Inspiration
AI agents are becoming capable of searching, comparing, and recommending products, but allowing an AI model to directly execute payments introduces serious risks.
A shopping agent might select a suspicious merchant, send money to a lookalike website, exceed the customer’s budget, or act without clear human approval. This inspired me to build PayPal Guardian, an independent security and payment-control layer for AI-assisted commerce.
The guiding principle behind the project is:
AI recommends. The Agent signs. Guardian verifies. The customer remains in control.
What it does
PayPal Guardian allows a customer to visit a shopping website and use a browser extension to automatically detect the product being viewed.
The extension extracts information such as:
- Product name
- Price and currency
- Seller information
- Product URL
- Website hostname
- Product rating and availability, when present
- Extraction source and confidence level
The extracted product evidence is sent to a self-hosted AI shopping agent. The AI can analyze and recommend the product, but it cannot independently authorize or execute a payment.
When the customer wants to continue, the Agent creates a payment intent containing the product, merchant, seller, amount, currency, timestamp, expiry, and a unique nonce. The intent is cryptographically signed using an Ed25519 private key.
The signed intent is then sent to Guardian, which independently verifies:
- Whether the Agent is registered and active
- Whether the Agent is authorized for the requested purpose
- Whether the digital signature is valid
- Whether the intent has expired
- Whether the intent ID or nonce has already been used
- Whether the website uses HTTPS
- Whether the TLS certificate and hostname are valid
- Whether the domain resembles a trusted brand or appears on a blocklist
- Whether the merchant or seller is new, known, or suspicious
- Whether the purchase complies with the customer’s spending policy
Guardian produces one of three decisions:
- ALLOW for verified merchants and policy-compliant purchases
- REVIEW for new merchants, new sellers, or transactions requiring customer approval
- BLOCK for suspicious domains, invalid signatures, replayed requests, prohibited categories, or policy violations
Only an allowed or explicitly approved transaction can continue to the PayPal Sandbox payment flow.
How I built it
The project uses the following components:
- Browser Extension using Manifest V3 to inspect the active product page
- Next.js and TypeScript for the Guardian dashboard
- Python and FastAPI for the AI Agent and Guardian APIs
- Ollama with Qwen3 for self-hosted AI inference
- Ed25519 digital signatures for Agent identity and transaction integrity
- PostgreSQL and SQLAlchemy for policies, payment intents, merchant evidence, approvals, PayPal orders, and audit events
- Docker Compose to run the complete local environment
- PayPal Sandbox Orders API for order creation and capture testing
The complete local environment consists of the frontend, Demo Agent, Guardian API, Ollama, and PostgreSQL services.
Key security decisions
The AI model never receives the Agent’s private key or PayPal credentials.
The Agent owns its private key, while Guardian stores only the corresponding public key. A newly registered Agent starts in a PENDING state and must be explicitly approved before receiving purchase authority.
Merchant trust is also evaluated independently by Guardian. The AI cannot simply declare that a website is safe. Guardian checks the actual URL, hostname, live TLS certificate, domain relationship, seller status, and risk signals before making a decision.
Newly discovered merchants are recorded as PENDING_VERIFICATION rather than being automatically trusted.
Challenges I faced
One of the biggest challenges was making the Agent and Guardian generate exactly the same canonical JSON representation for digital-signature verification. Even equivalent timestamps such as +00:00 and Z produce different bytes, which initially caused signature failures.
I also had to handle local model performance. Larger Qwen models were slow to load on CPU, so I used a smaller qwen3:0.6b model, reduced the context size, disabled unnecessary thinking output, and kept the model loaded between requests.
Another challenge was extracting product information from different websites. Some provide structured JSON-LD, while others require Open Graph, microdata, or safe DOM fallbacks. The browser extension therefore uses a layered extraction strategy and reports the source and confidence of the extracted evidence.
Separating merchant review from payment review was also important. A technically valid but previously unknown website should not be treated as automatically trusted. Guardian therefore records the merchant, evaluates its security signals, and requires review when confidence is insufficient.
What I learned
This project helped me understand that secure agentic commerce requires much more than connecting an AI model to a payment API.
I learned how to design clear trust boundaries between:
- AI reasoning
- Agent identity
- Merchant verification
- Spending policies
- Human approval
- Payment execution
- Audit and accountability
I also gained practical experience with browser extensions, asynchronous FastAPI services, cryptographic signing, TLS validation, Docker networking, self-hosted language models, structured AI output, PostgreSQL persistence, and PayPal Sandbox integration.
What is next
The current solution is a hackathon prototype. Future improvements could include:
- CA-issued Agent certificates or workload identity
- Hardware-backed private-key storage
- PayPal webhook verification
- Automatic capture after the Sandbox return flow
- Stronger merchant-reputation providers
- Production authentication and role-based access control
- Database migrations using Alembic
- Broader product-page extraction support
- Cloud deployment, monitoring, and compliance controls
PayPal Guardian demonstrates that AI-assisted shopping can be automated without removing security, transparency, accountability, or customer control.
Built With
- agentic
- ai
- api
- browser
- docker
- ed25519
- extension
- fastapi
- manifest
- next.js
- ollama
- orders
- paypal
- postgresql
- python
- qwen3
- sandbox
- typescript
- v3
