools are search_products and propose_checkout, and the agent streams its progress to the UI.
  • App: Next.js (App Router) with TypeScript. The API routes cover chat, mandate, cart, PayPal create-order, capture and webhook, and the audit log.
  • Guardrails: Server-side checks for the budget cap, allowed categories, and delivery date. Product descriptions are treated as untrusted data.
  • Payments: PayPal sandbox. Orders are created and captured on the server, and the webhook signature is verified through PayPal's API.
  • Storage: DynamoDB for carts, mandates, orders and the audit log. Locally it falls back to in-memory storage.
  • Deployment: Docker image on AWS ECS behind an Application Load Balancer, with an ACM certificate so the app is served over HTTPS at techdaari.com. Secrets live in AWS Secrets Manager and SSM.

Challenges we ran into

  • Bedrock setup. We first used the inference profile's display name instead of its ID, which Bedrock rejected as an invalid model identifier. The newer model also rejects the temperature setting, so we removed it.
  • Tool results. Bedrock only accepts JSON objects in tool results, so the array returned by product search had to be wrapped in an object.
  • Hosting. AWS App Runner wasn't available on our account, so we moved to ECS with a load balancer and a certificate.
  • Security review. An automated review flagged that carts, orders and audit entries weren't tied to a session, and that the chat endpoint had no input limits. We tightened session ownership and added validation.

Accomplishments that we're proud of

  • A full flow that works end to end: a natural-language request, an agent-built cart, guardrail checks, approval, a PayPal sandbox payment, and an audit trail.
  • The agent never sees payment credentials and can't exceed the mandate, even if the model gets something wrong.
  • It's deployed and live over HTTPS, and the code is public.

What we learned

  • Put the control around the model, not inside the prompt. Guardrails in code hold up when the model makes mistakes.
  • Never trust model-generated numbers. Recalculating totals on the server removes a whole class of errors.
  • Anything a model reads, such as product descriptions, can carry instructions, so it has to be treated as data.
  • Small API details, like model IDs versus profile names and the shape of tool results, can take up as much time as the main feature.

What's next for Agentic-Checkout

  • Per-user spending mandates that people can set and edit in the UI.
  • Rate limiting and server-issued sessions for production use.
  • A real product catalog and a live PayPal merchant integration.
  • Multi-merchant carts, plus returns and refunds handled through the agent.
  • Rolling out the PayPal webhook for confirmed payment status in the audit log.

Built With

Share this project:

Updates

Submission history