MANDATE: Spending Guardrails for AI Agents

Settings page for workspace name, currency, timezone, and week start.
Red-Team Lab testing the agent against prompt injection and manipulation attacks.
Audit Log listing policy verdicts for each agent decision.
Analytics page with spend trend, approval rate, and category mix.
Transactions ledger showing settled and pending PayPal sandbox payments.
Approvals Center with pending high-value purchases awaiting quorum or escalation.
Mandate Builder, where plain-English spending rules become structured limits
Agent Chat with the procurement agent recommending keyboards with prices and merchants.
Spending command center dashboard showing budget burn-down and spend by category
MANDATE sign-in page with email and Google login options.
Let your agent spend. Never lose control.

Inspiration

AI agents are evolving beyond answering questions. They can search products, compare prices, recommend purchases, and interact with external services. But giving an autonomous AI agent access to a payment method introduces a serious security challenge.

AI models can hallucinate, misunderstand user intent, or be manipulated through prompt injection attacks hidden in product descriptions and reviews.

We asked a simple question: How can we allow AI agents to perform useful purchasing tasks without giving them unrestricted control over money?

Our answer was MANDATE: a financial authorization layer that separates AI decision-making from payment authority.

What it does

MANDATE is an AI-powered spending control and authorization platform that sits between autonomous AI agents and payment infrastructure.

It allows organizations to define financial boundaries while enabling AI agents to propose purchases within those boundaries.

Key capabilities include:

Spending Policies: Configure purchase limits, budgets, permitted categories, merchant restrictions, and authorization requirements.
AI Procurement Agent: Interact with an AI-powered procurement assistant to explore purchasing requests and generate proposals.
Deterministic Policy Engine: Evaluate purchase proposals against predefined financial rules and return APPROVE, ESCALATE, or BLOCK decisions.
Risk Detection: Use machine learning to identify unusual purchasing behavior and suspicious transaction patterns.
Prompt Injection Defense: Analyze potentially malicious instructions using a transformer-based security classifier.
Human Approval: Allow users to review and authorize transactions that require additional approval.
Transaction Monitoring: Track purchase activity, spending analytics, and authorization decisions.
Audit Trail: Maintain records of transaction decisions and relevant security events.
Red-Team Lab: Test the system against adversarial scenarios and inspect its security evaluation results.

The most important principle is that AI agents can propose purchases, but financial authorization is controlled by MANDATE's policy layer.

How we built it

We designed MANDATE as a modular full-stack application combining AI orchestration, machine learning, deterministic policy enforcement, and payment infrastructure.

Frontend:

React 19
TypeScript
Vite
Tailwind CSS
Recharts

The frontend provides the spending dashboard, procurement interface, policy configuration, approval center, analytics, and security monitoring views.

Backend:

Python
FastAPI
Pydantic
REST APIs
SQLite / PostgreSQL support, depending on the configured deployment

The backend manages purchase proposals, policy evaluation, transaction workflows, risk analysis, and audit events.

AI and Machine Learning:

Google Gemini / Anthropic Claude: AI services used for procurement reasoning and agent orchestration, where configured.
Hugging Face Transformers: Provides access to pretrained transformer models.
DeBERTa: Used for prompt-injection classification.
Isolation Forest: Used for anomaly detection in purchasing behavior.
TF-IDF: Supports lightweight text vectorization and information retrieval.

Policy and Authorization: The policy engine evaluates financial constraints independently of the AI model. It checks mandate status, spending limits, merchant restrictions, permitted categories, time restrictions, and approval requirements.

Payment Integration:

PayPal Developer Sandbox
PayPal Orders API v2
OAuth 2.0 authentication

The PayPal integration demonstrates the payment workflow in a sandbox environment without processing real financial transactions.

Infrastructure:

Vercel for frontend deployment.
Docker for containerized development and deployment.
FastAPI backend deployment.

Challenges we ran into

Separating AI from financial authority

One of our biggest challenges was ensuring that an AI model could not directly authorize payments. We designed the workflow around purchase proposals and independent policy evaluation rather than allowing the model to control payment execution.

Handling prompt injection

Product descriptions and external content can contain malicious instructions. We incorporated a prompt-injection classification layer to help identify potentially unsafe content.

Designing financial policies

Financial authorization involves multiple constraints, including transaction amounts, daily and monthly budgets, merchant restrictions, and approval thresholds. We implemented a rule-based evaluation engine to handle these checks systematically.

Making risk detection useful

Traditional transaction validation is not always enough to identify unusual behavior. We incorporated an Isolation Forest-based anomaly detection component to provide an additional risk signal.

Building an understandable interface

We wanted MANDATE to be more than a backend security concept. We developed dedicated interfaces for policy management, approvals, analytics, transactions, and audit monitoring to make financial authorization understandable and inspectable.

Accomplishments that we're proud of

Built a full-stack AI financial authorization platform.
Integrated the PayPal Developer Sandbox payment workflow.
Developed a deterministic policy engine for purchase authorization.
Integrated machine learning components for anomaly detection.
Added transformer-based prompt-injection classification.
Created a procurement agent interface and spending management dashboard.
Built dedicated approval, transaction monitoring, analytics, and audit interfaces.
Developed a Red-Team Lab for evaluating adversarial scenarios.

Our biggest accomplishment is demonstrating an architecture in which AI can assist with purchasing decisions without receiving unrestricted financial authority.

What we learned

Building trustworthy autonomous agents requires more than improving model accuracy or writing better prompts.

Security must be built into the system architecture.

We learned the importance of separating probabilistic AI reasoning from deterministic financial authorization, treating external content as untrusted input, validating every transaction, and maintaining an auditable record of system decisions.

AI should help users make decisions, but critical financial permissions should remain under explicit policy control.

What's next for MANDATE

We plan to evolve MANDATE into a reusable financial authorization infrastructure for autonomous AI agents.

Our roadmap includes:

Stronger multi-tenant financial policy management.
Production-grade transactional database storage and atomic spending reservations.
Expanded human approval workflows and multi-approver authorization.
More comprehensive adversarial security testing.
Improved anomaly detection and model evaluation.
Stronger audit integrity, verification, and monitoring.
Production payment integrations beyond the sandbox.
An SDK and API that allow external AI agents and agent frameworks to integrate with MANDATE.

Our long-term vision is to make secure financial authorization a standard layer for autonomous AI systems.

MANDATE — Autonomous AI. Deterministic Control. Secure Commerce.