Handshake: Trust for Agent-to-Agent Commerce

Inspiration

AI agents can already shop and pay for us. What they can't do yet is prove what they were allowed to do. When an agent buys the wrong thing, the merchant usually eats the cost, the user says "I never approved that," and nobody has evidence either way. PayPal's leadership has publicly said that when consumer agents buy from merchant agents, each side has to be able to validate the other. We wanted to build that missing layer and make it concrete enough to demo.

What it does

Handshake is an open-source trust layer for agent-to-agent commerce, running on the PayPal Sandbox.

Signed mandate. A human gives a buyer agent a cryptographically signed spending mandate: budget, per-item cap, allowed categories, forbidden substitutions, expiry.
Handshake. The buyer agent and a merchant agent exchange attestations and fresh challenges before negotiating. Attestations come from a simulated trust anchor, standing in for PayPal identity or agent tokens.
Negotiation. The agents negotiate a bundle and price. Limits are enforced by deterministic code on both sides, not by prompts, so neither agent can be talked out of its rules.
Payment. The agreed cart is paid through the PayPal Sandbox.
Deal receipt. Both agents sign a tamper-evident receipt, appended to a hash-chained evidence ledger.
Dispute Court. If something goes wrong, an arbiter reads the evidence packet. Deterministic checks run first, and an LLM is used only for real ambiguity and can only cite evidence that exists in the packet. It returns a verdict, a liability split, and a ready-to-send dispute response. Trust scores update.

In our demo the same dispute plays out twice. In Case A the merchant delivered exactly what was agreed and wins with evidence. In Case B a misconfigured buyer agent exceeded its mandate, and liability shifts to the agent's deployer.

How we built it

Frontend: React, Vite, Tailwind, AG Grid for the filterable evidence ledger, live updates over Server-Sent Events
Backend: TypeScript, Fastify, PostgreSQL with Drizzle, Zod validation at every boundary
Agents: Claude with tool use for the buyer, merchant, and arbiter, with strict message schemas and a MandateGuard that checks every action before any state changes
Payments: PayPal Sandbox via [Agent Toolkit / Orders v2 API], behind a PaymentProvider interface
Catalog: [Channel3 product data / fixture catalog]
Evidence: ed25519 signatures and an append-only hash-chained ledger whose verifier pinpoints the first tampered entry
Ship: Render deployment, GitHub Actions CI, Vitest and Playwright tests

Challenges we ran into

Keeping LLMs inside the rules. Prompts alone aren't a safety boundary, so every limit lives in deterministic code. Counterparty messages are treated as untrusted data, and we test prompt-injection attempts against both agents.
Making the arbiter trustworthy. An LLM judge can invent evidence, so the arbiter's answer is rejected if it cites anything not in the packet.
Sandbox limits. The PayPal Sandbox can't attest real identities, so that part is simulated and labeled everywhere in the code, UI, and README. [Add what the sandbox did and didn't support for disputes.]
Demo reliability. Live LLM calls are slow and variable, so we built a record/replay layer that keeps demos deterministic while live mode still works.

Accomplishments we're proud of

A full loop from signed mandate to dispute verdict. Flip one byte in the ledger and the verifier shows exactly which entry broke.
[N] automated tests, including prompt-injection and tampering cases.
Clear labeling of what is real (PayPal Sandbox payments, signatures, ledger) and what is simulated (identity attestations).

What we learned

Agent safety belongs in deterministic code. The LLM should phrase and judge ambiguity, not enforce limits.
Agent disputes are an evidence problem before they're an AI problem.

What's next

Replace the simulated trust anchor with real PayPal identity or agent tokens
Adapters for emerging agent-commerce protocols
Real dispute API integration, merchant dashboards, and reputation shared across platforms

Try it

Code: https://github.com/RHarshith2005/paypal.git . Run Case A and Case B from the demo page. Sandbox test accounts and setup steps are in the README.