Pocket Change

Inspiration

AI agents are becoming capable of researching, planning, and making decisions independently, but giving them access to money introduces a critical problem: how do we let them spend autonomously without giving them unlimited financial authority? Approving every transaction manually defeats the purpose of autonomous agents, while unrestricted access creates serious security risks.

Pocket Change was built to bridge this gap by making autonomous payments safer through cryptographic permissions, strict spending limits, and verifiable enforcement.

What it does

Pocket Change is a secure payment authorization layer that allows AI agents to make purchases within boundaries defined by the user.

Bounded delegation: Agents receive cryptographically signed capability tokens that can only narrow their parent's permissions, budget, tools, and expiry.
Deterministic enforcement: Nine security checks validate signatures, scope, budgets, delegation depth, expiry, cumulative spending, idempotency, registries, and spending limits.
AI-powered judgment: Gemini evaluates whether a payment aligns with the user's original authorization, returning allow, defer, or escalate.
Independent plan critique: A separate critic evaluates the proposed plan before payment authority is issued, catching purpose drift even when the arithmetic is correct.
Secure spending: Payments integrate with Razorpay Orders API in test mode.
Verifiable audit trail: Hash-linked records provide an auditable history, while idempotency prevents duplicate charges during payment replay.

The goal is simple: let AI agents act independently without letting their authority grow beyond what the user approved.

How we built it

We built Pocket Change using Python 3.12 and FastAPI for the payment gateway, Biscuit tokens and Ed25519 signatures for cryptographically secure delegation, and Google's Agent Development Kit for agent orchestration.

Gemini 3.5 Flash, served through Vertex AI, handles task decomposition, payment judgment, and independent plan critique. Firestore stores the cumulative-spend ledger and transaction records, while Google Cloud Run hosts the gateway and web console. Google Secret Manager protects credentials, and Cloud Build with Artifact Registry handles deployment.

The frontend uses vanilla JavaScript and Vite, with Server-Sent Events streaming live execution updates. Payments use Razorpay in test mode, and the system explicitly rejects live API keys.

We designed the architecture around three principles: deterministic security enforcement, contextual AI judgment, and independent auditing. This separation ensures that a model outage cannot disable core payment controls.

Challenges we ran into

1. Designing secure delegation

The hardest challenge was ensuring that child agents could never gain more authority than their parents. We implemented monotonic attenuation: permissions, budgets, and expiry can only become more restrictive. Delegation depth is derived from the signed token structure rather than trusted from user input.

2. Separating searching from spending

An agent that searches the web encounters untrusted, seller-controlled content. Giving that same agent payment authority creates unnecessary risk. We separated the search and payment agents at the same delegation depth, ensuring that the agent reading hostile text cannot also spend money.

3. Working within model limits

Free-tier model quotas forced us to rethink task decomposition. We built a deterministic decomposer so that only branching decisions require model calls, reducing unnecessary API usage while preserving agent flexibility.

4. Discovering failures through live testing

Our live run exposed two subtle bugs. Sourcing instructions were not consistently inherited by subtasks, and an unconfigured safety monitor was incorrectly reported as active. We fixed sourcing propagation and made the system explicitly distinguish between configured, active, and unjudged safety checks.

5. Preventing purpose drift

A plan can satisfy every numerical constraint and still violate the user's intent. An independent critic caught a plan to purchase ergonomic chairs when the authorized task was to furnish an engineering office with a different intended scope. This reinforced the need to validate purpose, not just price.

Accomplishments that we're proud of

Built a working, deployed payment authorization system for autonomous AI agents.
Implemented nine deterministic security checks that run in approximately 2.4 ms without a model call.
Achieved 399 offline tests, covering payment controls, delegation, and attack scenarios.
Defended against 10 of 12 evaluated attack vectors, documenting why the remaining two were not applicable.
Created a hash-linked audit trail that can be verified in the browser.
Implemented idempotent payment handling to prevent duplicate charges during replay.
Built an independent AI critic capable of identifying violations of user intent that ordinary budget checks miss.
Made safety-monitor status transparent, ensuring the system reports when a control has not actually run.

Most importantly, we built a system that treats security as an enforceable property rather than a promise made by an AI model.

What we learned

We learned that prompt engineering alone is insufficient for financial security. Critical controls must be deterministic, independently verifiable, and enforced before a payment can proceed.

We also learned that delegation is fundamentally a problem of authority management. Cryptographic tokens, derived depth, decreasing budgets, and restricted capabilities help ensure that agents cannot escalate their privileges.

Another important lesson was that observability must be honest. A system should distinguish between a check that passed, one that failed, and one that never ran.

Finally, live testing revealed failures that offline reasoning had missed. Building trustworthy agents requires adversarial tests, real execution traces, replay protection, and continuous verification of both technical constraints and user intent.

What's next for Pocket Change

Our next goal is to evolve Pocket Change into a production-ready financial safety layer for autonomous agents.

Broader payment integrations: Expand beyond Razorpay test mode to additional payment providers and carefully controlled live-payment workflows.
User-friendly controls: Build dashboards where users can configure spending limits, approve sensitive purchases, revoke permissions, and monitor transactions in real time.
Stronger adversarial testing: Expand attack coverage, improve security benchmarks, and evaluate false-positive and false-negative rates across different agent tasks.
Improved policy enforcement: Develop richer policies for merchants, categories, recurring purchases, refunds, and transaction thresholds.
Better interoperability: Integrate with more agent frameworks and standardized identity and delegation protocols.
Production-grade reliability: Strengthen monitoring, recovery, key rotation, audit verification, and safeguards for partial failures.

Our long-term vision is to make Pocket Change a trusted financial control layer for the agentic economy, allowing AI agents to transact autonomously while keeping users firmly in control of their money.