Inspiration
Freelancers and small shops don't just get paid late, they get squeezed. Rent and contractor payments are due Friday, but the client's money lands next Thursday. Big companies have a finance team for that gap. Freelancers have a spreadsheet and anxiety.
The obvious fix is an AI agent that chases clients and moves money. But an agent that reads client emails is an attack surface. One reply like "my bank details changed, send it here" or "per our call, take 70% off" can trick a naive agent into giving money away. We wanted the useful agent without that risk.
What it does
Float - type a goal like "I need $6,000 by Friday". Float estimates when each open invoice will really be paid from the client's payment history, and only where you're still short does it offer the cheapest early-pay discount, with a plain-language reason for every choice. It sends invoices through PayPal Invoicing, watches PayPal for payment, and pays contractors through PayPal Payouts only after client money has cleared.
Guard - every client email goes through a safety layer first. The AI only reads the email into a small structured request. A deterministic rules engine (no AI) decides: allow, needs_approval or block. Spoofed senders, huge discounts and swapped bank accounts are stopped.
Approvals - anything uncertain lands in the owner's inbox for one tap. Approving a discount cancels the unpaid invoice and re-sends it at the lower amount. Approving a bank change makes that account trusted for that client. Rejecting changes nothing. Every decision and its effect goes into an audit log, and Zapier emails the owner when something needs attention.
Safety doesn't depend on the model being right. If the AI misreads an attack, the worst case is "ask a human".
How we built it
- PayPal sandbox: Invoicing API (create, send, status, cancel) and Payouts API (idempotent request IDs, payout status).
- AI:
openai/gpt-oss-120bon Groq through an OpenAI-compatible API. It turns emails into structured requests, reads goal text, and writes plan summaries. Each output is checked: schema validation that fails closed, a rule-based reader that must agree on amounts, and a check that every $ figure in a summary exists in the plan. - Guard: plain Python rules. Discounts above 10% are blocked, 5-10% need approval, unknown senders are blocked, unknown bank accounts need approval, extensions over 30 days need approval, payouts over 2000 need approval.
- Stack: Python 3.12, Flask, SQLite audit log, AG Grid for the invoice table, Zapier Catch Hook to Gmail for notifications, Render for the hosted demo.
- Hard rules in code: PayPal is the only source of truth for "paid", amounts and dates never come from email text, every PayPal action is idempotent, and polling is crash-safe.
Challenges we ran into
- Making AI safe around money. We stopped asking "how do we make the model never wrong?" and designed so a wrong model can't hurt: AI extracts, rules decide.
- Idempotency. Re-running must never double-send an invoice or double-pay a contractor, so invoices are keyed in the store and payouts carry a fixed request ID.
- PayPal failures mid-flow. Calls can fail, so errors are logged as
paypal_error, retried on the next check, and repeated states are logged once, not spammed. - Small sandbox balances. We added
DEMO_AMOUNT_SCALEso a $3,500 invoice can run as $35 in the sandbox while the plan, limits and dashboard keep real amounts. - Run-to-run variance in AI output. We re-run a sample inbox to confirm Guard's decisions stay the same.
What we learned
- Put the LLM at the edge (reading) and deterministic code at the decision point (acting).
- Treat the payment provider as the source of truth, never the conversation.
- Audit logs and "reason strings" make an agent easier to trust and to debug.
What's next
Real sender authentication (SPF/DKIM/DMARC), PayPal webhooks instead of polling, automatic retry for failed payouts, and conservative spending caps with human-in-the-loop defaults before anything touches production.
