LeashPay

Shop: coffee beans allowed → paid, gate trace + PayPal order ID
Wallet & rules: PayPal Vault connected, plain-English rules → confirmed policy
Shop: cookbook set over the ask-me limit → pending
Shop: gift card denied at Category
Approvals inbox: agent reason, rule, projected month
Approve → re-check → PayPal charge → paid
Approval re-check denies it, nothing charged
Inbox warning when the month filled up since the request
AG Studio dashboard overview (tiles, filters, donut, gate funnel, grid)
Purchases widget: AG Grid with Refund buttons on paid rows
Status filter "paid" cross-filtering the whole dashboard
Auditor agent "Why denied?" answering with numbers and filtering the page
Auditor "Anything suspicious?" spotting the agent probing the rules
Lead agent adding a "Catalog value by merchant & decision" chart
Edit layout with the Purchases and Gate funnel widgets in the picker

Inspiration

AI agents can already search, compare and fill a cart. The hard part is letting them pay. In a June 2026 YouGov poll for ACI (2,080 UK adults), only 19% said they trust an AI agent to follow their guidance. 70% said they would use agents less after a single unauthorized purchase.

Companies solved this long ago with corporate cards, spend limits and approval chains. People paying with PayPal have nothing like that for their own agents. LeashPay brings those finance-team controls to everyone: let the agent shop, but on a leash.

What it does

Connect PayPal once. Your PayPal account is saved securely through PayPal Vault, so the agent can pay without you at the keyboard.
Set rules in plain English. For example: "Max $200 a month, groceries and books only, ask me above $30." The AI turns this into a structured policy that you confirm.
Let the agent shop. Every purchase it wants to make goes through the policy engine first. The engine returns one of three answers:
- Allow: paid instantly through PayPal.
- Needs approval: you get a one-tap Approve or Reject on your phone.
- Deny: blocked, with the reason logged.
See everything. An AG Grid audit log shows every attempt, decision, rule, the agent's reasoning and the PayPal order ID. You can filter it, group it, and refund an order from the row.

How we built it

Backend: Python, FastAPI and SQLite.
Frontend: React, with AG Grid for the audit log.
AI: LLM tool calling, used for three jobs:
- shopping
- turning plain-English rules into JSON
- explaining decisions
PayPal (sandbox):
- Vault v3 to save the payment method: setup token, then payment token.
- Orders v2 with vault_id to pay when the buyer isn't present.
- Captures Refund API.
- Webhooks for capture status.

The key design choice is that the agent never touches PayPal directly. Its only way to spend is the request_purchase tool, and that tool always calls the policy engine first. The engine is plain, deterministic code with no AI in it, and it is unit-tested. For a purchase $p$ with amount $a(p)$ and category $c(p)$:

$$ d(p) = \begin{cases} \text{deny} & \text{if } c(p) \notin C_{\text{allowed}} \ \text{deny} & \text{if } S_{\text{month}} + a(p) > B \ \text{approve} & \text{if } a(p) > T \ \text{allow} & \text{otherwise} \end{cases} $$

Here $S_{\text{month}}$ is what has been spent this month, $B$ is the monthly budget and $T$ is the approval threshold. The AI can suggest a purchase, but only the rules can decide whether it gets paid.

Challenges we ran into

Paying without the buyer present. Getting a vaulted PayPal account to pay with no buyer at the keyboard took careful work with Vault v3 and Orders v2 in the sandbox.
Keeping AI out of the money path. It was tempting to let the LLM judge whether a purchase "fits the rules". We made the policy engine pure code instead, so its decisions are predictable and testable.
Ambiguous rules. "Ask me for anything expensive" has no number. The parser asks a follow-up question, and you confirm the policy before it takes effect.
Keeping the audit trail correct. Payment events and webhooks can arrive late or more than once, so every log entry needs to be written safely even when an event repeats.

What we learned

Trust in agentic commerce comes from limits the agent cannot get around, not from a smarter model.
PayPal's Vault and Orders APIs already have most of what agent payments need. The missing piece is a consumer-facing policy layer.
A good audit log is a product feature, not a debugging tool. Seeing why each payment was allowed is what makes people comfortable letting the agent pay.

What's next

Plug into PayPal's agentic commerce services so the agent can buy from real merchants.
Map policies to AP2 mandates.
Add shared family wallets with separate limits for each member.