Inspiration
AI can help people evaluate payment-related requests, but model output should never grant itself financial authority. BOLT explores deterministic human-controlled policy and review around those requests.
What it does — experimental prototype
BOLT Agentic Payments Control Plane is a local policy preview and read-only evidence prototype, not a payment executor.
- A browser-based demonstration displays policy outcomes.
- A local Node.js HTTP service accepts structured proposals or optional Ollama-generated payment intent and returns policy decisions (allow, approval required, or deny) with
executed:false. - A separate command-line inspector can retrieve the status of an existing PayPal Sandbox order using the operator's own sandbox credentials. It normalizes a minimal evidence record and may compare snapshots for changes.
- The read-only PayPal inspector is not wired into the browser preview or payment proposal endpoints.
It does not create, capture, refund or transfer money. Authenticated server-side human approval and durable audit controls have not been implemented.
How we built it
The public MIT-licensed repository contains a browser policy preview, a loopback-only Node.js service, deterministic policies, an optional locally run Ollama/Qwen2.5:1.5b intent planner, and separate PayPal Sandbox OAuth + Orders V2 GET inspection tooling. Offline contract tests use mock responses or synthetic fixtures, labeled as such.
No authenticated end-to-end PayPal Sandbox order inspection has been independently verified in internal QA. The public browser demo does not call PayPal or provide a payment checkout.
Challenges and lessons
Separating AI recommendation from authority, distinguishing simulations from real API evidence and avoiding sensitive customer-data retention are central challenges. A policy decision is not a completed payment. A SHA-256 digest of normalized data is not an independent PayPal attestation.
What's next
Validate the read-only Sandbox integration with an existing authorized test order; demonstrate actual local AI inference; add authenticated user approvals, durable audit records and clearer evidence in the demo. We will not imply these features are complete before they are tested.
Source and testing
Repository: https://github.com/ondmindmanagement-hub/bolt-paypal-control-plane
Run npm test and npm start to explore the local policy service; see the README for the read-only inspector and synthetic demo. Judges need their own PayPal Sandbox credentials and an existing test order to exercise the actual read-only API path. The project does not process real money.
Built With
- agents
- ai
- fintech
- javascript
- node.js
- paypal
- rest-api
