Holdfast Protocol

A trust layer for AI-powered commerce that combines PayPal payments, deterministic verification, tamper-evident proof of acceptance, and adversarial AI audits to prevent unsafe payment decisions.

Comment

Holdfast Protocol

Trust Infrastructure for AI-Powered Commerce

Inspiration

AI agents are becoming capable of researching products, making decisions, and coordinating complex workflows. As these agents become more autonomous, a critical question emerges: How do we let AI participate in financial workflows without giving it unchecked authority over payments?

An AI agent can misunderstand a request, recommend an excessive amount, or be manipulated by malicious instructions. In a payment workflow, these mistakes can have real financial consequences.

We built Holdfast Protocol around a simple principle: AI can propose a payment, but it should never be the sole authority that permits one.

Our goal is to make AI-powered commerce safer by placing deterministic policies, explicit approval steps, and verifiable evidence between an AI-generated recommendation and a payment action.

What It Does

Holdfast Protocol is a payment-safety layer for AI-powered commerce. It combines AI-assisted decision-making with deterministic authorization policies and a payment workflow built around PayPal.

The system is designed to:

  • Evaluate payment proposals: Check proposed payments against configured policies and spending limits.
  • Enforce deterministic safeguards: Reject proposals that violate payment rules, regardless of how confidently the AI recommends them.
  • Identify suspicious requests: Demonstrate how adversarial or prompt-injection-style instructions can be blocked by the safety layer.
  • Support explicit approval: Separate policy evaluation from the approval required to proceed with a payment.
  • Integrate with PayPal: Use PayPal Orders and authorization/capture workflows to connect payment decisions with payment execution.
  • Maintain an auditable workflow: Record decisions and relevant evidence so the reasoning behind a permitted or rejected action can be inspected.

The central idea is simple: intelligence may help make a decision, but financial authority must remain constrained by enforceable rules.

How We Built It

Holdfast Protocol uses a web application, a backend policy engine, and an MCP server to organize its payment-safety workflow.

Frontend: React and Vite provide the interface for reviewing payment proposals, inspecting decisions, and following the workflow.

Backend: Node.js and Express coordinate the application logic and enforce the payment-safety rules.

Policy enforcement: Deterministic checks evaluate payment proposals against configured limits and conditions. The AI-assisted layer does not independently authorize payments.

PayPal integration: PayPal Orders API and the authorization/capture workflow provide the payment integration. Sandbox buyer approval is part of the authorization flow where required.

Model Context Protocol (MCP): The MCP server exposes structured capabilities for AI-assisted interactions with the system.

Testing: Automated tests cover policy decisions, validation, and adversarial scenarios.

The workflow follows a clear sequence:

  1. Create a payment proposal.
  2. Evaluate it against the configured policies.
  3. Approve or reject it according to the required controls.
  4. Verify the relevant conditions and evidence.
  5. Proceed to payment authorization or capture only when the applicable requirements are satisfied.

The application also includes simulated scenarios to demonstrate policy violations and rejection behavior without executing real payments. These simulations are distinguished from actual PayPal Sandbox operations.

Challenges We Faced

One of our biggest challenges was defining a meaningful boundary between AI reasoning and financial authority.

An AI model can produce useful recommendations, but its output should not override a spending limit or bypass a required approval. We therefore focused on making policy enforcement deterministic and keeping the decision to permit a payment separate from the AI's recommendation.

We also had to think carefully about adversarial inputs, validation failures, and the difference between demonstrating a payment workflow and actually executing one. Keeping simulated demonstrations separate from payment operations was important for making the system easier to understand and safer to test.

Another challenge was making the safeguards visible. A security mechanism is more useful when a reviewer can see what was proposed, which checks were applied, and why the system allowed or rejected an action.

What We Learned

Building Holdfast Protocol reinforced three important lessons:

  1. AI recommendations and authorization are different things. An intelligent system should not automatically receive unrestricted financial authority.
  2. Security must be enforced outside the model. Critical payment rules need deterministic checks that do not depend on the model following instructions.
  3. Trust requires inspectable decisions. Clear policy outcomes, approval boundaries, and audit records make financial workflows easier to review.

We also learned how to connect a web application, backend safeguards, MCP capabilities, automated tests, and PayPal payment workflows into one coherent system.

What's Next

We want to extend Holdfast Protocol with stronger evidence verification, configurable policies, additional payment providers, and more comprehensive adversarial testing.

Our long-term vision is to provide a reusable trust layer for AI-powered commerce: one that allows AI agents to be useful while keeping financial actions governed by explicit, verifiable controls.

Holdfast Protocol — Payments for AI agents, with verifiable safeguards.

Share this project:

Updates

Submission history