Pact — Payment Recovery for AI Agents on PayPal

When an AI agent's payment fails, nobody's watching. Pact recovers it on PayPal: the merchant sends a signed offer, the agent checks it against its owner's spending limits, then pays.

Comment

Inspiration

AI agents are starting to buy goods, book travel, and settle invoices on our behalf. When a human's card declines, they see the error, pick a different card, or top up their balance. When an AI agent's payment declines, nobody is sitting at the checkout screen.

Every existing recovery tool (dunning emails, SMS, push notifications, "update your billing info" banners) assumes a human is reading the message. Agents either retry blindly into the processor—burning fees and triggering risk blocks—or fail silently, abandoning the order.

We built Pact to fix this. Pact is payment recovery infrastructure for agentic commerce on PayPal: a merchant-side decision engine that scores recovery options by expected net value, and a buyer-side guard that cryptographically verifies recovery offers against human spending mandates before moving a single cent.

What it does

Pact introduces an open, two-sided protocol—the Pact Recovery Protocol (PRP v0.1)—with two independent, non-custodial guardrails:

1. Merchant Recovery Engine (pact-merchant)

  • Diagnoses decline signals: Interprets 34 PayPal processor codes (00N7, 5100–5210, 9500 Suspected Fraud) and 20 Orders v2 API issues (INSTRUMENT_DECLINED, PAYER_ACTION_REQUIRED).
  • Computes Net Expected Value (NEV): Evaluates every recovery action \( a \) against doing nothing (baseline \( a_0 \)):

$$\text{NEV}(a) = (\hat{P}(a) - \hat{P}(a_0)) \times (\text{Amount} \times \text{Margin}) - \text{Fee}(a) - \text{Cost}(a)$$

If no action clears the merchant's profit floor (e.g., chasing a 4-dollar add-on), Pact drops the recovery rather than wasting processor fees.

  • Issues signed PRP offers: Returns an HTTP 402 Payment Required response containing machine-readable options signed with the merchant's Ed25519 key.
  • 10% live causal holdout: A deterministic 10% holdout group (salted SHA-256 hash) measures true causal recovery lift against organic retries.

2. Buyer Agent Guard (pact-buyer)

  • 12 hard invariants (G1–G12): Evaluates recovery offers against Maya's pre-approved mandate (weekly ceiling, per-order cap, authorized funding priority, category whitelist, merchant domain).
  • Autonomous alternate funding: If Maya's primary card fails for insufficient funds (5120), her agent switches to her pre-vaulted PayPal wallet without human intervention.
  • Zero autonomy on risk: On suspected fraud (9500) or exceeded retry limits, autonomous actions are barred and Maya gets a one-tap approval link.
  • Adversarial prompt shield: Recovery offers are parsed strictly as data schemas; prompt injections embedded in checkout text are quarantined and dropped.

How we built it

  • PayPal Orders v2 & Vault v3: Real-time capture (POST /v2/checkout/orders/{id}/capture) with PayPal-Request-Id idempotency; Vault v3 setup tokens exchanged for permanent vault_ids; stored-credential indicators (payment_initiator: CUSTOMER, payment_type: ONE_TIME, usage: SUBSEQUENT) reflecting the agent acting as the customer's authorized delegate.
  • PayPal Webhooks with signature verification: 7 events (PAYMENT.CAPTURE.COMPLETED, PAYMENT.CAPTURE.DECLINED, VAULT.PAYMENT-TOKEN.CREATED, …) verified via POST /v1/notifications/verify-webhook-signature.
  • Cryptographic protocol (PRP v0.1): Ed25519 signatures over canonical JSON binding HTTP method, path, timestamp (±300s skew) and anti-replay nonces.
  • ML & decision economics: Calibrated scikit-learn propensity model on decline features; Bayesian multi-armed bandit (Beta-Bernoulli, Thompson Sampling) learning recovery efficacy per failure class with bounded exploration.
  • Frontend: Next.js 14, React, TypeScript, Tailwind CSS; AG Grid decision ledger with pinned NEV columns and master-detail drawer; linked two-pane view of merchant diagnosis and buyer guard on one chronological timeline.

AI tools used and how

In Pact, models advise; deterministic policies and human mandates decide.

  • Calibrated propensity model: Predicts \( \hat{P}(a) \) and \( \hat{P}(a_0) \) to compute expected revenue lift, shown transparently in the per-option inspector.
  • Bayesian bandit: Adjusts action priors with Thompson Sampling without risking capital beyond the configured floor.
  • LLM: Parses natural-language shopper requests into structured JSON mandates and drafts dark-pattern-free customer recovery emails.
  • PayPal Agent Toolkit: Read-only integration powering Ask Pact, letting merchants audit declines, explain decisions, and query order states without moving money.
  • Strict boundary: No LLM has access to tools that capture funds, modify amounts, or alter authorizations.

Challenges we ran into

  1. Agent autonomy vs. payment consent: An agent's mandate is not legal authorization to charge a payment method. We enforce two-tier consent: Vault authorization is granted by the human at onboarding; the mandate only controls when the agent may use it.
  2. Measuring true causal lift: Blind retries often recover organically, so recovery tools claim false credit. A 10% live holdout with Wilson 95% confidence intervals measures real incremental revenue.
  3. Prompt injection in payment metadata: Memo fields and error payloads can carry injections. All offer fields are untrusted data, routed through strict Pydantic schemas and scanners.

Accomplishments that we're proud of

  • 220 automated tests — unit, integration, invariant and property-based — running in CI on Python 3.12 and Node 20.
  • Zero-credential offline reliability: Merchant decisions, buyer guardrails and simulated PayPal declines all run offline without sandbox credentials.
  • Real two-sided cryptographic independence: The merchant cannot forge an "agent accepted" response without the buyer's private key, and vice versa.
  • End-to-end sandbox verification with PayPal test cards and processor codes 5110, 5120, 9500.

Built during the hackathon & pre-existing work

  • Pact builds on ideas from the author's earlier project, salvage-razorpay.
  • Built during the hackathon: the full PayPal integration (Orders v2, Vault v3, stored credentials, webhook verification, Agent Toolkit); PRP v0.1 with Ed25519 signing; the buyer agent service, mandate store and 12-invariant guard; the Bayesian bandit loop; the Ask Pact assistant; and the Next.js app, linked visualizer and AG Grid console.

AG Grid

The Merchant Console (/merchant) uses AG Grid for the decision ledger: sortable, filterable by failure class and provenance (sandbox, fixture, simulated), with pinned NEV columns. Master-detail row selection opens the inspector with the full arithmetic, rule trace and signed Ed25519 payload.

What's next for Pact

  • Publishing PRP as an open RFC for agent-to-merchant payment negotiation.
  • Recovery for recurring billing failures (BILLING.SUBSCRIPTION.PAYMENT.FAILED).
  • Hardware-enclave key storage (AWS Nitro / Secure Enclave) for institutional deployments.

Built With

Share this project:

Updates