REIN

Give your AI agent a refund budget, not your PayPal keys.

Comment

Inspiration

AI agents are increasingly being trusted to perform financial actions such as refunds, payouts, and purchases. However, the current approaches create a difficult trade-off: either give an AI agent direct access to payment credentials and hope it cannot be manipulated, or require a human to manually review every transaction.

Neither approach scales well.

During our experiments, we found that an agent allowed to choose its own refund amounts could be socially engineered into issuing excessive refunds on 14 out of 20 test tickets (70%). This highlighted a fundamental problem: an AI agent should not be trusted to determine the financial authority it is allowed to exercise.

We wanted to build a third option: a deterministic financial mandate that an AI agent cannot negotiate, manipulate, or bypass through prompt injection.

That idea became Rein.

What It Does

Rein is a deterministic mandate gate that sits between AI agents and the PayPal Sandbox. It allows agents to request financial actions while ensuring that every action stays within predefined, server-enforced limits.

Instead of giving agents direct access to payment credentials, Rein provides a controlled interface through MCP or an SDK.

Its key capabilities include:

  • Credential Isolation: AI agents never receive PayPal credentials. All payment operations pass through Rein.
  • Trusted Refund Calculation: Agents specify which items should be refunded, while Rein independently calculates the refund amounts using trusted order data.
  • Deterministic Policy Engine: A pure policy function evaluates every request and returns an allow, escalate, or block decision based on rules such as R-OVER-CAPTURE, R-DAILY-HARD, and R-DUP.
  • Atomic Fund Management: Funds are reserved and executed within a transaction to prevent race conditions and duplicate refunds.
  • Human-in-the-Loop Approval: Risky actions are escalated to a human reviewer through a single-use approval link. Telegram notifications are supported when configured.
  • Verifiable Audit Ledger: Every decision is recorded in a hash-chained ledger with Ed25519-signed checkpoints. Anyone can independently verify the ledger through the /verify page.
  • Beat the Gate: A public adversarial testing experience where visitors attempt to manipulate a live AI agent into violating the rules. It uses Groq (Llama) when an API key is configured and otherwise runs in a clearly labeled recorded mode.
  • Agentic Commerce: The Shop page demonstrates buyer-side agents comparing prices through Channel3 and completing purchases within gate-enforced spending limits.

In our authored test set, Rein reduced successful over-refunds from 14 out of 20 to 0 out of 20 in a single run.

How We Built It

We built Rein using a modern TypeScript-based architecture designed around deterministic execution, security, and verifiability.

Technology Stack:

  • Backend: Node.js 22, TypeScript, and Express.
  • Database: SQLite using both better-sqlite3 and node:sqlite drivers.
  • Frontend: React and Vite.
  • Audit and Data Visualization: AG Grid for the audit ledger and mandate backtests.
  • Agent Integration: Model Context Protocol (MCP), with SDKs and wrappers for LangChain and OpenAI.
  • Payment Integration: PayPal Sandbox.
  • AI Integration: Groq with Llama for adversarial agent testing.
  • Deployment: Render.

The central component is a pure policy decision function with no side effects. It evaluates requests against predefined financial mandates and determines whether an action should be allowed, escalated, or blocked.

We deliberately separated the agent's intent from the actual financial execution. The agent can identify what it wants to refund, but Rein retrieves trusted order information and calculates the amount independently.

For transaction safety, we implemented a reserve-then-execute workflow. Refunds are reserved before execution, and a reconciler handles uncertain outcomes, such as PayPal requests that time out. The reconciler verifies whether the refund actually occurred before marking it as executed.

We also built the audit system so that third parties can verify its integrity without trusting the application itself. The ledger uses hash chaining and Ed25519-signed checkpoints, with a browser-based verifier that identifies the exact row where tampering occurs.

The project currently has 392 passing tests across both SQLite drivers.

Challenges We Ran Into

Building Rein involved several interesting engineering and security challenges.

1. Handling Payment Timeouts and Duplicate Execution

One of our biggest challenges was ensuring that a PayPal request timing out would not result in duplicate refunds or incorrect transaction states.

We implemented a reconciliation workflow that checks PayPal's actual refund status before marking an uncertain transaction as completed. This ensures that the system does not blindly assume an operation succeeded or failed.

2. Isolating Adversarial Testing from Production

Beat the Gate allows visitors to actively attempt to manipulate an AI agent. However, we needed to ensure these experiments could never interfere with real financial operations.

We isolated the feature using an in-memory database, a daily token budget, and no production notifications.

3. Building an Independently Verifiable Audit Trail

A normal audit log requires users to trust the application generating it. We wanted something stronger.

We implemented a hash-chained ledger with Ed25519-signed checkpoints and rebuilt the export and browser verification mechanisms so that even a single modified row can be detected at its exact location.

4. Creating Honest and Meaningful Benchmarks

Our initial benchmark measured only the execution time of the pure policy decision function. We realized this did not represent the actual performance of the complete system.

We rewrote the benchmark to measure the real gate, including the surrounding workflow, giving us a more meaningful representation of its performance.

Accomplishments We're Proud Of

We are particularly proud of the following achievements:

  • Reduced over-refunds from 14/20 (70%) to 0/20 (0%) on our authored test set in a single run.
  • Built a deterministic financial policy engine that does not rely on an AI model to enforce its own restrictions.
  • Implemented a signed, hash-chained audit ledger that anyone can independently verify through the browser.
  • Created Beat the Gate, a public adversarial testing environment where the final security decision comes from the actual policy engine, never from the model's claims.
  • Integrated PayPal Sandbox with atomic fund reservation, execution, and reconciliation workflows.
  • Achieved 392 passing tests across two SQLite database drivers.
  • Built an agentic commerce demonstration with enforced purchasing limits.

What We Learned

Our biggest takeaway was simple:

Don't just ask an AI model to behave. Remove the authority it could misuse.

Prompt engineering and model alignment are useful, but they should not be the final line of defense when real money is involved.

By separating an agent's intent from its financial authority, we learned that an entire category of prompt-injection attacks can be prevented structurally rather than through better prompts.

The model can make recommendations, select items, and request actions, but the final financial decision belongs to deterministic server-side rules.

We also learned that security is not just about preventing unauthorized actions. It is equally important to make every decision explainable, auditable, and independently verifiable.

What's Next

We see Rein as a foundation for safer agentic financial infrastructure.

Some of the improvements we would like to explore next include:

  • Telegram-native approval buttons for a smoother human approval experience.
  • Per-customer transaction velocity limits.
  • Multi-approver authorization for high-value transactions.
  • Support for additional agent frameworks through drop-in integrations.
  • Expanded payment-provider support beyond PayPal.
  • More advanced mandate policies for complex financial workflows.

We deliberately prioritized building a solid, deterministic security core before expanding into additional approval mechanisms and integrations.

Our vision is to make financial autonomy possible for AI agents without giving up human control, accountability, or trust.

Built With

Share this project:

Updates

Submission history