PromptGuard

• 

  PromptGuard Cover

• 

  Prompt-Only Boundary Failure

• 

  PromptGuard Closing Statement

• 

  Deterministic Policy Gate

• 

  Complete PromptGuard Workflow Diagram

• 

  Structured Prompt Workflow

Inspiration

AI agents are becoming capable of planning actions across tools, APIs, and financial systems. But payment decisions are different from ordinary chatbot responses: a misunderstood amount, a skipped compliance check, or a stale confirmation can create an irreversible outcome.

We wanted to explore a practical question: can prompt engineering make an AI payment agent more reliable without pretending that a prompt alone is a sufficient safety boundary?

What it does

PromptGuard is a structured workflow for safer AI payment-agent behavior.

It converts an unstructured payment request into:

1. Typed intent extraction that explicitly identifies missing information.
2. Tool-backed route and FX analysis.
3. A canonical human confirmation containing the exact amount and recipient.
4. Current-turn recipient screening.
5. A deterministic policy gate that validates the final attempted transfer before execution.

The workflow is evaluated on eight adversarial cases, including missing confirmation, amount drift, recipient swapping, stale screening, prompt injection, over-limit execution, and quoted confirmation text.

How we built it

We designed PromptGuard as a sequence of narrow prompts and deterministic checks rather than one broad instruction.

The workflow uses structured JSON outputs for intent extraction, focused tool-use prompts for analysis, and a human-in-the-loop confirmation step. The final transferPolicy gate is a pure code function: it checks the exact amount, exact recipient, current-turn screening status, address format, and a 100 USDC testnet limit without relying on a model decision.

We also built a reproducible evaluation harness, an interactive public Evaluation Lab, a workflow diagram, and a same-case comparison between a prompt-only boundary and PromptGuard's code-enforced boundary.

Challenges we ran into

The hardest challenge was avoiding misleading claims.

A prompt-only system may appear safe in a polished demo, but it has no independent validator after an unsafe tool call is attempted. We therefore separated model cooperation from system safety and described the comparison as an architectural containment experiment rather than fabricated model behavior.

We also found a real limitation: quoted third-party confirmation text can pass a simple approval extractor. Instead of hiding the case, we kept it visible as a known limitation and documented a mitigation path using structured speech-act classification.

Accomplishments that we're proud of

• Built a complete human-input → structured-prompt → deterministic-policy workflow.
• Created eight adversarial test cases with reproducible results.
• Reproduced 8/8 documented behaviors.
• Met 7/8 safety targets, while transparently disclosing one remaining limitation.
• Demonstrated that the same attempted actions meet only 1/8 safety targets under a prompt-only execution boundary, versus 7/8 with PromptGuard.
• Made the judge-facing workflow, comparison video, documentation, and interactive Evaluation Lab publicly accessible.

What we learned

Prompt engineering is valuable for making an agent cooperative, structured, and easier to inspect. However, prompts should not be the final authority over an irreversible side effect.

We learned that reliable agent design requires layered responsibility:

• Prompts guide reasoning.
• Tools provide evidence.
• Humans grant authority.
• Deterministic code enforces execution boundaries.

We also learned that an honest known failure mode is more useful than an unrealistic “perfect safety” claim.

What's next for PromptGuard

Next, we plan to replace the simple confirmation extractor with a structured classifier that distinguishes direct authorization from quoted or reported text.

We also plan to expand the evaluation suite with multilingual confirmation cases, more adversarial prompt-injection patterns, policy-version audit logs, and stronger testnet integrations.

PromptGuard is a testnet-only educational prototype. It does not handle real funds, provide financial advice, or claim regulatory certification.

Prior-work disclosure: PromptGuard is a new workflow-and-evaluation submission built on lessons from the earlier FlowPilot prototype.

Built With

• agent-evaluation
• ai-agents
• ai-safety
• anthropic-api
• base-sepolia
• claude
• css3
• ffmpeg
• github
• html5
• human-in-the-loop
• javascript
• json
• markdown
• node.js
• policy-engine
• prompt-engineering
• python
• react
• remotion
• reportlab
• testnet
• tool-use