DealMind + IntentLock

Tamper-evident SHA-256 audit log tracking every negotiation turn, invariant check, and verified PayPal Sandbox settlement event.
IntentLock™ zero-trust firewall: Mathematically verifying 9/9 cryptographic security invariants before authorizing PayPal checkout.
Buyer workspace: Comparing merchant offers, evaluating seller policies, and locking in ceiling budgets before autonomous delegation.
DealMind dashboard: Real-time monitoring of autonomous negotiation agents, active deals, savings metrics, and IntentLock firewall status.
Autonomous multi-turn AI negotiation: Buyer & merchant agents negotiate price and terms dynamically within strict user constraints.

Inspiration

AI agents are getting better at finding products, comparing offers, and negotiating — but there is a problem: what happens when the AI makes a decision that the user never actually intended to approve?

We wanted to solve the gap between AI autonomy and human control.

That led us to DealMind + IntentLock™: an autonomous commerce agent where AI can negotiate the deal, but an independent security layer makes sure the final terms still match the buyer's original intent before any payment can happen.

Our core idea was simple:

Let AI negotiate the deal. Let IntentLock protect the decision.

What it does

DealMind acts as an autonomous buyer agent. A user provides their requirements — such as product, maximum budget, condition, delivery time, warranty, and subscription preferences.

The AI then evaluates available offers and negotiates with seller agents to find the best compliant deal.

But negotiation is not the final authority.

Before checkout, IntentLock™ independently verifies the negotiated agreement against the buyer's original constraints. It checks critical conditions including:

Price and currency
Product identity
Product condition
Delivery time
Warranty
Recurring subscriptions
Additional or hidden fees
Bilateral acceptance of the negotiated deal

Only when all required constraints pass can the transaction move toward payment.

The final payment flow also requires explicit human approval, followed by a single-use authorization that is securely bound to the verified deal. PayPal Sandbox then handles the actual payment, while DealMind validates the payment result before marking the transaction complete.

How we built it

We built DealMind as a full-stack agentic commerce system.

The frontend was built with React, TypeScript, Vite, and Tailwind CSS, with a dashboard that exposes the negotiation, IntentLock verification, approval, payment, and audit trail.

The backend uses Node.js, Express, TypeScript, and SQLite for persistent deal, approval, payment, and audit records.

For autonomous negotiation, we integrated Groq's LLM infrastructure using openai/gpt-oss-120b through a provider abstraction, allowing the negotiation engine to remain independent of a specific model provider.

The security architecture is built around a key principle:

The AI negotiator does not get to decide whether its own negotiated result is safe to pay for.

IntentLock independently generates and verifies a canonical contract fingerprint. Human approval is then bound to that verified contract, amount, currency, and user through a single-use authorization mechanism.

For payments, we integrated the PayPal Sandbox REST API. The complete lifecycle was tested with a real Sandbox order, buyer approval, authoritative capture, payment verification, and reconciliation.

Challenges we ran into

The hardest part was not simply getting an AI agent to negotiate. It was making the entire chain safe, deterministic, and verifiable.

We had to deal with issues around maintaining the integrity of the negotiated terms, preventing stale or reused approvals, securely binding authorization to the correct deal, validating PayPal responses, handling duplicate capture requests, and safely reconciling payment states.

We also encountered a real PayPal Sandbox issue where an earlier order expired before capture. Instead of bypassing the problem or modifying the database manually, we treated it as a genuine payment-state failure and rebuilt the flow around proper order lifecycle handling.

Another challenge was balancing autonomy with human control. We wanted the AI to do meaningful work independently while ensuring that the user always remained the final authority over the transaction.

Accomplishments that we're proud of

We are especially proud that DealMind is not just a UI demo — the complete transaction pipeline was actually exercised end-to-end.

The final verified Sandbox transaction successfully completed:

AI negotiation → IntentLock verification → human approval → PayPal Sandbox checkout → PayPal capture → payment verification → audit trail

The negotiated deal was $74.00 USD for a Samsung 980 1TB NVMe SSD.

IntentLock verified 9/9 required constraints, and the PayPal Sandbox transaction reached COMPLETED with an authoritative capture.

We also achieved:

182/182 full workspace tests passing
128/128 backend tests passing
Clean frontend production build
Clean backend TypeScript build
Passing GitHub Actions CI
Automated security and payment lifecycle testing
Persistent audit trail for important transaction events
Idempotent payment capture and reconciliation handling
Sandbox-only payment enforcement

Most importantly, we built the system around a security principle we believe is essential for agentic commerce:

An AI agent can negotiate on your behalf without being allowed to silently redefine what you agreed to.

What we learned

We learned that building an agentic system is very different from simply adding an LLM to an application.

The model can reason and negotiate, but trust cannot come from the model alone.

Critical decisions need deterministic validation, explicit authorization, strong state management, and independent verification.

We also learned that payment integration is not just about creating an order and calling a capture API. Real payment systems require careful handling of authorization, expiration, duplicate requests, external state, reconciliation, and failure scenarios.

Most importantly, we learned that the best agentic systems may not be the ones that give AI the most control — they are the ones that give AI useful autonomy inside clearly enforced boundaries.

What's next for DealMind + IntentLock

Our current implementation uses a controlled demonstration catalogue and PayPal Sandbox. The next step is taking the architecture beyond the demonstration environment.

We envision DealMind becoming an agentic commerce security layer that can work across multiple merchants, marketplaces, payment providers, and AI agents.

Future directions include: