What is TRACE?
AI purchasing agents can make decisions and add items that exceed the instructions a person gave them. Existing payment records may show what was ordered, but they do not necessarily explain which agent action violated the user's original intent.
TRACE is an AI-commerce incident response prototype that connects a human-authorised purchase mission, an AI agent's recorded actions, and PayPal Sandbox order evidence.
How it works
- Authorise: A user creates a mission with a purchase objective, spending limit, and prohibited add-ons.
- Record: TRACE stores the agent's product selections and add-on actions as timestamped events.
- Detect: A deterministic policy engine checks those events against the mission rules and flags violations such as prohibited add-ons or budget overruns.
- Explain: Google Gemini generates a readable incident explanation from the mission, event evidence, and deterministic analysis. Gemini does not make payment decisions or override policy.
- Prove: TRACE creates and retrieves a PayPal Sandbox order so the order contents can be compared with the authorised mission and the agent event history.
Demonstrated result
In a test mission with a $300 budget, the agent selected a $249 coding monitor and added a prohibited $29 extended warranty. TRACE detected the prohibited add-on. When creating the PayPal Sandbox order, TRACE excluded the warranty; PayPal's retrieved order showed a $249 total and the coding monitor as the only line item. The order remained in CREATED status and was not captured.
Technology
- PayPal Checkout Orders REST API in Sandbox for order creation and retrieval.
- Google Gemini (gemini-3.6-flash) for evidence-grounded incident explanations.
- Python and FastAPI for the API and workflow.
- SQLite for mission and agent-event persistence.
Safety boundary
The deterministic policy engine is authoritative. Gemini only explains the recorded evidence and recommends next steps. It cannot authorise purchases, capture orders, issue refunds, or override mission rules. PayPal Sandbox orders are not live customer payments.
Running the prototype
The current prototype runs locally. Start the FastAPI application, then open the interactive API documentation at /docs to create a mission, record agent events, analyse the mission, create a Sandbox order, and retrieve the PayPal order details. Full dependency installation and environment-variable setup instructions must be provided in the public repository.
Current limitations
TRACE currently depends on agent events being sent to its API; it does not independently observe arbitrary third-party agents or shopping carts. PayPal integration is demonstrated in Sandbox, not live commerce. Snapshot persistence is not yet verified and is not claimed as a working feature.
