AgentProof

• 

  AgentProof project cover image

Inspiration

AI agents are starting to shop for people. But when a customer later says “I never allowed this purchase” and opens a PayPal dispute, the shop has to prove what the agent was allowed to buy. Today that proof usually doesn’t exist, or it’s scattered across logs. We wanted to keep that proof from the very first step and turn it into evidence PayPal can use.

What it does

• A customer authorizes an AI agent with a spending limit and a description of what it may buy.
• When the agent shops, AgentProof checks the budget before any payment. If the purchase is over the limit, it’s blocked, and PayPal is never called.
• Allowed purchases are paid through PayPal. Every step is recorded: what the agent searched for, what it chose, the budget check, and the payment.
• Each purchase has a case page with a clear timeline. When a dispute arrives, code rebuilds the facts and runs the checks: within budget, authorized before the purchase, delivered before the dispute.
• An AI writes the evidence from those facts. Every amount and ID it writes is checked before anything is saved.
• The shop reviews the evidence beside the checks, approves it, previews the exact request PayPal will receive, and submits it.
• If PayPal or the AI is down, AgentProof switches to built-in demo versions and labels them clearly, so it keeps working.

How we built it

• Stack: Elixir and Phoenix LiveView, with PostgreSQL and Ecto. Database row locks stop two purchases at the same moment from overspending a budget.
• PayPal: the Sandbox REST API, for login tokens, creating orders and building the provide-evidence request.
• AI: a local model (Ollama, llama3.2) with structured JSON output. OpenAI can be used instead. Swappable services: PayPal and the AI each sit behind a simple interface with a real version and a demo version. That makes them easy to test, and it gives the app a safety net.
• UI: Tailwind CSS with daisyUI.
• Delivery: Docker, so it runs with one command, and 283 automated tests. We recorded the demo video automatically with Playwright.

Challenges we ran into

• Small AI models make things up. I made a rule: code finds the facts, and the AI only writes the words. Every number and ID in the AI’s answer must appear in the facts. If it doesn’t, the AI gets one more try with the problems listed, and after that a demo version writes the evidence.
• The small model kept adding adjectives to search queries, like “noise cancelling headphones”, which matched nothing. We gave it a separate JSON field for details, so the product field stays a plain noun.
• Sandbox limits: PayPal only takes money after a buyer approves in a browser, and shops can’t create disputes through the API. We simulated those parts and labelled them clearly in the app.
• Editing an agent’s limit later must not rewrite old evidence. So each purchase saves the terms it was checked against.

Accomplishments that we're proud of

• The AI never decides the facts, and nothing it writes is saved without being checked.
• The app is honest: anything simulated or written by the demo AI is marked as such.
• The full flow works end to end with a real local AI, and the demo can’t break if a service goes down. It’s well tested and starts with a single Docker command.

What we learned

How PayPal’s order and dispute APIs work, and where the Sandbox stops.

What's next for AgentProof

• Real payment capture with saved PayPal payment methods (PayPal Vault).
• Picking up real disputes automatically through PayPal webhooks.
• Connecting to real AI agent frameworks, instead of our scripted agent.
• Signed authorization records, so the customer’s permission can be proven cryptographically.
• Login and multiple shops, plus PDF evidence attachments.

Built With

• docker
• elixir
• liveview
• phoenix
• postgresql