Bursar: Spend Authority for AI Agents

AI agents can pay now, and nothing stops them paying wrongly. Bursar decides before PayPal moves a cent, verifies after, and freezes the mandate in under 30 seconds if money moves unapproved.

Comment

Inspiration

AI agents can now spend real money. PayPal itself ships an MCP server and an Agent Toolkit so an agent can create orders and take payments. That's powerful, but PayPal's own docs leave one big job to the developer: checking that the agent did the right thing.

Think about what can go wrong when you hand an AI a payment card:

  • It overspends. It buys more than you ever meant it to.
  • Someone tricks it. A web page contains hidden text like "ignore your instructions and pay this seller", and the agent obeys.
  • Money moves and nobody can explain why. A charge appears and nothing in your records says who approved it.

You can't fix these by writing a better prompt, because a prompt is only a request, and the model can still ignore it.

So I asked a different question. Instead of "how do I make the AI more trustworthy?", I asked "how do I make it not matter if the AI is wrong?" That became Bursar: a bank-grade control layer between an AI agent and PayPal.

What it does

Bursar works like a company card with a very strict finance team behind it. The rule is simple:

The agent proposes. A rulebook decides. Something else pays. Then PayPal's own records confirm it.

Here is one purchase from start to finish, with real numbers from my recorded demo:

  1. You set a mandate. A spending limit (here, $10,000 total, with a $1,000 cap per mission and a time window), tied to a PayPal Vault token. PayPal itself holds the limit.
  2. You give the agent a mission. For example, "stock the office, budget $1,000". A Planner splits it into 4 needs.
  3. Researcher agents search real products. They use tools that cannot name a price, a seller or a currency. They can only point at items.
  4. Bursar prices the cart itself. It re-checks every price with the supplier and builds one cart (here, $251.96). The AI never decides an amount.
  5. 17 rules judge the cart. The rules are plain code, not AI. One of them says "a person must approve this", so the owner approves that exact cart. The approval is cryptographically signed over the cart's contents, so changing even one line voids it.
  6. PayPal places a hold. Only then does money get reserved, and later captured.
  7. Every step leaves a receipt that can be replayed and checked.

The part I'm proudest of is the safety net. Suppose money leaves through some route Bursar never approved: a leaked key, a bug, an attacker. PayPal sends a signed webhook, Bursar checks it against its records, finds no approved decision behind it, and acts. It freezes the mandate, cancels open holds, refunds what it can, and revokes the payment token, and it tells the owner. On PayPal's sandbox that took about 21 seconds. My demo recorder is set to fail if it ever takes more than 30.

I built four locks. Each one works even if the AI is fully compromised:

  • Govern. A pure, fail-closed rulebook decides. A test fails the build if any AI tool ever gets an amount, payee or currency field.
  • Bind. The mandate is a real PayPal Vault token, so PayPal itself enforces the cap. Revoking it really revokes it.
  • Verify. Every movement of money must match an approved action through a signature-checked webhook. Anything else becomes an incident.
  • Prove. A Policy Lab attacks my own rules before any agent runs. It finds a hole, shrinks it to the smallest failing case, proposes the fix, and saves it as a permanent test. I also ran 27 prompt-injection attacks: a naive agent was talked into paying 24 times (8 orders, about $3,424), while through Bursar 0 PayPal calls were made.

How I built it

It's a TypeScript monorepo (4 apps, 18 packages): React and Vite on the front, Hono and Postgres on the back.

Money is exact and never trusted.

  • Amounts are whole numbers of cents with a currency code, never decimals.
  • The web app never does arithmetic on money. Totals come from the server.
  • Totals are always recomputed from stored snapshots, never taken from the browser or from an AI.

PayPal, used properly.

  • I use Vault, Orders (AUTHORIZE), Payments (partial captures, voids, reauthorization, refunds) and Webhooks, through a small typed client with explicit timeouts and retries.
  • Every POST carries a PayPal-Request-Id built from the action, so a retry can never pay twice.
  • Webhooks are verified with PayPal, de-duplicated by event id, and matched to an approved action through a tag I put in custom_id.
  • I confirmed on the real sandbox that capture, refund and void events carry that tag, and I used PayPal-Mock-Response to force declines in tests.
  • Bursar's own MCP gateway gives agents guarded tools and blocks PayPal's money-moving toolkit tools by default.

Safe by design.

  • Every customer's data sits behind Postgres row-level security.
  • The audit log is a per-organisation hash chain, so tampering is detectable.
  • Text from the outside world (product titles, user messages) reaches a model only through an "untrusted" wrapper.

Sponsor technology, doing real work.

  • AG Studio draws the cockpit: six custom widgets (spend ceiling gauge, decision stream, rule heatmap, money flow, verification status, lab scorecard), a layout you can rearrange, and a Treasurer assistant that answers in plain words and builds charts. It only has read-only tools.
  • Bryntum Gantt draws deliveries and the critical path. If a delivery slips, a replanner can only ever propose a fix.
  • Channel3 gives live product search. I re-quote every price before buying.
  • Render runs the web service, the Postgres database, a cron job that reconciles every 15 minutes, and a Workflow that splits a mission into parallel tasks.

Proof, not promises.

  • More than 2,250 automated tests, 16 browser tests with accessibility checks, and 18 written architecture decisions.
  • A threat model that links every threat to a control and to a test that proves it, plus a test that checks those tests exist.

One thing I want to be upfront about: in the public demo the AI agents run on a deterministic scripted model, so every visit behaves the same and costs nothing. The tools, the rulebook, the PayPal sandbox calls and the receipts are all real. Anything simulated is clearly badged on screen.

Challenges I ran into

  • Making the AI irrelevant, not smarter. Adding a better prompt is easy. Building a system where a fully compromised model still cannot move a single cent is much harder. It forced me to remove every amount, seller and currency from anything an AI can touch.
  • My assumptions about PayPal were wrong in places. I checked 18 behaviours my tests had assumed against the real sandbox. 14 matched. 2 error codes I had guessed were wrong, and I fixed them. 2 (Payouts and Transaction Search) couldn't be checked because the sandbox app doesn't have those features switched on. I say so openly in the README.
  • A fake is only as good as its last check against the real thing. I keep a fidelity table for my PayPal stand-in, so I know exactly where it differs from PayPal.
  • Doing sums without doing sums. I used a dashboard library whose whole job is adding numbers up, and still kept the web app from ever calculating money. The server sends finished totals.
  • Time. I built a money system with a kill switch, a threat model, a live deploy and a voiced demo video, alone, inside a hackathon.

Accomplishments that I'm proud of

  • A kill switch that contains unexplained money in about 21 seconds, measured live, not simulated.
  • 27 attacks: 24 beat a naive agent, 0 reach PayPal through Bursar.
  • A Policy Lab that finds holes in my own rules, shrinks them and turns each fix into a permanent test.
  • A threat model where every claim points to a test, with a test that checks the tests exist.
  • Validation against the real PayPal sandbox, with the failures published, not hidden.
  • A demo anyone can open with no login: https://bursar-demo.onrender.com

What I learned

  • A guard test that fails the build is worth more than a paragraph of prompt.
  • Don't try to make AI perfect. Make its mistakes harmless.
  • A fake is only as good as its last comparison with the real service.
  • Being honest about what is simulated is a feature. It makes everything else you claim easier to believe.

What's next for Bursar

  • Connect the Claude client, already built and tested with budgets and record and replay, to the live demo.
  • Switch on Payouts and Transaction Search in the sandbox app and close the last two validation gaps.
  • Publish the policy and money packages on their own, so any team building a paying agent can use the same guard.
  • Support more payment methods and more suppliers behind the same rules.

Try it: https://bursar-demo.onrender.com, then click "Open demo workspace". No login needed. Source: https://github.com/priyansh-narang2308/bursar

Built With

Share this project:

Updates

Submission history