Inspiration
AI shopping agents are suddenly everywhere — "tell the bot what you want, let it buy it for you." It's a compelling pitch, but it skips the actual trust problem: would you hand an autonomous agent your payment method and just hope it doesn't overspend, buy the wrong thing, or go silent if your package never shows up? Most demos treat that as a footnote. We treated it as the whole project. SafePayAI exists because "AI that shops for you" only matters if a buyer can trust the boundaries around it — and today, mostly, they can't verify those boundaries exist at all.
What it does
SafePayAI lets a buyer delegate shopping to an AI agent without delegating control of their money. In practice:
- The buyer signs a mandate first — a spending cap, allowed merchants/categories, and a time window. This is the buyer's own explicit boundary, set before the agent does anything.
- The buyer describes what they need ("running shoes under $80") and the agent proposes a cart that fits inside that mandate.
- The buyer reviews and approves — only then does a separate, deterministic checkout step execute the real payment through PayPal. The AI never holds payment credentials and never pulls the trigger itself.
- Once the order is placed, SafePayAI watches it. If it runs late or gets lost, a deterministic rules engine — not the AI — can open and resolve a refund case automatically, so the buyer doesn't have to notice the problem or fight a merchant to get made whole. Ambiguous cases fall through to a human reviewer instead of being auto-decided.
- Buyers, merchants, an operator, and a reviewer each get their own view into the same mandates, orders, and cases, with a full audit trail of what happened and why.
How we built it
We split the system deliberately along the line that matters most: anything that touches money is deterministic and rule-based, and anything that's AI is kept strictly upstream of that line, proposing but never deciding. On top of that we built a buyer-facing app for signing mandates and shopping, role-based views for merchants, operators, and reviewers, a simulated order-tracking loop to drive the protection flow, and an audit trail that lets anyone — including a judge — trace exactly why a cart was approved or a refund was issued. Checkout itself runs against PayPal's sandbox environment.
Challenges we ran into
Designing the mandate was harder than it sounds — too loose and it's meaningless, too rigid and the agent can't make any reasonable purchase at all; we spent real time tuning that middle ground. Keeping the AI genuinely out of the money path, end to end, meant auditing every step to make sure no code path let a model output turn directly into a charge or a refund amount. Handling uncertain outcomes — a payment call that times out without a clear success or failure — forced us to design for "we don't know yet" as a real state, not an edge case to ignore. And writing refund policy rules that are fair without being easy to game took several rewrites once we started trying to break our own logic.
Accomplishments that we're proud of
The core trust architecture works end-to-end, not just on a slide: a real purchase went through the full mandate-to-approval-to-checkout flow on PayPal's sandbox, and the order-protection loop can detect a problem and resolve a refund case without a human having to step in for the common cases. That loop — AI proposes, buyer approves, rules decide, humans backstop — is the actual product, and it runs.
What we learned
The hard part of "AI shopping agent" was never the shopping — language models are already good enough to pick a reasonable cart. The hard part is proving to a buyer, convincingly, that the agent cannot betray the boundary it was given. Trust architecture is a design problem as much as an engineering one, and it's the part competitors building "just" a shopping bot are likely to skip.
What's next for SafePayAI
We'd like to give buyers richer mandate controls — per-category limits, recurring mandates, finer merchant allow-lists — and build out real tooling for merchants to manage disputes on their side instead of just appearing in them. The catalog is seeded for this demo; a natural next step is connecting to real retail integrations. Carrier tracking is currently simulated on our own clock, and broadening that to real carrier data sources would make the protection loop meaningfully stronger. Longer term, we want reviewers to have better tools for the genuinely ambiguous cases, since that human backstop is core to keeping the system honest as it scales.
Built With
- asyncpg
- claude
- docker
- fastapi
- github-actions
- gsap
- jwt
- neon
- next.js
- paypal
- pnpm
- postgresql
- pydantic
- python
- radix-ui
- react
- render
- tailwind-css
- tanstack-query
- typescript
- uv
- vercel
- zod
