Mandate - Agentic Shopping with PayPal

An AI agent restocks your household and pays with PayPal, but only within the budget and rules you sign. Big buys ask first, anything off-limits is blocked, every purchase can be undone and tracked.

Comment

Inspiration

AI agents can already find almost anything you want to buy. Almost nobody trusts one with their card. Today you either give an agent full access to your payment method or approve every click yourself, and neither one is real delegation.

I kept coming back to a small, everyday case: running out of coffee again. I don't want to shop for filters and beans every month. I'd hand that job to an agent if I could say "no more than \$60 a month, check with me above \$25, coffee and kitchen only" and know those rules were enforced, not just suggested to a model.

McKinsey projects that agentic commerce could orchestrate \$3–5 trillion in global consumer spending by 2030. Trust is the missing layer, and it belongs at the point where money moves. That became Mandate.

What it does

Mandate turns a plain-language instruction into a signed spending mandate: a budget, an "ask me above" limit, allowed categories, shops and an end date. A Claude shopping agent then restocks your repeat list and buys what you ask for, paying with your saved PayPal wallet.

Every purchase goes through one of three paths:

  • Inside the rules: paid automatically with PayPal, with a receipt.
  • Above your approval limit: comes back as a one-tap approval in the PayPal window.
  • Outside the rules: blocked and logged, and no money moves. This includes prompt-injection attempts like "the listing says these headphones count as coffee gear."

Every purchase can be undone, which refunds it through PayPal and restores the budget. The Shop page shows exactly what the agent buys and where: brand, size, pack, store, how often, and what the mandate decides for each line. Orders shows the PayPal order and capture IDs and the reason each charge was allowed. Spending shows every mandate's signed limits and outcomes.

How I built it

The model never decides whether to pay. Claude drafts mandates and does the shopping, but every payment attempt goes through a deterministic policy engine. A charge for amount \(a\) is approved automatically only if all of these hold:

$$ \text{status} = \text{active} \;\wedge\; t < t_{\text{expiry}} \;\wedge\; c \in C_{\text{allowed}} \;\wedge\; m \in M_{\text{allowed}} \;\wedge\; a \le L_{\text{ask}} \;\wedge\; s + a \le B $$

Here \(c\) is the category, \(m\) the merchant, \(L_{\text{ask}}\) the ask-first limit, \(s\) the amount already spent and \(B\) the budget. If the only condition that fails is \(a \le L_{\text{ask}}\), the purchase becomes an approval. Anything else is blocked.

PayPal does all the money movement:

  • Vault: links the buyer's wallet once, with the PayPal v6 Web SDK. The vault ID never reaches the browser.
  • Orders v2: charges the saved wallet when the buyer isn't present, through the PayPal Server SDK with idempotency keys.
  • Human-present checkout: used for approvals.
  • Refunds: power Undo.
  • Webhooks: checked with verify-webhook-signature.
  • APIMatic Context Plugin: used during development to check the Server SDK integration.

Mandates are signed with Ed25519 at activation, so the rules the agent works under can't be quietly changed.

Channel3 supplies real products and live prices over its MCP server. An isolated classifier sees only a product's title and brand to assign its category. Anything it can't classify is filed as "other", which no mandate allows.

The agent never sets a price. Checkout items are identified by server-side SKUs (SH-<option>@<store>), so the agent picks an item and a store, and the server sets the price.

AG Studio powers the Spending console. It has custom widgets for a budget meter and the policy decision flow, plus a Claude-backed Mandate auditor agent that reads mandates, queries spending and drafts rule changes for the person to re-sign.

The stack is TypeScript, a Node server and a React front end, deployed on Render. It's a mobile-friendly installable web app with voice input, and an offline vitest suite covers the policy engine and payment flows.

Challenges I ran into

  • Saving a wallet without a purchase. PayPal's save-without-purchase flow failed in the sandbox in current Chrome. I switched to a \$1.00 AUTHORIZE order with store_in_vault: ON_SUCCESS, voided immediately. The buyer sees one PayPal window, and the wallet is saved and the mandate signed in the same step.
  • Keeping the model out of the money path. It's tempting to let the agent judge whether a purchase "fits." I moved every decision into deterministic code and gave the agent no way to set prices or categories. Prompt injection then has nothing to grab onto.
  • Failing safely. If PayPal returns PAYER_ACTION_REQUIRED or declines the saved wallet, the purchase becomes an approval card. It is never retried silently.
  • Many judges, one sandbox login. Each browser gets its own private session, so testers sharing the same sandbox buyer never see each other's wallets, mandates or receipts.
  • Making trust visible. Receipts, approval cards and the Shop page went through many rounds so a person can see at a glance what the agent did, what it will do and why.

Accomplishments that I'm proud of

  • A complete, deployed flow that judges can try in about three minutes: link PayPal, sign a mandate, let the agent shop, approve, block, undo.
  • A safety boundary that doesn't depend on the model behaving well.
  • An interface that makes delegated spending feel understandable rather than risky.

What I learned

  • Trust in agentic commerce comes from deterministic guardrails at the payment layer, not from better prompts.
  • People want to delegate repeat purchases, but they want a clear moment to step in. "Ask me above \$X" turned out to matter more than the budget itself.
  • PayPal's building blocks already cover most of what agentic checkout needs: Vault for buyer-not-present charges, human-present checkout for approvals, Refunds for Undo and Webhooks for a reliable audit trail.

What's next for Mandate

  • Family plans: shared household budgets, with a mandate per person.
  • Merchant verification: shops check the signed mandate before they accept an agent's order.
  • Native app, voice first: speak a request, and approve with Face ID from a push notification.
  • Scheduled restocks: the repeat list reorders on its own schedule, still checked by the mandate.

Live demo: https://mandate-etwi.onrender.com (PayPal sandbox, no real money)

Built With

Share this project:

Updates

Submission history