ALLOWANCE

Give your AI agent an allowance, not your wallet: a spending firewall for AI agents, built on PayPal.
Replay of a real sandbox run: each purchase passes the guard ring; the $48 desk lamp waits for your OK in PayPal.
The mandate as a card: $200 allowance, $60 max per purchase, ask above $40, backed by a PayPal vault token.
Attack Lab: the same OpenAI agent vs hidden prompt injections. Unguarded, 21% of attacks succeed; with ALLOWANCE, 0%.
PayPal view: ALLOWANCE's ledger beside what PayPal itself reports through the Orders and Transaction Search APIs.
Tamper-evident audit log: every hash in the chain is re-checked in your browser with WebCrypto SHA-256.
Control Room, built with AG Studio: allowance, step-ups, one-click undos and a rule-by-rule trace for every decision.
Ask the Auditor: an AI analyst answers what-if policy questions from recorded decisions, and can only propose changes.

Inspiration

Agents can now spend money. Today, giving one PayPal access means giving it your wallet — a free-form "pay" tool, a saved payment method, and a prompt asking it to behave. We wanted the opposite: an allowance an agent can't break, built only from PayPal's own primitives.

What it does

You give your agent an allowance — "$200 this month · max $60 per purchase · office supplies and electronics · no subscriptions · ask me above $40" — and link PayPal once through a Vault saved-wallet consent. Your errand becomes a task contract you confirm. Every money-moving tool call the agent makes then passes 12 deterministic rules and comes back ALLOW (paid from your saved PayPal wallet), STEP-UP (PayPal asks you on your phone) or BLOCK (with the exact rule). Anything paid can be undone for 10 minutes with a real PayPal refund. An Attack Lab proves it: the same OpenAI agent with and without ALLOWANCE — attack success 21% → 0%, false blocks 0% on normal errands. An AG Studio Control Room with custom widgets and an Auditor agent explains every verdict and simulates policy changes against recorded agent behaviour — and can only propose, never apply.

How we built it

PayPal (sandbox): Vault v3 payment tokens (setup token → approval → payment token, usage_type: MERCHANT), Orders v2 with payment_source.paypal.vault_id for agent purchases, normal Orders v2 checkouts for step-ups (captured by a poller + CHECKOUT.ORDER.APPROVED webhook), Refunds for undo, PayPal-Request-Id idempotency on every POST, signature-verified Webhooks, and the PayPal Agent Toolkit whose money-moving tools sit behind the same guard.
The guard: framework-free TypeScript — 12 pure rule functions, an atomic SQLite ledger (BEGIN IMMEDIATE, tested with racing processes), a SHA-256 hash-chained audit log, and wrap() that classifies every tool (read-only / money / default-deny). p95 under 1 ms.
OpenAI: a hand-written Responses API agent loop with function calling; structured outputs for task parsing; one-sentence verdict explanations; the Control Room's agents.
AG Studio: custom theme, four custom widgets with Form Configuration (Allowance Ring, Verdict Stream, Attack Lab Matrix, Chain Seal — which re-verifies the audit log's SHA-256 chain in the browser), a four-page report with drill-through and live data, and a custom agent team (our own lead + an Auditor with explain_verdict, simulate_policy, draft_policy_change and two Tool Components).
Next.js 16 on Render, SQLite, Motion for the Firewall Lane, Vitest + fast-check + Playwright + axe.

Challenges we ran into

Making task-binding precise: binding by category alone would let a cheap off-task item through, so contract lines carry a product type from the catalog's vocabulary.
Keeping the comparison fair: both agent configurations share the prompt, model and read tools; only the money tools differ, and success is judged by code.
Capturing step-ups reliably even when the phone's redirect never lands (poller + webhook).

Accomplishments that we're proud of

The guard never reads attacker-writable text, and the agent can't name a price or a payee.
$1245.54 of unauthorised spend prevented in the Attack Lab; every number reproducible from lab/results/latest.json.
A Control Room agent that can replay recorded decisions against a new policy — and is designed to never apply changes itself.

What we learned

Safety for agentic payments belongs in capabilities, not prompts: give agents identifiers, not amounts; bind them to what the person confirmed; and make undo a first-class primitive.

What's next

Vault reference-transaction approval for live, merchant-signed catalogs, per-agent identity and allowances, risk signals, and packaging the guard as a library and an MCP server so any agent host can use it.