Inspiration
AI agents are starting to pay real invoices. But an agent that can pay can also be tricked into paying: a fake invoice with changed bank details, a payment request hidden in text the agent reads, or a large transfer nobody approved. This is invoice fraud, now aimed at software that acts on its own.
[Add one verifiable statistic about invoice or business-email-compromise fraud, with its source. Check the number before using it.]
I work in OT/ICS security, where a command is never trusted just because it arrived on the right network. Safety systems check every command against rules the sender cannot change. Mandate applies that idea to AI agents that move money.
What it does
Mandate is a policy gateway that sits between an AI agent and PayPal. The agent never talks to PayPal directly. It asks Mandate to make a payment, and Mandate decides:
- Allow: the payment is within the rules and is sent to PayPal.
- Hold: a human must approve it first (a large payment, or a changed payee).
- Block: it breaks a rule (unknown payee, over budget, expired mandate, duplicate invoice).
The business defines a mandate: [budget, per-payment cap, approved suppliers, approval threshold, expiry]. Every request and decision, with the reason, is written to an audit log.
Demo scenario: an AI bookkeeper for a small business reads supplier invoices and pays them.
- A legitimate invoice is paid through the PayPal sandbox.
- A fake invoice arrives for a known supplier with changed payee details. The agent is convinced it is real. Mandate holds the payment, flags the payee change, and records it.
- A large legitimate payment goes to the approval screen, where a human approves it.
The rules are enforced in deterministic code, not by an AI model, so the agent cannot be talked out of them.
How I built it
- AI agent: runs on Nebius Token Factory using [exact model ID]. It reads supplier invoices, extracts the supplier, payee and amount, and calls Mandate's
request_paymenttool through tool calling. [If true: the same model writes the plain-language risk summary shown on the approval screen.] - Gateway: an MCP server over Streamable HTTP that exposes [list the real tools] to the agent.
- Policy engine: [language/framework]. Checks: expiry, amount and currency, supplier allow-list, payee change, duplicate invoice, per-payment cap, cumulative budget, approval threshold. If several checks fire, the strictest outcome wins.
- PayPal: [state exactly what you used: e.g. REST API with Payouts / Invoicing / Orders; PayPal MCP server or Agent Toolkit if used]. All payments run in the PayPal sandbox.
- UI: approval queue and audit log built with AG Grid. [Delete if not used.]
- Hosting: [Render / self-run only].
- Tests: an attack test script runs [N] cases and prints pass or fail. [Fill N with the real number.]
- Development: built with help from Claude Code.
Challenges
- [Real challenge 1, e.g. getting the right PayPal sandbox flow for paying an invoice]
- [Real challenge 2, e.g. getting the model to call the payment tool reliably]
- [Real challenge 3, e.g. detecting a payee change without blocking legitimate updates]
Accomplishments
- [Real accomplishment, e.g. the full attack scenario runs end to end against the PayPal sandbox]
- [Real accomplishment, e.g. every attack in the test script is blocked or held]
What I learned
- [Real lesson. Example of the kind of thing that fits: the agent's judgment and the system's rules should be separate, so the rules still hold when the agent is fooled.]
What's next
- Per-agent mandates for several agents in one business.
- Live-mode PayPal support after a proper security review.
- More checks: payee verification, velocity limits, exportable audit logs for accountants.
