PayGuard is a zero-trust deterministic policy firewall and cryptographic human-in-the-loop (HITL) safety layer designed for the PayPal AI Hackathon to solve the massive trust deficit in agentic commerce. While consumers increasingly rely on AI assistants, over 70% of adults would permanently abandon AI shopping tools after a single unauthorized or hallucinated transaction, and large language models (LLMs) remain inherently vulnerable to prompt injection and price manipulation. PayGuard solves this by decoupling probabilistic AI reasoning from financial execution—restricting the LLM strictly to intent extraction (mapping natural language queries to catalog SKU IDs and quantities) while blocking it from handling prices or payment credentials. Every transaction must clear a server-side policy engine, an anti-prompt-injection firewall, and a cryptographic HMAC-SHA256 single-use 30-second nonce approval engine before executing real itemized transactions on the PayPal Sandbox Platform, with all decisions streamed live into an AG Grid security audit ledger.
- Inspiration & Problem:- Bridging the 55% consumer discomfort and 70% churn risk caused by unmitigated LLM probabilistic vulnerabilities and prompt injections in autonomous shopping.
- Core Solution:- Zero-trust deterministic policy firewall, cryptographic HMAC-SHA256 single-use 30-second nonces, and human-in-the-loop (HITL) verification sitting between AI agents and the PayPal Orders v2 API.
- Tech Stack:- Decoupled architecture built with a Python FastAPI backend (
security_engine.py,paypal_client.py,catalog.py) and a Next.js/Tailwind CSS frontend featuring AG Grid audit streams and step-up modal verification. - Key Challenges:- Maintaining strict isolation between probabilistic intent parsing and deterministic financial logic, and managing asynchronous single-use nonces with strict expiration windows.
- Accomplishments & Learnings:- Successfully proving that enterprise-grade security and AI convenience can coexist by treating LLM outputs as untrusted user inputs requiring server-side schema validation.
