BoundPay

Agentic procurement with real product research, deterministic spending policies, human approval, and PayPal execution—so AI can recommend purchases without controlling your money.

Comment

Inspiration

AI agents are becoming increasingly capable of researching products and recommending purchases. But giving an AI purchasing power creates a much harder question:

Who decides what the agent is actually allowed to spend?

BoundPay was built around a simple separation of authority:

The AI decides what to recommend.
Policy decides what's allowed.
You decide when money moves.

The goal is to make agentic commerce useful without giving a language model direct financial authority.

What it does

BoundPay turns a natural-language purchasing request into a policy-controlled procurement workflow.

A user can write something like:

"Buy 12 monitors for our engineering team. Maximum budget $3,000. Human approval is mandatory."

BoundPay then:

  1. Uses AI to interpret the purchasing mission.
  2. Converts it into a structured spending mandate.
  3. Lets the user review the mandate before research begins.
  4. Autonomously searches real products using Channel3.
  5. Compares and ranks eligible candidates.
  6. Evaluates every hard constraint with deterministic code.
  7. Builds a compliant basket.
  8. Generates a fingerprint-bound Payment Mandate.
  9. Requires explicit human approval.
  10. Executes the approved purchase through PayPal Sandbox.
  11. Records an attributed audit trail of the entire process.

The AI can recommend a purchase, but it cannot authorize one.

How we built it

BoundPay is a single full-stack Next.js application built with React and TypeScript.

OpenRouter provides structured intent extraction, bounded agent planning and recommendation explanations. The current free model is nvidia/nemotron-3-super-120b-a12b:free, with free-only routing enforced by the application.

Channel3 provides real product discovery and fresh product details.

AG Grid powers the procurement comparison workspace, where users can inspect prices, requirements, eligibility, ranking and rejected candidates.

The Policy Guard is entirely deterministic. Money calculations use integer minor units, and hard constraints cannot be overridden by the LLM.

Once a valid basket exists, BoundPay creates a SHA-256 fingerprint of the authorized mandate. Human approval is bound to that exact fingerprint, so changing the basket, amount or other protected data invalidates approval.

PayPal Sandbox Orders v2 is the final transaction boundary.

How AI is used

AI is used for language understanding and bounded decision support, not financial authority.

OpenRouter helps BoundPay:

  • interpret natural-language purchase requests
  • extract structured constraints
  • plan bounded product research
  • produce concise recommendation explanations

All structured AI output is validated with Zod.

The LLM does not perform payment arithmetic, enforce spending rules, authorize transactions or decide whether a payment may proceed.

How PayPal is used

PayPal is not just a checkout button in BoundPay.

It is the final execution boundary of the agentic commerce workflow.

Before a PayPal order can be created, BoundPay requires:

  • a valid purchasing mandate
  • a compliant product basket
  • Policy Guard approval
  • an unchanged mandate fingerprint
  • explicit human approval

The integration uses PayPal Sandbox Orders v2 with CAPTURE intent, stable request IDs, approval redirects, amount verification and capture-state verification.

A real Sandbox transaction was successfully completed for USD 2,950.68, with the captured amount verified against the authorized mandate.

Agentic Commerce

The agent autonomously plans and performs product research, evaluates available evidence, filters non-compliant candidates, ranks eligible products and proposes a basket.

BoundPay then introduces an explicit authorization boundary between intelligence and money movement.

This means the agent can act autonomously where it is safe to do so, while deterministic policy and human approval govern financial execution.

Policy Guard

The Policy Guard evaluates hard requirements independently from AI output.

Examples include:

  • total budget
  • per-item budget
  • quantity
  • currency
  • required product features
  • merchant rules
  • rating requirements
  • delivery constraints
  • available evidence
  • human approval

Unknown information is never silently treated as valid.

If required evidence is missing, BoundPay fails closed.

If a proposed purchase violates policy, payment is blocked.

In one real test, a USD 3,601.56 proposal was rejected against an authorized USD 3,000 budget.

Human approval and integrity

Every payment mandate is fingerprinted.

Approval belongs to that exact mandate.

If the basket, amount, merchant or protected purchasing state changes after approval, that approval becomes invalid.

This prevents an agent — or a modified client request — from turning approval for one purchase into authorization for another.

Product research

BoundPay uses the official Channel3 TypeScript SDK for product discovery and fresh detail retrieval.

External product data is treated as untrusted input.

Product descriptions cannot modify spending policy or payment authorization.

Missing ratings, delivery commitments, inventory or landed-cost information remain explicitly unknown and can block a strict purchasing mandate.

Product comparison

AG Grid provides the main procurement comparison workspace.

Users can inspect and compare:

  • products
  • merchants
  • prices
  • quantities
  • exact basket totals
  • product attributes
  • constraint matches
  • ranking
  • Policy Guard status

Rejected candidates stay visible so users and judges can see exactly why they could not be purchased.

Challenges we ran into

One of the most important challenges was incomplete evidence.

A real Channel3 research run returned 30 candidates, but none could prove every constraint of an intentionally strict mandate involving rating, delivery, inventory and landed cost.

Rather than inventing missing facts, BoundPay rejected all 30.

We therefore created two truthful scenarios:

  • a machine-verifiable Sandbox purchasing flow that can reach payment
  • a stricter trust scenario that deliberately blocks when evidence is insufficient

Another challenge was free LLM inference. The initially preferred Gemma endpoint was incompatible with the strict structured-output requirements we needed. Nemotron successfully handled the same structured mission while remaining on a zero-cost OpenRouter route.

Accomplishments

  • Real OpenRouter AI inference
  • Real Channel3 product discovery
  • Deterministic Policy Guard
  • Fingerprint-bound human approval
  • Real PayPal Sandbox order and completed capture
  • Real over-budget payment blocking
  • AG Grid procurement comparison
  • Full attributed audit trail
  • 74 unit and adapter tests
  • Four Playwright browser journeys
  • Public Vercel deployment
  • Public MIT-licensed repository

Most importantly, no model receives unrestricted payment authority.

What we learned

The most valuable part of agentic procurement is not recommendation quality alone.

It is the boundary between recommendation and authority.

A high AI score is not permission to spend.

Missing evidence is meaningful.

And payment completion should come from the payment provider, not from an animation pretending the payment succeeded.

What's next

Next steps include:

  • directly verified merchant quotes and landed-cost data
  • mixed-product basket optimization
  • durable authorization revocation
  • immutable audit infrastructure
  • broader procurement policies
  • enterprise approval workflows

Before any real-money use, BoundPay would also need production-grade identity, authorization, durable persistence and operational controls.

Built With

Share this project:

Updates

Submission history