IntentLock

AI builds the cart, managers lock the SHA-256 hash, and PayPal executes only what was approved—eliminating AI price hallucinations and post-approval cart drift via PayPal Sandbox Orders v2 & MCP.

Comment

Inspiration

Autonomous AI agents are great at finding products and building shopping carts, but businesses still hesitate to give AI agents direct access to corporate PayPal instruments. Why? Because if an AI hallucinates a unit price, miscalculates multi-pack quantities, or if a shopping cart changes between manager review and payment execution (TOCTOU: Time-of-Check to Time-of-Use cart drift), unauthorized money leaves the account.

When we interviewed $N = 3$ small-team coordinators (Maya Lin, Jordan Vance, and Elena Rostova), we found they spent an average of $14.2\text{ minutes}$ per order manually translating informal team requests into pack quantities, experienced a $23.3\%$ pack-size math error rate, and saw $33.3\%$ of carts drift between Slack screenshot approval and actual checkout. We built IntentLock to solve the "last mile" of agentic commerce: separating AI cart preparation from human financial authorization and PayPal payment execution using cryptographic intent locking.

What it does

IntentLock (https://intentlock-unys.onrender.com/) is an interactive B2B purchasing agent and PayPal checkout storefront for teams buying routine supplies from a verified merchant (Acme Workspace Supplies, MERCH-ACME-001, 15 USD SKUs):

  1. Step 1 — AI Shopping Cart Builder (Coordinator — Alice Chen): Translates informal natural-language supply needs into a structured, inventory-checked cart version $v_n$. For a team of headcount $H$ requiring $r_i$ units per person of SKU $i$ sold in packs of size $p_i$ with warehouse stock $S_i$, our unprivileged AI agent computes the exact pack quantity $q_i$: $$q_i = \min\left(S_i,\; \left\lceil \frac{H \times r_i}{p_i} \right\rceil \right)$$ Deterministic guardrails (G-01, G-02) bind authoritative SQLite prices $c_i$ (in integer USD cents) so the cart total is strictly: $$T_{\text{cents}}(v_n) = \sum_{i=1}^{k} c_i \cdot q_i \le B_{\text{cents}}$$

  2. Step 2 — Cryptographic Approval Lock (Approver — Bob Martinez): Enforces strict Separation of Duties (G-04 blocks the requesting Coordinator from self-approving: $\text{actor}{\text{approver}} \neq \text{actor}{\text{coordinator}}$). When Manager Bob approves Cart $v_n$, IntentLock serializes the cart via RFC 8785 Canonical JSON ($\text{JCS}(v_n)$), computes a deterministic 64-character SHA-256 intent_hash, and signs an immutable ApprovalLock with HMAC-SHA256 and expiration timestamp $t_{\text{exp}}$ (G-06): $$h_{\text{intent}} = \text{SHA256}\big(\text{JCS}(v_n)\big)$$ $$\sigma_{\text{lock}} = \text{HMAC-SHA256}{K}\big(r{\text{id}} \;|\; v_n \;|\; h_{\text{intent}} \;|\; \text{approver_id} \;|\; t_{\text{exp}}\big)$$

  3. Step 3 — Verified PayPal Sandbox Checkout (Buyer — Charlie Kim): Right before calling PayPal (t_{\text{now}} < t_{\text{exp}}), IntentLock recomputes the live cart's hash $h_{\text{live}} = \text{SHA256}(\text{JCS}(v_n^{\text{live}}))$ (G-05). If even $1\text{ cent}$ or $1\text{ unit}$ drifted after Bob's approval ($h_{\text{live}} \neq h_{\text{intent}}$), checkout is deterministically blocked (409 STALE_APPROVAL_HASH_MISMATCH). Only when $h_{\text{live}} \equiv h_{\text{intent}}$ does IntentLock invoke the PayPal Sandbox Orders v2 REST API (/v2/checkout/orders) and PayPal Agent Toolkit MCP (@paypal/agent-toolkit: create_order, get_order, pay_order), binding purchase_units[0].custom_id $= h_{\text{intent}}$ inside the live PayPal order.

  4. Step 4 — 6-Invariant PayPal Reconciliation & Tamper-Evident Receipt: Queries the authoritative PayPal Sandbox Order (GET /v2/checkout/orders/{id}) and verifies all 6 settlement invariants (Order Status == COMPLETED, Capture Status == COMPLETED, Currency == USD, $T_{\text{captured}} == T_{\text{approved}}$, $\text{custom_id} == h_{\text{intent}}$, and $|\text{purchase_units}| == 1$), sealing a hash-chained audit receipt: $$E_k = \text{SHA256}\big(E_{k-1} \;|\; \text{payload}_k\big)$$

How we built it

  • PayPal Sandbox Integration: Built on PayPal Sandbox Orders v2 REST API (/v1/oauth2/token, /v2/checkout/orders), the PayPal JavaScript SDK for interactive buyer popup approval, PayPal Sandbox Negative Testing (PayPal-Mock-Response: INSTRUMENT_DECLINED, DUPLICATE_INVOICE_ID), and a Model Context Protocol (MCP 2025-11) Adapter compatible with @paypal/agent-toolkit (create_order, get_order, pay_order).
  • Cryptographic Guardrail Engine (G-01 to G-08): Built in Python 3.11 and FastAPI with SQLite WAL atomic checkout locking, RFC 8785 Canonical JSON serialization, $\text{SHA-256}$ intent hashing, $\text{HMAC-SHA256}$ approval signatures, and hash-chained audit logs.
  • Multi-LLM Automatic Failover Router: Engineered a low-latency, priority-ordered AI router cascading across Google Gemini 2.5 Flash ($\approx 1.3\text{s}$ with thinkingBudget=0 $\rightarrow$ gemini-2.5-flash-lite) $\rightarrow$ Groq Cloud LPU (openai/gpt-oss-120b) $\rightarrow$ OpenRouter Free Tier (google/gemma-4-31b-it:free) with automatic circuit-breaker failover on HTTP 429 rate limits.
  • Interactive Frontend Storefront: Built with React 18, TypeScript, Vite, and Tailwind CSS, containerized via multi-stage Docker and deployed on Render.

Challenges we ran into

  • Eliminating Floating-Point & Serialization Drift: In IEEE 754 floating-point math, $0.1 + 0.2 \neq 0.3$, and JSON key ordering differences completely change a $\text{SHA-256}$ digest. We solved this by storing all prices in integer cents ($c_i \in \mathbb{Z}^+$), sorting line items deterministically by SKU, and enforcing RFC 8785 JSON Canonicalization before hashing and formatting PayPal's two-decimal USD strings.
  • Handling Network Drops During Payment Capture (PAYMENT_UNCERTAIN): If a network timeout occurs during PayPal capture, retrying blindly risks double-charging, while assuming success risks unverified orders. We designed an idempotent checkout state machine (PayPal-Request-Id) that transitions interrupted captures to UNCERTAIN_NEEDS_SYNC and resolves them strictly via read-only verification against PayPal's GET /v2/checkout/orders/{id} endpoint (G-08).
  • Optimizing Live LLM Latency & Rate-Limit Resilience: Default thinking tokens on reasoning models added $>10\text{s}$ of latency. Tuning thinkingBudget: 0 for structured JSON synthesis cut Gemini 2.5 Flash latency down to $\approx 1.3\text{s}$, backed by zero-downtime failover to Groq LPU.

Accomplishments that we're proud of

  • End-to-End Cryptographic Binding with Live PayPal Sandbox Orders: Every live PayPal Sandbox Order created by IntentLock carries the human-approved $\text{SHA-256}$ intent_hash inside purchase_units[0].custom_id, proving cryptographically that the exact cart paid on PayPal matches the exact cart approved by the manager.
  • Quantitative Benchmark Improvements:
Metric Manual Baseline ($N=3$) IntentLock Workflow Improvement
Request-to-Cart Time $14.2\text{ min}$ $38.4\text{ sec}$ $95.5\%$ faster
Pack-Size Math Error Rate $23.3\%$ $0.0\%$ $100\%$ reduction
Post-Approval Cart Drift (TOCTOU) $33.3\%$ $0.0\%$ $100\%$ eliminated
  • $100\%$ Pass Rate Across 10 Golden & Adversarial Evaluation Scenarios: Achieved a perfect SKU selection score: $$F_1 = \frac{2 \cdot \text{Precision} \cdot \text{Recall}}{\text{Precision} + \text{Recall}} = 1.00$$ alongside $100\%$ prompt-injection & price-override rejection ($0.01 override blocked by G-01/G-03), $100\%$ self-approval blocking (G-04), and $100\%$ TOCTOU tamper detection (G-05).

What we learned

  • AI Agents Need Cryptographic Boundaries, Not Just System Prompts: Prompt instructions alone cannot guarantee financial safety. Separating the unprivileged AI proposer from the human cryptographic signer and the PayPal execution gate makes agentic commerce trustworthy by construction.
  • Canonical State Versioning Makes Human-in-the-Loop Practical: Treating every cart edit as an immutable version ($v_1 \rightarrow v_2$) that automatically supersedes stale approvals eliminates ambiguity between coordinators, managers, and finance buyers.

What's next for IntentLock

  • Hardware Passkey / WebAuthn Manager Signing: Upgrading $\text{HMAC-SHA256}$ manager approval signatures to hardware-backed FIDO2/WebAuthn passkeys ($\text{ECDSA P-256}$) for enterprise treasury compliance.
  • PayPal Webhooks & Multi-Merchant Payouts: Adding asynchronous PayPal Webhook listeners (CHECKOUT.ORDER.APPROVED, PAYMENT.CAPTURE.COMPLETED) and multi-vendor split settlement via PayPal Payouts.
  • ERP & Slack/Teams MCP Connectors: Allowing coordinators to draft requests in Slack while managers approve and lock $\text{SHA-256}$ cart hashes directly from mobile notifications.

Built With

Share this project:

Updates

Submission history