Inspiration
AI agents are starting to move real money, but nothing checks WHO they are paying. A poisoned instruction, a lookalike payee, or a swapped identifier can drain an agent's budget in one call. PayGuard is that missing check for PayPal payments: a firewall between an agent's intent to pay and the payout itself.
What it does
PayGuard evaluates every proposed payment before execution and returns allow, warn, or block with human-readable reasons and a score. Signals include: a blocklist of known drainer addresses, identifier drift (a known payee whose email changed under the same Payer ID), lookalike-domain detection, invoice/order cross-checks, velocity, and amount anomalies. If the verdict is block, the payout function is never invoked — demonstrated, not just claimed. A prompt-injection attempt embedded in a payee note is treated as data, flagged, and refused before execution.
How we built it
Pure Python, standard library only — no dependencies to install. The decision engine (directory, signals, scoring) is separated from the executor; the demo runs against recorded fixtures modelled on PayPal's Orders v2 payee object and the Payouts API, including sandbox-style Payer IDs. PayPal exposes no arbitrary-payee trust lookup (userinfo is self-only), so PayGuard builds trust from the payer's own history: identifier binding, drift detection, and cross-checks. The full demo runs from a clean clone with one command.
Challenges we ran into
Designing honest signals without a payee-reputation API: several natural checks (account age, verification status of an arbitrary payee) do not exist on PayPal's public surface, so we replaced them with payer-side evidence instead of pretending. Keeping the executor unreachable on block required structuring the wrapper so a refused verdict cannot fall through to a payout call.
Accomplishments that we're proud of
Four scenarios reproduced identically from a clean copy: blocklist block (score 100), first-time payee warning (30), known-vendor allow (0), and a prompt-injection attempt refused with the executor invoked zero times.
What we learned
Agent payment safety is mostly an identity-binding problem: the dangerous change is rarely the amount, it is WHO is on the other end and whether that identity quietly changed.
What's next for PayGuard
A live PayPal sandbox executor behind the same wrapper, a persistent payee-directory store, and webhook-driven drift alerts when a known payee's identifiers change.
Log in or sign up for Devpost to join the conversation.