Autonomous Enterprise Resource Manager(AERM)

Inspiration

Finance teams lose money in two quiet ways. They overpay for hardware because nobody benchmarks every purchase, and they keep paying for SaaS seats long after people stop using them. An AI agent could fix both, but nobody will let one near a payment account if a poisoned vendor listing can redirect the money, a bad price can slip through, or there is no way to stop it and no record of what it did.

We did not want to build another shopping agent. We wanted to build the part that makes it safe to say yes, and then invite you to try to break it.

What it does

A finance manager types a spending policy in plain English:

Laptops and monitors, up to $1,800 each, $12,000 a month, vendors A and B only, no more than 10% over market, buy automatically.

An LLM compiles it into strict rules and shows them next to the original text. If anything is ambiguous, it asks a question instead of guessing. The manager reviews the diff and signs once.

From then on, an agent benchmarks each purchase against real market offers from Channel3, compares two vendors, negotiates, and proposes an order. The agent cannot spend. A deterministic verifier checks every proposal against the signed mandate: signature, expiry, replay, vendor, per-unit cap, monthly cap, price drift, over-benchmark and circuit breaker. In-policy purchases execute as PayPal sandbox orders. Anything outside the policy waits in an approval queue until the manager signs that exact cart. The same loop finds idle SaaS seats and cancels them through PayPal subscriptions.

Every step lands in a hash-chained ledger that exports as a proof pack, and one click on the kill switch revokes all mandates.

The Break-it Arena is a public page where you can inject a poisoned vendor listing, a forged approval or a replayed mandate and watch what stops it. Every attack case and every result is in the repo.

How we built it

Policy to mandate: LLM (DeepSeek) → Zod schema → human diff → ES256 signature (WebCrypto) over an RFC 8785 canonical hash. The signature binds to the exact cart: change one field and it no longer verifies.
One design rule: the LLM never holds a spend-capable tool. Payee and amount come from the verified mandate and the re-fetched price, never from model text. The planner is deterministic; the only LLM is the policy compiler.
TypeScript monorepo: shared Zod contracts, a pure guard package with 16 rule codes, a ledger, a Fastify API, workflows on Render with Postgres, and a React dashboard.
Python ML service (FastAPI, scikit-learn), advisory only: a robust fair-price estimate, an idle-seat model (gradient boosting), purchase-anomaly detection (isolation forest) and the backtest. The API still works with the service switched off.
Simulated vendors with their own PayPal sandbox merchant accounts, and real benchmark prices from Channel3.

The backtest counts savings only on purchases the policy auto-approves:

$$\text{saving} = \sum_{i \in \text{auto-approved}} \left(p_i^{\text{human}} - p_i^{\text{agent}}\right) q_i$$

Challenges

Making "safe" testable. We wrote 69 attack and control cases across 11 categories (payee redirection, price inflation, quantity tampering, expired and replayed mandates, unicode tricks and more) and ran them against our own verifier. The first run stopped 40 of 45 attacks and found five real fail-open gaps. One example: an expiry of "never" never expires, because every comparison with an invalid date is false. A fuzzer found four more that we had not thought to write. Our own audit then found the sharpest bug of all: three production callers passed a signature check that accepted any non-empty value. The Arena had passed because its test harness used real cryptography and production did not. We fixed it with real ES256 verification and added a forged-signature attack to the Arena.

Real prices versus our simulated vendors. Channel3 returned a usable benchmark for only 14 of our 30 hardware queries, and our invented catalog disagreed sharply with real prices. We anchored the demo to five real products and learned that searching with invented product names returns random products.

Honest ML on synthetic data. Our simulated company is cleaner than any real one, so we report every ML number as an upper bound, beside a simple baseline.

Latency. A live Channel3 call takes a median of 8.7 s, so benchmarks are prefetched and cached with a real-offers fallback.

Accomplishments

Policy compiler: on 32 held-out policies, run once with the prompt frozen, it produced the exactly correct policy on 18 of 18 clear inputs and guessed on 0 of 14 ambiguous or adversarial inputs. Repeat runs were stable.
Arena: 45 of 45 attacks that can be driven at the verifier were stopped, with 0 false blocks on legitimate purchases. Cases not yet runnable are listed, not counted.
Fuzzing: 20,000 random verifications found no invariant violations after the fixes, and it found weaknesses our hand-written cases missed.
Backtest on 90 days of simulated purchasing: about half the purchases auto-approved and the rest escalated to a human or held by the circuit breaker, with about 7% savings on the auto-approved ones.†
Idle-seat detection: about 99% precision and recall against about 94% for a fixed 30-day rule, mostly by recognising users who log in rarely but regularly.†

What we learned

A green test suite measures the test harness. Ours passed while production accepted any signature. Test the deployed path.
The two errors do not cost the same. For the compiler, the headline metric is how often it guesses when it should ask, not overall accuracy.
Savings came from comparing vendors, not from clever negotiation. Negotiation added only about 4% of the savings.†
Report the baseline. A gradient-boosted seat model barely beat plain logistic regression. The features did the work, not the model.

What's next

WebAuthn passkey signing and phone approval, a rule for duplicate orders, multi-currency support, real merchant integrations, and packaging the guard as a library for other agent builders.

What is simulated, and what is real

Simulated: the company, its asset register, SaaS subscriptions, seat-usage logs and purchase history, and the two vendors (agents we wrote, each with its own PayPal sandbox merchant account). Real: benchmark prices from the Channel3 catalog; mandates, signatures, verification, orders and subscriptions through the PayPal sandbox, the ledger and the dashboard. All ML and backtest numbers are on synthetic data and are upper bounds, not field results. The policy and abuse test suites were written by our team and are published in the repo.