Sentinel: AI payment gateway

customer order placed manually
system architecture
customer order placed manually using gemini api key
customer order placed through live simulation or ai agent
continuous orders being placed by live simulation
5 active merchant companies
command centre keeping track of all customer and merchant orders
full audit trail
groq auditor that accepts or flags orders

Inspiration

Agent-to-agent commerce is becoming the defining problem in fintech right now — NPCI's Unified AI Protocol, and the global race between ACP, AP2, and x402, all point to the same shift: AI agents, not humans, will increasingly be the ones shopping and paying on a person's behalf. Razorpay is already piloting in-app agent checkout. But almost every demo of "AI buys things" skips the hard part: how does a merchant let an autonomous agent spend real money without a human watching every transaction? We wanted to build the missing piece — not a flashier chatbot, but the guardrails that make an agent safe to transact with.

What it does

We built a checkout agent that makes a merchant (a roofing and tiles business) fully transactable by an AI buyer, end to end, on Razorpay:

An agent-readable catalog — served as a machine-readable JSON manifest at a /.well-known/agent-catalog.json endpoint, so any AI shopping agent can discover products, prices, and stock without a human-facing webpage. A policy-gated checkout agent — every order is checked against hard limits (per-order cap, per-session spend cap, per-line quantity cap, category allowlist, human-confirmation threshold for high-value orders) before any payment is attempted. A bounded upsell agent — offers at most one catalog-grounded upsell per checkout, and re-validates it against policy before adding it, so an accepted upsell can never sneak past a spending limit. A real LLM as the buyer — instead of scripting the cart ourselves, an actual LLM reads the catalog and a plain-English shopping goal, then decides what to buy — including an adversarial mode where we deliberately prompt it to try to overspend, to prove the guardrails hold even against a misbehaving agent. A full audit trail — every decision (allowed, blocked, offered, succeeded, failed) is logged with a plain-English reason, viewable live during checkout. Graceful failure handling — when an order clears merchant policy but exceeds the payment gateway's own transaction ceiling, the agent catches the failure, explains the specific cause, and offers a concrete remediation (splitting the order) instead of crashing or silently retrying. How we built it

Python + FastAPI backend, with Razorpay's Order API behind a swappable client — mock mode (in-memory, zero credentials) by default so the whole system runs and demos anywhere, and a real Razorpay test-mode SDK path behind one environment variable, with no other code changing between the two. The policy engine, audit logger, and upsell logic are all separate modules so nothing can reach Razorpay without passing through the gate first. The AI-buyer piece calls a live LLM (Google Gemini's free-tier API) with the catalog and a shopping goal, parses its response as strict JSON, and submits it through the same checkout pipeline a human would use.

Challenges we ran into

Getting a live LLM into the loop without a paid API budget was the biggest last-mile obstacle — we hit billing walls with our first provider choice and had to swap to a genuinely free option (Gemini's Flash-tier API) without changing anything about the guardrail architecture around it. We also had to be deliberate about separating merchant policy failures (blocked before any charge) from gateway-level failures (a real Razorpay-style rejection after the call is made) — conflating the two would have undercut the "graceful failure" requirement, since a judge could reasonably ask which layer actually caught the problem.

Accomplishments that we're proud of

The adversarial test: prompting the LLM to deliberately try to overspend (50 units of multiple SKUs, well past every cap) and watching the policy engine block it — itemized, before a single rupee moved — is the clearest proof that the guardrails don't depend on the AI buyer behaving well. That's the actual bar this track sets, and we can show it live, not just claim it.

What we learned

The hard part of agent commerce isn't getting an LLM to pick a shopping cart — that's almost trivial. It's building the boring, unglamorous layer underneath it: hard caps, audit logging, and failure paths that hold up even when the agent on the other end is adversarial or wrong. That layer is what actually makes autonomous spending trustworthy.

What's next for Razorpay Payment Gateway

Connecting to live Razorpay test-mode keys for a real dashboard demo, extending the upsell agent into a ranked campaign orchestrator, and replacing the keyword-based catalog search with proper LLM-based intent parsing on the merchant side — so a buyer agent can express a need in natural language and still only ever resolve to real, policy-checked SKUs.