Inspiration
It started with a simple scenario. You ask an AI agent to find you a pair of headphones and buy them. It finds a nice pair for €62, but your budget was €50. Nothing stops it from clicking "Pay".
AI agents have gone from answering questions to taking actions. They book things, compare offers, and more and more often they pay. Payment systems were built for humans who hesitate, double-check and sometimes change their minds. An agent does none of that. It can be wrong, or be manipulated, and it acts in milliseconds.
We wanted agents to stay useful without anyone having to hand over their wallet. That became AgentShield.
What it does
AgentShield sits between an AI agent and the PayPal payment flow. The agent never pays directly. It asks AgentShield first.
The owner starts by writing a mandate: a total budget, a limit per purchase, the allowed categories, trusted merchants, a delivery deadline and how long the mandate is valid. When the agent wants to buy something, it sends the request to our API. The decision engine runs 15 strict checks on it, from the obvious (is the mandate still active, is the currency right) to the less obvious (has this exact request already been sent, does this purchase push the total over budget).
Every request ends with exactly one of three answers. Below the auto-approval threshold, the purchase is approved and can move on to PayPal. In the grey zone between that threshold and the per-purchase limit, the owner gets a request to confirm or reject, and if nobody answers it simply expires. Above the limit, or if any strict rule fails, it's refused. A refusal isn't just a label on a screen: the backend won't even let a PayPal checkout be created for that action.
Approved actions go through the PayPal Sandbox: the order is created, the capture is checked before anything is settled, and payouts are sent.
Every decision is written to an audit chain. Each entry is hashed with SHA-256 together with the hash of the entry before it, so changing anything in the past breaks the whole chain from that point on. One API call checks the entire history.
Owners follow everything in a Streamlit dashboard with six screens: an overview, the mandates, a form to submit an expense, pending approvals, the full history, and a simulated wallet. The wallet shows a monthly premium, a bonus-malus that rewards or penalises the agent's behaviour, and a shared reserve meant to cover incidents.
There is also an optional AI expert that explains each decision in plain English. It can explain, but it never decides. It doesn't set amounts and it can't override a rule. Without an API key, it falls back to a deterministic explanation with the same structure.
How we built it
The backend is written in Rust with Axum and exposes a JSON REST API, with SQLite for storage. The decision engine is fully deterministic: guardrails, thresholds, and a risk score built from explicit factors we can explain one by one.
For payments we used the PayPal Orders API for creating and capturing orders, plus Payouts, all against the Sandbox. We also built a mock gateway so the whole flow can run offline, without credentials, which saved us more than once during the hackathon.
The frontend is Python with Streamlit and Pandas, and it talks to the backend over HTTP. A test suite covers the main API scenarios, and a GitHub Actions pipeline checks formatting, lints, tests and the release build on every push.
Challenges we ran into
The first real problem was concurrency. If two requests arrive at the same moment, both can pass the budget check before either has been recorded, and the agent ends up spending twice. We made the guardrails atomic so the check and the reservation happen together, and added idempotency keys so a retried request is never counted twice.
The second was trusting PayPal's responses too quickly. A capture that answers isn't necessarily a correct capture. We now check the amount, the currency and the status before an action is marked as settled.
The third was more of a design temptation. It would have been easy to let a language model make the call. We chose the opposite: every money decision is deterministic and auditable, and the AI is only there to explain.
Finally, we built the backend and the frontend in parallel and brought them together late. Lining up data models and error formats under time pressure took more evenings than we'd like to admit.
Accomplishments that we're proud of
The whole loop works end to end: an agent proposes, the mandate decides, a human confirms when needed, PayPal executes, and everything lands in the audit trail.
We're also proud that a refusal is actually enforced. A refused action physically cannot turn into a payment, and anyone can verify the full history with a single request.
What we learned
With agentic payments, the most important feature is the ability to say no. Refusals, expiry and limits have to be designed first, not added at the end.
We also learned that rules and AI work better together than in competition. The rules make decisions reliable, the AI makes them understandable.
And we learned the PayPal order lifecycle in detail, and why every step deserves its own check.
What's next for AgentShield
Ed25519 signatures on every audit entry are already prototyped on a separate branch, and the next step is anchoring the chain externally so a truncated history can be detected too.
After that, we want approvals to arrive as push notifications instead of living in a dashboard, budgets per merchant and per category, recurring subscriptions, and limits on spending speed. Longer term, a small SDK would let any agent framework check with AgentShield before it pays.
