AgentPay Guard

AI agents can shop. Who keeps them accountable? AgentPay Guard combines enforceable spending policies, AI risk analysis, human approvals, and auditable PayPal payments.

Comment

AgentPay Guard

AI payments. Human control.

Inspiration

AI agents are moving beyond answering questions. They can search for products, compare services, manage workflows, and increasingly initiate purchases.

But giving an AI agent the ability to spend money raises a fundamental question:

Who decides what an AI agent is actually allowed to pay for?

A model might misunderstand a request, encounter malicious instructions, exceed a spending limit, or attempt the same payment twice. A convincing AI-generated explanation is not sufficient authorization to move money.

We built AgentPay Guard to explore a safer approach to agentic commerce: let AI agents propose purchases while keeping payment authorization enforceable, explainable, and accountable.

What It Does

AgentPay Guard is an AI-powered payment governance layer that sits between an autonomous agent's purchase request and PayPal checkout.

Every request passes through three possible outcomes:

  • Allowed: A request satisfies the required policies and can proceed to PayPal checkout.
  • Human Review: A request needs explicit approval from an authorized reviewer before proceeding.
  • Blocked: A request violates enforceable policies and cannot initiate payment.

The system combines deterministic spending policies with contextual AI risk analysis using Meta Muse Spark 1.3.

The AI evaluates purchase context and provides understandable risk signals. Crucially, the AI does not have the authority to override payment policies or independently execute transactions.

Once a purchase is authorized, the buyer completes PayPal's approval flow. The backend verifies and captures the payment, while signed webhooks and an auditable event history help keep transaction records consistent.

How We Built It

We developed AgentPay Guard as an end-to-end web application with a responsive interface, a server-side payment orchestration layer, an AI risk evaluation service, and persistent transaction records.

1. Deterministic Payment Policies

Every purchase request is validated against enforceable rules, including spending limits and authorization requirements.

Policy violations cannot be bypassed by model-generated reasoning or client-side manipulation.

2. AI-Powered Risk Evaluation

We integrated Meta's Muse Spark 1.3 through the Meta Model API to analyze purchase context, identify suspicious signals, and produce explainable assessments.

We tested real inference on normal purchases, unusual requests, and prompt-injection scenarios.

The AI contributes contextual judgment, while deterministic policies remain the final enforcement boundary.

3. Human-in-the-Loop Approval

Requests requiring review enter a dedicated approval workflow.

An authorized reviewer can approve or reject the request, and the decision is recorded in the audit trail.

Internal review approval is deliberately separate from PayPal buyer approval.

4. Real PayPal Sandbox Integration

We integrated PayPal Orders v2 for order creation, buyer approval, and payment capture.

We successfully completed and verified a genuine USD 18.00 Sandbox capture.

The payment status was reconciled across PayPal, the database, audit records, and the user interface.

5. Signed Webhooks and Auditable Transactions

We implemented PayPal webhook signature verification, event correlation, duplicate-event handling, and payment-state reconciliation.

Real Sandbox webhook deliveries and official redeliveries were successfully tested.

The system also maintains an auditable record of purchase evaluations, approvals, payment transitions, and relevant failures.

Challenges We Faced

Making Payment Retries Safe

One of the most important challenges was handling uncertain payment outcomes.

A network timeout does not necessarily mean a capture failed. Treating an ambiguous result as a definitive failure could lead to unsafe retries.

We improved payment-state reconciliation and idempotency handling to prevent unintended duplicate captures.

Keeping AI Reasoning Separate From Authority

AI-generated content is inherently untrusted.

A malicious purchase description might instruct the model to ignore spending limits or approve a prohibited payment.

We designed the system so that model output cannot override server-enforced rules. In our demonstrated prompt-injection scenario, the request was blocked before any PayPal operation.

Verifying Real Integrations

Mocked responses alone were not enough to prove the system worked.

We encountered PayPal credential configuration errors, approval-expiration constraints, webhook URL issues, and live-model latency.

Resolving these required real Sandbox transactions, signed webhook verification, database reconciliation, and regression testing.

Making Complex Decisions Understandable

Payment governance involves multiple states: policy evaluation, human approval, payer approval, capture, and webhook confirmation.

We designed the interface to make these distinctions clear without overwhelming users with technical details.

What We Accomplished

  • Integrated real Meta Muse Spark inference with enforceable payment policies.
  • Demonstrated allowed, human-reviewed, and blocked purchase scenarios.
  • Completed a genuine PayPal Sandbox payment capture.
  • Verified signed PayPal webhook delivery and redelivery.
  • Confirmed that repeated capture requests did not produce duplicate payments in our tested flow.
  • Passed 198 automated tests, including database and payment regression tests.
  • Built a responsive decision workspace and searchable audit experience.
  • Prepared a reproducible open-source application with documented demo scenarios.

These results demonstrate a working prototype, not a claim of production certification or guaranteed fraud prevention.

What We Learned

The most important lesson was that AI reasoning and financial authorization should be separate responsibilities.

AI can help explain why a purchase looks unusual. But reliable payment systems also require explicit policies, identity and authorization checks, durable state transitions, idempotency, and independently verifiable outcomes.

We also learned that a trustworthy AI product needs to communicate uncertainty and failure states as clearly as it communicates success.

What's Next

AgentPay Guard is currently a PayPal Sandbox prototype.

Our next steps include:

  • Supporting multiple agents with independent spending budgets and permissions.
  • Introducing configurable organization-level approval policies.
  • Expanding behavioral risk signals using historical transaction patterns.
  • Supporting more advanced multi-step approval workflows.
  • Improving observability, operational monitoring, and long-running payment reconciliation.
  • Exploring standardized integrations with additional agent frameworks.

Our long-term vision is a reusable payment governance layer for increasingly autonomous AI systems.

AI agents should be able to act. But financial autonomy should always come with accountability.

Built With

Share this project:

Updates

Submission history