Gofer

Inspiration

Every week brings another demo of an AI agent that can buy things for you. Almost none of them answer the question that actually matters: how do you let an agent spend your money without handing it a blank cheque? "Are you sure?" popups don't scale to autonomy, and a raw card on file is a disaster waiting to happen. We wanted the missing piece — a way to give an agent real spending power and a hard, enforceable leash at the same time.

What it does

Gofer is an AI shopping agent governed by a server-enforced Mandate. You hand it a goal in plain English — "restock the good coffee beans, under $20" — and it searches a real product catalog, reasons about the best pick, screens that pick against your rules, and settles through real PayPal.

The Mandate is the leash, and it lives on the server, not in the browser:

• Total budget and per-item cap
• Auto-approve threshold — buys under it settle hands-free; above it wait for one human tap
• Allowed categories and blocked merchants
• Expiry

Every pick resolves to one of four honest verdicts — auto-approve, needs approval, denied, or abstain — and every move is written to a sortable audit ledger with the real PayPal order and capture IDs. Gofer also runs standing errands: recurring, mandate-bound jobs that fire on a schedule and settle on their own, still screened by the same Mandate.

How we built it

• Agent loop: an AI SDK tool loop that searches the Channel3 product catalog and reasons with Meta Muse (served on Baseten), with a deterministic fallback so a demo never dead-ends.
• Payments: PayPal Orders v2 for settlement and Vault v3 for hands-free, card-on-file auto-approved buys.
• The Mandate is enforced server-side. The browser holds only a mandate id — it cannot lift its own cap. Every spend is checked against the live budget, caps and allowlist before any money moves, which maps cleanly onto PayPal's AP2 agentic-payments mandate direction.
• Frontend: Next.js (App Router) + React + Tailwind, an AG Grid audit ledger, and a Bryntum Gantt for standing errands.
• Durability: deployed on Render with a persistent disk, so the mandate state and ledger survive restarts and redeploys.

Challenges we ran into

• Keeping the guardrail honest. Early on the agent would fall back to the cheapest item regardless of the goal; we made it require a real goal match and abstain rather than buy junk.
• Durability for real. A mandate that resets on every deploy isn't a mandate. We moved state onto a persistent disk and proved it holds across restarts.
• Autonomous runs that read clearly. Getting the Gantt to lay recurring runs on their true dates took honoring explicit scheduling instead of the engine's auto-placement.

Accomplishments that we're proud of

• A spending agent you'd actually trust: limits enforced where the agent can't reach them.
• Real PayPal orders and captures — not a mock — logged to an auditable trail.
• Four legible verdicts, including the agent choosing to abstain when nothing fits.
• Standing errands that spend safely over time, not just one-shot buys.

What we learned

Autonomy is a trust problem before it's a capability problem. The hard part of agentic commerce isn't getting an agent to buy something — it's making the limits the source of truth and keeping the agent on the far side of them.

What's next for Gofer

• Per-merchant and per-category sub-mandates, and shared team mandates.
• A durable queue / cron for standing errands across multiple instances.
• Full alignment with PayPal's AP2 mandate standard as it lands.
• Dispute and refund flows wired back into the ledger.

Built With

• ag-grid
• ai-sdk
• baseten
• bryntum
• channel3
• meta-muse
• next.js
• node.js
• paypal
• react
• render
• tailwind-css
• typescript