Readback

The safe way to let your AI shop with PayPal. Every purchase your agent makes, on the record.

Comment

Inspiration

AI agents are starting to spend people's money. Sooner or later a shopper will look at a charge and say: "I didn't buy this. My AI did." Today PayPal reviews that as an ordinary transaction, with no record of what the shopper let her agent buy. PayPal's FY2025 Form 10-K reports $1.49 billion in realized losses and charge-offs on its protection programs, up 22% in a year (all protection programs, not only unauthorized claims).

Pilots solve the same problem with a readback: they repeat every instruction before acting, and the exchange is recorded. Readback does that for AI agents that pay with PayPal.

What it does

Readback is the dispute layer the agent-payment standards (AP2, Mastercard Verifiable Intent) leave out, running on PayPal today:

  1. She approves her agent's limits on PayPal. Claude turns one sentence into exact terms; code checks every term. She approves them on PayPal's own approval page, and PayPal stores them, with her agent's key fingerprint, in the saved-wallet agreement.
  2. Her agent signs every purchase. Claude can't pay. It can only ask her agent, which signs one exact order (ES256) and refuses anything outside her terms. The store's gate verifies the signature, re-reads the terms from PayPal and charges with a per-period invoice number, so PayPal itself refuses a second charge.
  3. A "my AI bought that" dispute is rebuilt from PayPal's records and checked with eleven deterministic checks, re-verified in the investigator's browser.

Same claim, two verdicts. A purchase her agent signed inside her terms: uphold the charge. A charge the merchant made itself with no request from her agent: refund the buyer, against the very merchant running Readback.

Readback stores nothing. No database. Every fact on every screen is read from PayPal just now.

What the video doesn't show

  • /judge: eight attacks run through the real layers in your browser, and all 59 labeled eval scenarios (0 wrong suggestions toward either side).
  • /ap2 and /vi: AP2's and Verifiable Intent's own example mandates, verified in the browser.
  • /proposal: filing a real unauthorized claim made PayPal delete the agreement within minutes; we propose PayPal keep the terms (deleted_at) and show them on its approval page.
  • Tests: 415 unit tests, 26 browser checks, 0 axe-core accessibility violations.

How we built it

  • PayPal (sandbox): Vault v3 setup and payment tokens, Orders v2 merchant-initiated charges (vault_id, stored_credential), Payments v2 captures, Disputes (read, provide evidence, accept claim), Transaction Search, Orders v2 tracking, webhook verification. Every POST carries a deterministic PayPal-Request-Id.
  • AI (Anthropic Claude Sonnet 5.5): drafts the terms, shops by calling the agent's tools, writes a cited plain-English case brief that a validator checks, and picks the filter for "Ask the queue". Claude proposes; cryptography and deterministic code decide. Claude never holds a key.
  • AG Grid: the investigator's queue, with four custom cell renderers, a theme built from the product's design tokens, quick filter, and Claude-picked filters, live from PayPal.
  • Render: two stateless services from one Blueprint; the agent runtime holds the agent key and no PayPal credentials.
  • Stack: TypeScript, Next.js, MCP TypeScript SDK, jose over WebCrypto, zod, vitest, fast-check.

Challenges we ran into

PayPal doesn't say which saved wallet paid an order, the approval page shows a merchant-written summary rather than the stored terms, and an unauthorized claim deletes the agreement. Each is recorded with its sandbox response and handled in code.

What's next for Readback

PayPal keeping agent terms on the agreement, verifying the signature at charge time, and showing the stored terms on its approval page.

Built With

Share this project:

Updates

Submission history