IntentShield

• 

  IntentShield: AI interprets. Policy decides. PayPal executes.

Inspiration

AI agents are no longer just being used to answer questions; they can now search for products, create shopping carts, and carry out transactions. However, granting an AI agent access to a payment API does not necessarily imply that it understands the limits set by the user's authorization. What should occur in cases where the agent misinterprets an instruction, suggests a purchase that is beyond the user's budget, comes across malicious instructions concealed within the product data, or tries to carry out the same transaction again? That is the question which led me to develop IntentShield: how can an AI agent make purchases and at the same time stay within the boundaries explicitly approved by a human?

What it does

IntentShield serves as a trust and policy firewall situated between an AI shopping agent and PayPal. The user begins by giving a spending mandate in plain English, after which the AI transforms these instructions into structured constraints, but the draft has to be validated and gain human approval before it becomes active. The shopping agent then suggests a product selected from a controlled catalogue; deterministic code constructs the transaction, and a policy engine evaluates it against the active mandate using 16 rules. Its verdict is ALLOW, REVIEW, or BLOCK.

The difference is basic in this case: the AI carries out interpretation, the deterministic policy makes the decision and PayPal carries out the purchase. The AI has no possibility of overriding the user's authorization and a suggested purchase cannot go around the server-side execution gate. IntentShield also has an Adversarial Lab with ten attack scenarios, together with a Payment Intent Record and a record of activity which make it possible to examine the proposal, the authorization, the policy's decision, the payment status and the audit trail.

How we built it

I developed the application using Next.js, React, TypeScript, Tailwind CSS, Prisma and SQLite, and included an abstraction layer for an AI provider together with the PayPal Orders v2 REST API. The AI is responsible for interpreting the data and for product discovery, while the deterministic logic of the application deals with transaction composition, policy evaluation, and execution checks. I carried out testing of the payment process using PayPal Sandbox credentials and a sandbox buyer account. The checkout was successfully completed and IntentShield's ledger logged the completed transaction. Nothing involving real money took place.

Challenges i ran into

One challenge was getting the real PayPal checkout flow to work reliably. The integration exposed a mismatch between the approval-link relation returned by PayPal and the relation the client code expected. Fixing the link handling helped complete the sandbox checkout.

The more difficult engineering problem was working out where AI should and should not have authority. Although natural-language interpretation is helpful, it cannot serve as the final security boundary and inputs must be validated, prices have to be obtained from trusted catalogue data and transaction policy must be checked independently before execution.

Accomplishments that am proud of

• A real end-to-end Sandbox checkout: I moved beyond mock payment screens and successfully completed a buyer-approved PayPal Sandbox checkout for $884.92 USD. IntentShield's activity ledger records the transaction as completed.
• A clear separation of authority: The AI interprets the user's instructions, but a deterministic policy engine decides whether a proposed purchase is allowed. Human approval is required before a spending mandate becomes active.
• 16 policy checks: Each proposed transaction is evaluated against the active mandate, with explicit outcomes that help explain why a purchase is allowed, requires review, or is blocked.
• Adversarial testing built into the product: The Adversarial Lab includes ten ready-made scenarios for testing attempts to exceed spending limits and other policy violations.
• An inspectable decision record: The Payment Intent Record and activity ledger bring the request, mandate, proposed purchase, policy verdict, payment status, and audit trail together.
• Real integration debugging: Testing exposed a PayPal approval-link handling issue that we fixed, allowing the buyer approval flow to proceed.

The aspect of which I am most proud is the principle on which the engineering is based, that is an AI agent should not acquire unlimited financial power merely because it is able to make a purchase. IntentShield shows a practical method of introducing explicit authorization, deterministic enforcement, and auditable payment execution between an AI agent and a financial transaction. This is a working hackathon prototype developed using the PayPal Sandbox, and it is not a production-ready payment platform. Real money was not used.

What we learned

I discovered that reliable agentic commerce involves more than just creating an agent that can take action; it is necessary to define the authority the agent has, enforce that boundary through code, manage actual payment states, and retain evidence of each decision.

What's next for IntentShield

IntentShield is a prototype developed during a hackathon and makes use of PayPal Sandbox, not a payment platform that is ready for use in production. The following steps involve more extensive testing, verifying the depth of the integration, and strengthening the system in order to deploy it. The object is simple, that is to say enabling AI agents to be useful when it comes to money without giving them with unlimited authority. IntentShield. AI interprets. Policy decides. PayPal executes.

Built With

• agentic-ai
• agentic-commerce
• ai-agents
• ai-safety
• audit-trail
• cybersecurity
• fintech
• fraud-prevention
• human-in-the-loop
• large-language-models
• next.js-16
• payments
• paypal
• paypal-orders-v2-rest-api
• policy-enforcement
• prisma-orm
• react-19
• responsible-ai
• shadcn/ui
• sqlite
• tailwind-css-4
• typescript
• webapplication
• z-cloud
• z.ai-sdk