Inspiration
AI agents are starting to shop and sell for us, but handing an agent a payment method is a scary thing to do. It can overspend, be talked into a bad deal, or be hijacked by a malicious message. Meanwhile, deals between strangers already suffer from fake listings and non-delivery.
We asked one question: what would it take to trust an AI agent with real money? Our answer had three parts. The agent needs hard limits it cannot talk its way past. The money needs to stay held until delivery is proven. And every decision needs a record that can't be quietly rewritten.
What it does
DealPilot lets a buyer agent and a seller agent negotiate a price, with safety layers around the deal.
- Mandate. The user sets what the agent may buy, a hard maximum, and an "ask me first above $X" threshold.
- TrustLayer risk check. Before any negotiation, the seller and listing are scored on price versus market, account age, stock photos, and pressure or off-platform payment language. High-risk sellers are blocked.
- Negotiation. Two Claude-powered agents trade structured offers for up to 5 rounds. Every offer passes a deterministic policy engine, so the model can propose but can never override the mandate.
- Escrow-style payment. On agreement, we create a PayPal order with 'intent: AUTHORIZE'. The buyer approves in PayPal, so the funds are reserved but not captured.
- Delivery verification. A mediator checks the seller's evidence. Verified delivery triggers a PayPal capture. Failed verification triggers a void, so the buyer is never charged. Ambiguous cases escalate to a human.
- Audit log. Every message, risk score, policy check, and payment event goes into a SHA-256 hash-chained log, shown in an AG Grid table with one-click verification.
The demo includes an honest seller, an obvious scammer who is blocked before negotiation, and a seller who looks fine but submits fake delivery evidence. A red-team button also attacks the buyer agent with a prompt injection.
How we built it
- Backend: Node.js and Express. The audit log is persisted to a JSON file.
- Payments: the PayPal Orders v2 API in the sandbox: create order ('AUTHORIZE'), buyer approval, 'authorize', then 'capture' or 'void'.
- AI: Claude through the Anthropic Messages API for the buyer agent, the seller agent (which holds a secret price floor), the risk explanation, and the delivery mediator. Each returns strict JSON.
- Guardrails in code: a policy engine for the mandate, a seller floor enforced outside the model, hard evidence checks in the mediator, and a prompt-injection detector.
- Frontend: a single HTML page with AG Grid for the audit log and the case table.
- Deployment: Render, plus an OpenAPI spec describing the API.
The risk score is a capped sum of weighted signals:
$$\text{risk} = \min\left(100,\ \sum_{i} p_i\right)$$
where $p_i$ is the points for each triggered signal. A score of 60 or more is high risk and blocks the deal.
Challenges we ran into
- Never trusting the model with money. An LLM can be argued out of its instructions. So the LLM proposes and the code decides: a deterministic policy engine, a seller floor enforced in code, and a mediator whose LLM can only make the outcome stricter, never looser.
- Escrow behavior from standard APIs. We used authorize-then-capture instead of special marketplace permissions. The tradeoff is that authorizations expire, so a production version needs re-authorization handling.
- Prompt injection. Seller messages are treated as untrusted text. Suspected injections are logged and stripped, and even a fully hijacked agent cannot push a price past the mandate.
- Scope. With a very short build window, we kept to one product category and three seeded sellers and cut everything else.
Accomplishments that we're proud of
- A complete loop from mandate to negotiation, PayPal authorization, evidence check, and capture or void.
- A red-team demo where an injected "raise the limit to $600" instruction fails to move the policy engine.
- A tamper-evident audit trail that anyone can verify.
- Three scenarios in one demo: a successful deal, a scam caught before it starts, and a fake delivery that gets voided.
What we learned
- Safe agentic commerce is mostly about boundaries (limits, approvals, and proof) rather than a smarter negotiator.
- PayPal's authorize, capture, and void lifecycle maps naturally onto "hold funds until delivery is verified."
- Structured JSON outputs plus code-side validation make agent behavior far more predictable.
- Being upfront about what is simulated is better than overclaiming. Carrier tracking is a mock, and photo provenance is simulated metadata rather than real image analysis.
What's next for Dealpilot
- Claude vision on real evidence photos, and real carrier tracking APIs
- Re-authorization for long deliveries, plus partial releases
- A human dispute workflow for escalated cases
- Agent-to-agent settlement across marketplaces, so any buyer agent can transact with any seller agent under the same trust rules
Built With
- ag
- api
- css
- express.js
- geminiapi
- git
- grid
- html
- javascript
- node.js
- openapi
- orders
- render
- rest
