Mandate

Your AI can shop. It can't cross the line. Mandate puts signed, plain-English spending rules between AI agents and PayPal, and proves every payment it makes.

Comment

Inspiration

McKinsey expects AI agents to orchestrate up to $1 trillion of US retail by 2030. Yet in benchmarks, hidden instructions on web pages hijack browsing agents 42–68% of the time, chargebacks already cost merchants $36.9B a year, and no one has settled who pays when an agent buys the wrong thing. Mandate makes every agent payment provably authorised before money moves.

Behind those numbers is a simple problem. A model can misread what you meant, a web page can steer it, and once money moves it's hard to take back. Prompt injection isn't something you can fully train away. So I stopped trying to make the agent trustworthy and asked a different question: what if the agent never had to be trusted at all? Let it be as clever as it likes, but put your rules, written by you, signed by you and enforced by plain code, between the agent and your money, and give every merchant proof that you said yes.

What it does

  • Write your rules once, in plain English. "Household and kitchen basics, up to $80 a month, nothing over $25." Meta's Muse Spark turns that into structured limits you can check and adjust (categories, per-item cap, budget, a fair-price limit, trusted sellers, an end date) before you sign them as an AP2 v0.2 Intent Mandate.
  • Connect PayPal once. PayPal Vault saves your wallet through PayPal's own login. Mandate never sees a password or card.
  • Every purchase goes through the gate. Seven rules, in order: mandate active, where the request came from, category, seller, item limit, market price, budget. Inside the rules it's paid at once from the saved wallet. Over a limit, it asks you. Anything else is blocked, and nothing is paid.
  • Hijack-proof by design. If a product page or website tells the agent to buy something, the gate sees the request didn't come from your task and refuses, however convinced the agent is. Try the "Compromised-agent drill" on the live site.
  • Approve from anywhere. In-app pop-ups and a Notifications page, plus Telegram (approve or decline with one tap), Slack, Discord, and email or 7,000+ apps through Zapier.
  • Scheduled buys. Weekly basics run on their own from a Bryntum calendar, still through the gate.
  • Real products, fair prices. The agent shops real stores through Channel3, and every price is compared with the median across ten other shops.
  • See and prove everything. Each decision becomes a signed, hash-chained receipt. Insights (AG Studio) shows where the money went; an AG Grid decision explorer shows how each of the seven rules came out for every purchase. Edit one record and the chain names exactly which receipt was altered.
  • Sellers can verify before they ship. Public, key-only verification: one call returns Mandate's checks, PayPal's own order record and the AP2 verdict. There's a readable seller page, a PDF receipt, and an evidence pack for disputes.
  • Built for developers and other agents. A public API with an APIMatic portal, SDKs in TypeScript, Python and C#, a context plugin for AI coding assistants, a Postman collection, and an MCP server so Claude, ChatGPT or any agent can shop inside the same rules.

How we built it

  • Next.js 15 + React 19 + TypeScript, hosted on Render with Postgres.
  • The split that makes it safe: the agent can only propose. A pure, deterministic gate decides. Only the executor, holding a single-use permit for that exact amount, can touch PayPal. The model never has payment credentials.
  • PayPal: the Agent Toolkit for orders, Vault (setup tokens → payment tokens) for the saved wallet, Orders v2 with vault_id for one-step payment, webhooks (CHECKOUT.ORDER.APPROVED captures even if the buyer closes the tab), and the PayPal Server SDK to read PayPal's own order record during verification. Shipment tracking is added to PayPal orders.
  • Trust layer: AP2 v0.2 SD-JWT mandates (intent, cart, payment), Ed25519-signed receipts in a hash chain, and passkey approvals. Interoperability is tested against Google's AP2 reference SDK.
  • AI: Meta Muse Spark through the Meta Model API, both as the shopping agent and as the rules reader. KERNEL's cloud browser reads web pages, and everything it returns is treated as untrusted.
  • Sponsor tools: Channel3 (products and market prices), AG Grid and AG Studio (decision explorer, Insights), Bryntum Calendar (scheduling), APIMatic (portal, SDKs, context plugin), Zapier (alerts and kill switch), Postman (42-assertion collection), Astropods (an external shopper agent).
  • Quality: 525 unit tests and 24 Playwright end-to-end tests, including axe accessibility scans in light and dark mode.

Challenges we ran into

  • Prompt injection can't be fixed inside the model. The breakthrough was moving the decision out of the model entirely and tracking where each request came from, so text on a web page can never authorise a purchase.
  • Payments without a redirect every time. Getting Vault, saved payment tokens and webhooks to work together, so an in-rules purchase pays instantly and an approved one completes even if the buyer has left the page, took several iterations in the sandbox.
  • A reasoning model as a parser. Muse Spark thinks before it answers; early on the rules reader returned nothing until I gave it room to think and added retries.
  • Two grid libraries on one page. AG Studio's styles quietly overrode AG Grid's header layout and hid rows in the decision explorer. It was found while recording the demo and fixed with a one-line scoped rule.
  • Proving it, not just claiming it. Designing receipts that a seller can verify with public keys alone, and that show which record was tampered with, meant careful work on signing and hash-chaining.

Accomplishments that we're proud of

  • A hijacked agent tries to buy a $50 gift card, and not one cent moves, live, on a real PayPal sandbox.
  • Rules a non-technical person can write in one sentence, yet enforced by deterministic code and signed as an open standard (AP2).
  • Every payment is independently verifiable by the seller, down to PayPal's own record of the capture.
  • One gate for every agent: Mandate's own, Claude, ChatGPT or any MCP client.

What we learned

  • Safety for AI payments is an architecture problem, not a prompt problem: keep the model away from the money and make the rules the only path.
  • Provenance (who asked for this?) is the most important question an agent payment system can answer.
  • People trust what they can see. The "How it decided" view and the decision explorer made the system feel safe in a way the code alone didn't.

What's next for Mandate

  • Passkey signing on the user's own device by default, instead of the sandbox demo key.
  • Moving from the PayPal sandbox to live payments with a pilot group.
  • Household and team mandates: shared budgets with per-person limits and approvers.
  • A merchant plugin so shops verify the mandate automatically at checkout.
  • Richer rules, such as per-category budgets, delivery windows and preferred sellers.

Built With

Share this project:

Updates

Submission history