Agentrix: a payments ecosystem of autonomous agents

A payments ecosystem of autonomous WebAgents on PayPal: proactive, responsive and supportive to customers and owners, with every agent identified and governed.

Comment

Inspiration

Most small businesses have a website that does very little for them. It cannot answer a customer at night, follow up on an unpaid invoice, pay a supplier, or warn the owner that cash is running low. AI agents can now do all of these things, and before long the agents of one business will be paying the agents of another.

That raises three questions that must be answered before anyone can trust agents with money: Who is this agent? Who is responsible for it? Where did the money go? We built Agentrix to answer those three questions.

What it does

Agentrix WebAgent Platform turns a business's website into a team of AI agents, which we call WebAgents. They are proactive, responsive and supportive to both customers and the owner. Every website has a Chief agent that manages the team and reports to the owner, along with working agents such as the Cashier, Payables, Receivables and Support.

  • Customers can browse the site and pay with PayPal, or they can simply ask a question. The front desk agent answers from the day's stock. When the customer says what they want, the agent places an order card in the conversation that shows the total and a PayPal button. Once the order is paid, it is confirmed and the customer can track it.
  • Customers' AI agents can also shop. An agent arrives at the site's agent door, signs its request, and is verified against its own website. It can then order and pay with a saved PayPal account, with no person involved on either side.
  • The owner remains in control. The owner signs a mandate that sets how much the agents may pay per transaction and per day, and to whom. Within those limits the agents act on their own. Anything outside them, such as a new payee, a larger amount or a custom order, waits for the owner's approval.
  • Every agent has a verifiable identity. Each agent carries a badge, which is a W3C decentralized identifier tied to the website's own domain and signed by the owner. Anyone can verify it. An agent that cannot prove its identity is refused before any PayPal order is created.
  • Every payment can be checked. The money stays in PayPal. Each agent keeps a signed wallet record of every transaction, and each record is matched against PayPal's transaction ID and the entry in the accounting books.

We then left the system running with nobody at the keyboard. Starting on Wednesday evening, three shopper agents placed 18 orders at Kilele Bakery, a sample shop, and paid for 14 of them with saved PayPal accounts, for a total of USD 109.88. Four custom cake requests arrived through the agent door with verified signatures and were held for the owner's decision. Agentrix's agents invoiced Kilele's agents for their usage, and Kilele's agents checked each invoice against the owner's mandate and paid it through PayPal. There were eight of these settlements, and each one was recorded in both companies' books under a single PayPal ID. Staff payroll was paid through PayPal Payouts within the mandates. Each Chief agent also sent its owner a brief by Telegram and email that summarised what people did, what agents did, and the day's sales and costs.

Judges can replay this activity on a public page. They can also press "Run the day" on the judges' page to watch a scripted day run live against the PayPal sandbox.

How we built it

  • adk-rust powers every agent. Each business has its own kernel, with graph flows, guardrails, memory, governed tool calls and a signed audit log. Rules, not the language model, decide whether money is allowed to move.
  • PayPal handles all payments. We use Orders v2 for checkout and for invoices between agents, Vault so that a customer's agent or another company can pay without a person signing in each time, Payouts for payroll and bills, Subscriptions for Agentrix's own monthly plans, and webhooks that are verified with PayPal. Refunds can only be sent to the person who paid.
  • Identity is built on did:web badges, HTTP message signatures (RFC 9421), and an OpenID Connect issuer on each site. We tested the same agent identity live against AWS IAM, Amazon Bedrock AgentCore Identity, Google Cloud workload identity federation and Microsoft Entra Agent ID.
  • Mandates follow the structure of the Agent Payments Protocol (AP2). We describe them as AP2-style and do not claim formal conformance.
  • Accounting and CRM run on Zavora ERA, which the agents reach through the open-source mcp-erp server.
  • The agent door supports MCP for customers' agents and A2A for the agents of other companies.

Challenges we ran into

  • Proving that an agent really paid. A language model saying that it paid is not evidence. We therefore verify every claim against PayPal, the accounting books and the signed audit log.
  • Making approvals tamper-proof. The owner's signature covers the exact payment that was shown. In our attack tests, the founder approved a payment of USD 800 and the agent then tried to pay USD 750 instead. The system treated the change as a new request, cancelled the approval, and paid nothing.
  • Letting two companies' agents agree on a payment. Each agent had to stay within what its own owner had authorised, so neither side could promise more than its mandate allowed.
  • Running the system for real. Leaving the agents unattended for a full day exposed problems that a short demo would never show, including an agent conversation that broke after a restart and pages that displayed placeholder data. We fixed what we could before submitting and have listed the remaining issues in the repository.

Accomplishments that we're proud of

  • The system ran unattended for a full day, and its records match PayPal's.
  • We ran ten attacks against it, ranging from a fake supplier email to a forged PayPal webhook, and all ten were refused.
  • A customer can place an order inside the chat and receive a PayPal payment card in the same conversation.
  • Each Chief agent writes a real daily brief for its owner, based on the business's own records.
  • We contributed our agent identity work back to adk-rust (zavora-ai/adk-rust#1362 and #1366), so any adk-rust agent can now use it.

What we learned

Building an autonomous agent that looks impressive in a demo is easy. Building one that people can trust with money is much harder. Most of the valuable work went into defining limits: what an agent may do on its own, what must wait for a person, and how an outsider can verify both.

What's next for Agentrix: a payments ecosystem of autonomous agents

  • We will add suppliers, couriers and riders as WebAgent websites of their own, so that a shop's agents can order ingredients and deliveries directly from other businesses' agents.
  • We will allow customers to complete payment inside the conversation, without leaving the chat.
  • We will run each business on its own isolated node, so that businesses interact only through their public, signed agent doors.
  • We will open the platform to real customers. Plans start at USD 29 per month.

Built With

  • a2a
  • adk-payments
  • adk-rust
  • ag-grid
  • anthropic-claude
  • axum
  • caddy
  • decentralized-identifiers
  • http-message-signatures
  • kubernetes
  • model-context-protocol
  • openid-connect
  • paypal
  • paypal-orders-api
  • paypal-payouts
  • paypal-subscriptions
  • paypal-vault
  • paypal-webhooks
  • postgresql
  • rust
  • sqlite
  • tokio
  • vultr
  • webauthn
Share this project:

Updates

Submission history