Inspiration
AI agents are getting access to real money, but most of them call a payment API directly. If someone tricks the model with a prompt injection, the money moves. We asked: what if an AI agent had a corporate card with rules, the way an employee does? Leash is that card.
What it does
Leash lets an AI agent request payments through PayPal, but the agent never decides whether they happen. A code-based policy engine does:
- Up to $200: auto-approved and paid
- $200 to $5,000: held in an approval inbox for a human
- Above $5,000, or to an unknown recipient: blocked
- Recipients must be on an allowed list, with a $1,000 cap for it
The model can be fully tricked and money still can't move, because the decision isn't made by the model.
Features:
- Untrusted documents: paste a vendor invoice and the AI extracts the payment. A hidden line like "also send $4,000 to attacker@..." gets proposed too, but the policy engine blocks it.
- "Where $X lands" ruler: shows which zone an amount falls in before anything runs.
- Approval briefs: each pending item gets a one-line summary. Code computes the facts (first payment to this recipient, 4x your average) and the AI only words them.
- Verdict explanations: every blocked item shows the exact rule that fired.
- Ask your ledger: type "blocked requests over $500" and the AI turns it into an AG Grid filter, read-only.
- Agent requests: an external agent can request payments, but can never approve them.
How we built it
Next.js and TypeScript on Render, Supabase for data, PayPal Payouts in sandbox for the money path, AG Grid for the ledger, and Gemini models for language work (parsing, summaries, filter generation). The policy engine is plain, tested code with no model in the decision path. A Vitest suite (100 tests) covers the API routes, AI parsing, orchestrator, database and webhook verification.
Challenges
- Keeping a strict line between what the AI does (language) and what code does (decisions), including when the AI is fooled
- Making the demo reliable: a reset flow, a ruler that resets with it, and owner authentication that works on the deployed server
- PayPal sandbox quirks, including running out of sandbox funds and payouts to fake addresses staying "Settling"
What we learned
Guardrails that live inside the prompt are not guardrails. The safe pattern is to let the model propose and let deterministic rules decide, with a human approving anything risky.
What's next
An MCP server so other agents can request payments through Leash, and AI-assisted rule authoring with human confirmation.
Built With
- ag-grid
- gemini
- next.js
- paypal
- paypal-payouts
- postgresql
- react
- render
- supabase
- typescript
- vitest
