PromptPay Guard

A production-grade, two-tier Zero-Trust security firewall protecting the PayPal Orders API v2 from autonomous AI agent prompt injections, Salami micro-drains, and budget overruns.

Comment

💡 Inspiration

Autonomous AI agents are shifting from passive text generation to executing real-world financial commerce—buying compute, subscribing to APIs, and booking business logistics. However, wiring an LLM's non-deterministic reasoning directly to financial settlement rails like the PayPal Orders API v2 creates catastrophic vulnerabilities:

  1. Adversarial Prompt Injections: External data sources (e.g., untrusted invoices, emails) can hijack agent reasoning and reroute funds to attacker-controlled escrow accounts.
  2. Salami / Micro-drain Attacks: Malicious actors issue hundreds of rapid sub-dollar micro-transactions to drain enterprise balances below static threshold triggers.
  3. Vendor Homoglyph Spoofing: Attackers substitute subtle Unicode characters in vendor emails to intercept automated settlements.
  4. Denial-of-Wallet & High Inference OpEx: Inspecting every raw transaction with heavy frontier LLMs costs thousands in operational tokens and adds hundreds of milliseconds of latency.

We built PromptPay Guard as a resilient, two-tier Zero-Trust reverse proxy to intercept, inspect, and mathematically govern every AI agent financial payload before it touches PayPal's network.

🛡️ What It Does

PromptPay Guard sits as an intelligent gateway between Autonomous AI Agents and the PayPal Orders API v2:

  • ⚡ Tier-1: High-Speed Boundary Engine (<0.5ms | $0.00 Cost): Uses in-memory deterministic heuristics (atomic sliding-window rate limiters, budget ceilings, schema bounds, and homoglyph checkers) to eliminate ~38% of malicious attacks at absolute zero inference cost.
  • 🧠 Tier-2: Semantic Intent Engine (Gemini 1.5): Evaluates agent scratchpad contexts against declared user mandates to uncover covert prompt injections and intent deviation.
  • 🎯 3-Zone Operational Risk Model & Radial Gauge: Replaces binary pass/fail logic with a graduated 3-zone engine:
    • Zone 1 (0–30 Score): Low Risk $\rightarrow$ Autonomous PayPal Capture execution.
    • Zone 2 (31–70 Score): Medium Risk $\rightarrow$ Suspends execution for Human-in-the-Loop (HITL) admin approval.
    • Zone 3 (71–100 Score): Critical Risk $\rightarrow$ Instant HTTP 403 adversarial block.
  • 👤 Human-in-the-Loop (HITL) Triaging Console: Allows risk operations teams to review flagged payloads with 1-click Approve (debited and captured) or Reject (safely dropped).
  • 📡 Real-Time Webhook Settlements: Verifies incoming PAYMENT.CAPTURE.COMPLETED events, defends against replay attacks with cryptographic validation, and feeds an RFC 4180-compliant audit ledger with 1-click CSV/JSON exports.

🏗️ How We Built It

  • Core Gateway: Engineered with Node.js and Express.js, hardened with strict Helmet CSPs, payload bounding, and RFC-compliant JSON parsing.
  • AI Intelligence: Integrated Google Gemini 1.5 Flash (for sub-cent micro-inspection) and Gemini 1.5 Pro (for deep adversarial reasoning) with dynamic model switching.
  • Payment Rails: Direct integration with PayPal Orders API v2 Sandbox for automated authorization, capture, and status polling.
  • Enterprise Hardening:
    • Idempotency Key Engine: Prevents duplicate PayPal charges on agent network retries.
    • Context Window Ceiling: 4,000-character boundary prevents LLM Denial-of-Wallet attacks.
    • State Persistence: Graceful lifecycle dump and startup rehydration across process recycles.

🧪 Testing & Verification

We implemented an enterprise-grade automated testing harness covering 60 automated test cases (100% Green / Passing):

  • npm run test:audit: CSV/JSON ledger exports, PayPal Webhook callbacks, and HITL lifecycles (13/13).
  • npm run test:security: Type confusion, homoglyph typosquatting, ReDoS, and payload bounding (18/18).
  • npm run test:resilience: Fail-secure defaults on Gemini timeouts or PayPal gateway errors (5/5).
  • npm run test:models: Dynamic model switching and token cost math (7/7).
  • npm run test:edge: Idempotency caching, 4k character DoS bounds, and webhook replay guards (8/8).
  • npm run test:all: Core PRD positive and negative verification scenarios (9/9).

📈 Unit Economics & Results

  • Latency: Tier-1 delivers deterministic filtering in 0.06ms – 0.55ms (10x faster than standard requirements).
  • Cost Efficiency: Slashes payment inspection OpEx by 98.8%—reducing standard costs from $2.35 down to $0.03 per 1,000 requests.
  • Zero-Cost Shield: Deflects volumetric attacks at $0.00 marginal compute spend.

🔮 What's Next for PromptPay Guard

  • Multi-Instance Redis Layer: Transitioning in-memory state tracking to distributed Redis Sorted Sets (ZADD/ZREMRANGEBYSCORE) for multi-region cloud clustering.
  • Hardware Security Integration: Securing API keys via AWS Secrets Manager and KMS.
  • Multi-Modal Invoice Auditing: Enabling agents to cross-verify visual PDF receipts against PayPal line items before approval.

🧠 Why Google Gemini 1.5?

Rather than relying on generic, expensive frontier models, PromptPay Guard was specifically architected around Gemini 1.5 Flash and Pro:

  • Sub-Cent Unit Economics: Gemini 1.5 Flash's pricing ($0.075 / $0.30 per 1M tokens) enables enterprise-grade semantic inspection at fractions of a cent, driving our 98.8% OpEx reduction.
  • Dynamic Tiering: Seamlessly routes routine transactions to Gemini 1.5 Flash for sub-200ms latency, while automatically escalating ambiguous, high-value payloads to Gemini 1.5 Pro for deep adversarial intent reasoning.
  • Deterministic Structured JSON Output: Native JSON schema constraints guarantee zero parsing errors and reliable integration with our RFC 4180 compliance ledger.

Built With

  • cybersecurity
  • express.js
  • fintech
  • google-gemini-1.5-flash
  • google-gemini-1.5-pro
  • node.js
  • paypal-orders-api-v2
  • rest-api
  • webhooks
  • zero-trust-architecture
Share this project:

Updates

Submission history