Inspiration
What it does## Inspiration
Agents are getting wallets — Google's AP2 (PayPal is a launch partner), OpenAI/Stripe's ACP, card-network agent tokens. But a shopping agent that holds payment power and reads untrusted product pages has the full "lethal trifecta": one line of seller text can change the address, the quantity, or the store. Research like CaMeL, AgentDojo and Microsoft's Magentic Marketplace shows agents get hijacked and manipulated. Everyone is building the wallet; we built the seatbelt.
What it does
- Mandate Studio – type a wish ("one 16 kg kettlebell, max $80"). Gemini compiles it into a least-privilege policy (budget, per-item cap, quantity, stores, expiry, ask-me threshold), HMAC-signed like an AP2 mandate.
- PayPal-backed budget – signing creates a PayPal AUTHORIZE hold. The user approves once with their own PayPal account; agents can only capture what the gateway allows; revoking voids the hold and refunds captures.
- Mandate Gateway (MCP server) – the only money interface agents get. Every purchase passes: signature/expiry, budget & quantity (price from catalog ground truth, never the agent), merchant allow/deny, provenance (ship-to must come from the signed mandate – CaMeL-style taint), look-alike seller detection, listing-integrity red flags, Elastic threat memory, a second-provider LLM judge, and KERNEL verify-before-pay (a cloud browser opens the real retailer page). Result: ALLOW (PayPal capture), ESCALATE (human approves), or BLOCK.
- Quarantined extraction – the planner never sees raw listing text; a separate tool-less LLM turns listings into typed fields + red flags.
- Attack Lab – AgentDojo-style red-teaming: the same agent with and without the gateway. Attack success 25% → 0%, poisoned listings caught 75%.
- Control Tower – AG Grid audit log, AG Studio dashboards whose built-in agents build charts on request, and an Elastic Agent Builder auditor that answers questions with ES|QL.
- Any agent, via MCP – connect Mandate to your own Claude (custom connector, per-user token); the same mandate still decides what it may pay for.
- Sign in with PayPal – identity and payer are bound: a mandate's hold must be approved by the same PayPal account that owns it.
How we built it
FastAPI + FastMCP backend (the gateway is an MCP server; our own agent is an in-process MCP client), React + Tailwind frontend, SQLite store, Docker, deployed on Render.
- PayPal REST Orders v2 + Payments v2: AUTHORIZE orders, partial authorization capture with
final_capture, void, refund, payer-ID binding; order-approval sign-in. - Channel3 product search with mandate limits compiled into search filters.
- KERNEL cloud browsers (Playwright execute, live view, replays) for verify-before-pay.
- Elastic
semantic_textindex for the audit trail and threat memory; Agent Builder agent with ES|QL tools. - AG Grid 36 / AG Studio with custom widgets and a custom
AgLlmAdapterproxying Studio's agents through our backend. - Gemini (planner, compiler) + Groq (extractor, judge, re-ranker) via OpenAI-compatible APIs with per-model fallbacks and 429-aware cooldowns.
Challenges we ran into
Free-tier LLM quotas (we route each role to its own model bucket and fall back automatically), Gemini thought-signature requirements across model fallbacks, a 20k-char AG Studio tool schema that broke small models, an AG Grid version clash, sandbox currency/account setup, and making prompt-injection attacks realistic enough to measure honestly.
Accomplishments that we're proud of
A real end-to-end flow on PayPal sandbox – wish → signed mandate → PayPal hold → agent → KERNEL-verified page → capture → hold released – and a measured security result instead of a claim: the unprotected agent bought from a typosquatted "basspro-outlet.shop"; with Mandate it was blocked before PayPal was ever called.
What we learned
Modern models resist naive injections, but not reliably – safety has to live outside the model. Deterministic checks plus provenance beat "ask the LLM if it's safe".
What's next
AP2-format mandates, PayPal Vault for long-lived standing mandates, PayPal Multiparty to pay real merchants, per-agent keys with spending analytics, and a public benchmark of shopping-agent attacks.
