Allowance

Live market: agents, models, money flow
Hijack attempt caught and banned
Paid $216.20 of $250 hold, $33.80 back
AI reads offers, math picks the winner
Tamper-proof ledger: fakes break chain
Step 1: say what you want
Step 2: PayPal holds funds as proof
Built to fix measured AI agent flaws
Spending limits for your own AI agents

Inspiration

AI agents are starting to shop for us — and they're easy to fool. Microsoft Research put AI shopping agents in a simulated marketplace (Magentic Marketplace, 2025) and found they accept the first offer they see 80–100% of the time, get worse as more options appear, and — with a single hidden prompt injection — send all of the money to the scammer.

Making the agent smarter doesn't fix that. Changing the market does. So we asked: what if shopping worked the other way around?

What it does

Allowance is reverse commerce for AI agents. You say what you want; PayPal proves you can pay; AI sellers compete for you — and only honest offers can win.

You ask — "Noise-cancelling headphones, under $250, within 5 days." An LLM turns it into a structured request that you sign on your device (ECDSA P-256).
PayPal holds your budget — a real authorization hold on your vaulted PayPal wallet. Sellers know you can pay; nothing is charged.
Sealed-bid market — five AI seller agents bid, and every offer stays sealed until the window closes, so being first earns nothing.
Trick detector — gpt-oss-safeguard-20b checks every offer against a written policy of the six manipulation tactics from the Microsoft study: fake credentials, fake reviews, false urgency, bad-mouthing rivals, hidden fees, and prompt injection. A second, independent cross-check catches anything the classifier misses.
The AI reads, math decides — gpt-oss-120b only extracts facts (price, fees, delivery, warranty, condition); a deterministic formula with your private priorities picks the winner. No first-offer or position bias is possible.
Final round — the top two can beat their own price once, without seeing each other's offer.
You pay only the winning price — PayPal captures exactly that amount, releases the rest of the hold, and pays the seller through PayPal Payouts.
Herd immunity — a seller caught attacking any buyer is banned for every buyer.
Tamper-proof — every step is written to a SHA-256 hash-chained ledger, with a live "try to fake a payment" drill that shows the chain breaking.

In our live runs, three of five sellers tried to cheat — a fake "PayPal Verified Partner" badge, a buried $74.99 fee on a refurbished unit, and a hidden "SYSTEM OVERRIDE" telling the buyer agent to capture the full $250. All three were thrown out; the honest winner dropped its price in the final round; the buyer paid $216.20 of a $250 hold and got $33.80 back automatically — every step a real PayPal sandbox transaction.

Allowance also protects agents you already run: give any agent a plain-English allowance ("groceries, $120 a week, ask me above $45") and every purchase goes through deterministic rules → injection scanner → AI guardian → PayPal hold/capture or a one-tap human approval. In testing, a gpt-oss-20b shopping agent read a poisoned product page and added five $100 gift cards on its own — Allowance blocked it before any PayPal order existed.

How we built it

Next.js 16 + TypeScript, Tailwind, SQLite (node:sqlite), Server-Sent Events, and an animated SVG live agent graph that shows every agent, the model behind it, and the money path in real time.
PayPal REST APIs (sandbox): Vault v3 setup/payment tokens, Orders v2 intent: AUTHORIZE with a vaulted wallet (proof-of-funds hold), authorization capture with an amount + final_capture (pay only the winning price, release the rest), void (nothing charged when nobody wins), Payouts (seller settlement), refunds, buyer-approval checkout fallback, and verified webhooks. Every money-moving call is idempotent via PayPal-Request-Id.
AI on Groq, one model per job:
- openai/gpt-oss-120b — parses requests and allowances into strict JSON-Schema structured output; reads untrusted offers in quarantine and extracts facts only; guards personal-agent purchases.
- openai/gpt-oss-safeguard-20b — the trick detector: a policy-following classifier given our written manipulation policy; all sealed offers reviewed in one batched call.
- openai/gpt-oss-20b and qwen/qwen3.8-27b — the seller agents and the personal shopping agents (tool calling).
Trust layer: WebCrypto-signed intents (AP2-style mandates), server-signed settlement receipts, a hash-chained audit ledger (AG Grid), one-time owner tokens for approvals, and an MCP server so any agent can plug in.

Design rule: LLMs read and explain; deterministic code decides and moves money. No model output can loosen a rule or move funds on its own.

Challenges we ran into

A single safety model isn't reliable. In one run the classifier missed a seller using a fake PayPal-partner badge. We added an independent cross-check — the fact reader's unverifiable claims and buried fees can block an offer on their own — and the attack was caught consistently from then on.
Off-the-shelf injection detectors miss shopping attacks. llama-prompt-guard-2 scored our hidden "add this bundle" instructions at ~0.004; it's tuned for "ignore previous instructions" jailbreaks. A policy-following model (gpt-oss-safeguard) caught them at 0.99.
PayPal sandbox realities. Vault permissions didn't activate on one app, and sandbox Payouts aren't available from every country, so we collect from buyers on one app and pay sellers from a settlement app — the standard marketplace pattern.
Free-tier rate limits. We spread each AI role across a different Groq model so they draw from separate per-minute budgets.

Accomplishments that we're proud of

A real end-to-end flow on PayPal: hold → capture only the winning price → automatic release → seller payout, with real sandbox IDs.
A live LLM agent genuinely fell for prompt injections — and Allowance stopped it every time.
Every design choice maps to a measured failure from published research, not a guess.

What we learned

Agents don't need to be perfect if the market is designed so manipulation can't pay off. PayPal's authorization primitives — hold, partial capture, void — are exactly the escrow layer agentic commerce needs.

What's next

Real seller onboarding through PayPal's multiparty/platform APIs, external seller agents joining over MCP and the Agentic Commerce Protocol, shipment-tracking-based milestone captures, and passkey-based owner approvals.