PALS: PayPal Autonomous Life Shopping

Inspiration

AI agents are becoming more capable every day. They can research, compare products, make decisions, and even perform actions on our behalf. But when it comes to online shopping, the experience is still far from seamless.

Finding the best deal often means jumping between multiple websites, comparing prices, checking shipping costs, searching for coupons, and making sure the seller is trustworthy. It can quickly become a time-consuming process.

We wanted to make this experience simpler with PALS (PayPal Autonomous Life Shopping).

But there was a bigger challenge. How do you give an AI agent the ability to shop on your behalf without giving it unrestricted access to your money?

We wanted to build something that could work autonomously while keeping the user in control of every important financial decision. That became the foundation of PALS.

What it does

PALS is an autonomous shopping and payment platform where four specialized AI agents, which we call PALs, work together to make online shopping easier and safer.

GLY (Conversational Intent & Router): Acts as the primary interface between the user and the system. It understands shopping requests, identifies user intent, provides live updates, and answers policy-related questions using Retrieval-Augmented Generation (RAG).
ARB (Arbitrage & Live Discovery): Searches across domestic and international marketplaces such as Amazon, Best Buy, Walmart, Flipkart, and Croma. It compares available products, checks prices, and calculates the actual cost, including shipping, taxes, and applicable discounts.
DEFENDER (Security & Risk Guardian): Acts as the security layer of the system. It checks merchant reliability, monitors suspicious price changes, and generates cryptographically signed approval tokens that lock the authorized transaction amount.
PULSE (Payment Execution & Ledger): Handles PayPal payment operations through the Orders v2 and Capture APIs. It ensures transactions go through the required authorization checks and maintains an audit trail of payment activities.

Together, these agents handle everything from understanding what a user wants to finding the right product, securing the transaction, and completing the payment.

How we built it

We built PALS as a TypeScript monorepo with a modular, event-driven architecture. Each agent has a specific responsibility, allowing us to develop, test, and manage them independently.

Some of the key technologies and implementation details include:

Central Communication Bus (calls/): Instead of allowing agents to communicate directly with each other, we created a centralized communication layer. All agent-to-agent requests pass through this system, making communication easier to manage and reducing unnecessary dependencies.
LLM Intent Engine and RAG (GLY): We integrated Google's Gemini 3.5 Flash using @google/genai for intent classification, structured responses, and conversational interactions. We also implemented RAG over official PayPal customer policy documentation to provide more grounded answers.
Product Discovery and Scraping (ARB): We developed a multi-layer discovery pipeline using Serper API, Bright Data Web Unlocker, and fallback product catalogs. We also introduced request limits and caching to keep API usage under control.
Security Layer (DEFENDER): We implemented deterministic transaction rules and HMAC-SHA256 signature verification. This ensures that important transaction details, such as price, merchant identity, and currency, cannot be silently changed between approval and payment.
PayPal Integration (PULSE): We integrated PayPal's Orders and Capture APIs, along with sandbox testing, webhook handling, and refund reconciliation.
Frontend: The dashboard was built using React 18, Vite, and Tailwind CSS. It communicates with the backend through WebSockets and REST APIs, with a simulator available as a fallback.

Challenges we ran into

Building PALS involved several challenges, especially because we wanted the system to work reliably rather than simply demonstrate a basic AI shopping experience.

Dealing with Anti-Bot Protection: Accessing real-time product information from e-commerce websites wasn't straightforward. Many platforms use Cloudflare Turnstile and other anti-bot mechanisms. We addressed this by building a discovery pipeline that uses Serper API for search queries and Bright Data's Web Unlocker for product-page access.
Handling LLM Delays and Failures: During development, we encountered situations where temporary API errors caused the conversational agent to become unresponsive. To improve the experience, we introduced strict timeouts, retry mechanisms, exponential backoff, and real-time WebSocket updates so users aren't left wondering whether the system is still working.
Making Autonomous Payments Safe: This was probably one of the most important parts of the project. We didn't want an AI agent to have unrestricted access to payment operations. We separated the responsibilities of all four agents. GLY handles conversations, ARB handles discovery, DEFENDER handles security approvals, and PULSE handles payments. This separation ensures that a transaction cannot proceed without the required security validation and explicit user authorization.

Accomplishments that we're proud of

There are several parts of PALS that we're particularly happy with:

350+ Passing Tests: We built an extensive test suite covering individual components, agent communication, security checks, scraping limits, and end-to-end workflows.
Accurate Landed Cost Calculation: Rather than comparing products using only their listed prices, we calculate the estimated final cost by considering shipping, taxes, currency conversion, and available coupons.
PayPal Checkout Integration: We connected the shopping experience directly to PayPal, allowing users to move from a natural-language request to product selection, transaction approval, and payment confirmation.
Security-First Architecture: We implemented transaction limits, cryptographic approval tokens, and strict separation between agents to prevent unauthorized purchases.
Controlled API Usage: We introduced request counters, caching, and configurable API budgets to reduce unnecessary external API calls and avoid unexpected usage costs.

What we learned

One of our biggest takeaways was that building an autonomous AI system is about much more than making an LLM call tools.

An agent that can make decisions also needs boundaries. Especially when money is involved, relying entirely on AI-generated decisions isn't enough. We learned how important it is to combine AI-driven intelligence with deterministic validation, cryptographic security, and explicit user consent.

We also learned a lot about multi-agent architecture. Dividing the system into specialized agents made it easier to isolate responsibilities, test individual components, and manage communication without creating a tightly coupled system.

Most importantly, we realized that autonomy and user control don't have to compete with each other. A system can be highly autonomous while still keeping the user in control of every important decision.

What's next for PALS

We see PALS as something that could grow beyond a regular shopping assistant. There are several features we'd like to explore next:

Automated Price Drop Monitoring: Allow users to save products and target prices. Background workers could monitor prices and notify users as soon as a product reaches their desired price.
Multi-Item Cart Bundling: Extend ARB to compare products across multiple merchants and find combinations that minimize the overall cost, including shipping and available discounts.
Mobile Wallet and Passkey Support: Explore WebAuthn and passkey integration to make transaction approval faster and more convenient through biometric authentication on mobile devices.

Our long-term goal is simple: make online shopping feel less like a repetitive task and more like having a reliable personal assistant who does the research, finds the right deal, and always respects your decisions.