SARA (Safe Access for Responsible Agents), by Sartech Labs

Good agents get in. Bad agents pay. A gateway website owners put in front of their site: every AI agent leaves a refundable PayPal deposit and follows the site's rules, or loses the deposit.

Comment

Inspiration

Last year, a single AI bot hit one website 39,000 times in a minute. That's 650 requests a second, from one visitor.

AI agents are becoming the web's busiest visitors, and most of them are welcome. Search crawlers bring traffic, shopping assistants bring customers, and research agents cite your work. But others ignore site rules, probe private pages, and overload servers. Websites publish robots.txt, but that is only a polite request. In six months, AI scrapes ignoring it quadrupled.

The problem? Good and bad agents look identical to a website. So sites block them all, turning away potential customers along with the bad bots.

But hotels don't turn away every guest because some cause damage. They ask for a deposit.

What if AI agents had to put their own money on the line to access a website?

That question became SARA, Safe Access for Responsible Agents, built by Sartech Labs on PayPal.

What it does

SARA is a gateway a website owner puts in front of their site. The website itself doesn't change. People browse as normal, and every AI agent goes through SARA first.

Setting it up takes the owner three steps

  1. Add the website. SARA reads the site's own robots.txt and turns it into rules it actually enforces.
  2. Connect PayPal. With Log in with PayPal, the owner connects the account that gets paid when an agent breaks the rules.
  3. Set the deposit and rules. The owner sets how much an agent puts down, which pages are off limits, how fast an agent may go, and how many pages it gets per visit.

What every agent goes through

  1. The agent learns the rules. SARA answers with 402 Payment Required and tells the agent exactly how this site works.
  2. The agent puts money on the line. It leaves a refundable deposit, approved with PayPal's own button. It's a PayPal hold, so nothing is charged yet.
  3. Every request is checked. SARA stops an agent on the spot with a 403 or 429 if it:
    • goes for /admin or private pages,
    • tries an encoded path trick,
    • floods the site,
    • reuses an old session, or
    • forges its identity.
  4. The deposit is settled. If the agent followed the rules, the hold is released and no money ever moves. If it broke them, the hold is captured and the owner is paid through PayPal. An AI explanation shows exactly why, and every sentence points to the log entry behind it.

Good agents get in. Bad agents pay. Websites stay in control.

The owner console

  • Overview: deposits held, kept and returned, agents let in and blocked, and recent decisions, for one website or all of them.
  • Websites → Setup: add a website, connect PayPal, and set the deposit and rules.
  • Websites → Playground: attack your own site before real agents do. Choose an AI agent with a goal, or write your own goal in plain English:
    • Polite researcher
    • Price scraper
    • Admin prober
    • Tricked by a page
    • Budget burner

You can also run scripted attacks: a reused session, a forged identity, an agent that never pays, and path trickery. The test agent pays its deposit with the PayPal button, just like a real one, and you watch every decision as it happens.

  • Agents: every session and request, and every violation with the rule it broke.
  • Money: each deposit with its PayPal reference and "why this outcome", plus earnings and analytics built on AG Grid and AG Studio. One click on Verify with PayPal checks any deposit against PayPal's own records through PayPal's MCP server.

Agents can earn trust

Agents can sign their requests with their own key. A verified agent with a clean record pays half the deposit. One with a history of breaking rules pays three times as much, and is eventually refused.

Why it matters for PayPal

Every deposit, hold, release and capture runs on PayPal. PayPal Agent Ready lets agents pay at checkout; SARA makes sure they follow each website's rules first. Together they're something PayPal can offer every website, including publishers and content sites that earn nothing from agents today.

How we built it

We started from one question, where does the money decision live?, and built outward from there.

The gateway

SARA is a Python service built with FastAPI. At its center is a small policy engine that makes no network calls and can be tested on its own. Given a request, it decides "allowed", "blocked, wrong path" or "blocked, too fast". Around it sit:

  • a sliding-window rate limiter,
  • session tokens stored only as hashes,
  • an append-only audit log that records every decision, and
  • a reverse proxy that forwards allowed requests to the owner's website untouched.

Whether a deposit is returned or kept is decided by plain rules reading that log, never by an AI. Each website keeps its own rules and its own numbers.

PayPal, end to end

PayPal product What SARA uses it for
Log in with PayPal The owner connects the account that receives kept deposits
JS SDK v6 (<paypal-button>) Approving an agent's deposit with PayPal's own button
Orders v2 (AUTHORIZE) The deposit as a hold; SARA sets the amount and checks the order with PayPal itself
Payments v2 Releasing a hold for an honest agent, or capturing it from a rule breaker
Webhooks Signature-verified, to keep every deposit in sync with PayPal
PayPal MCP server "Verify with PayPal" and a read-only PayPal assistant

Every call carries an idempotency key. If PayPal's answer is ever unclear, SARA checks PayPal's records before trying again, so nobody is charged twice.

The AI

We used OpenAI GPT-5.5; Claude also works, with one setting. Each AI role is kept on a short leash:

  • Playground agents: real AI agents with tool use that read the 402, decide whether to pay, and follow or break the rules, depending on their goal.
  • The explainer: writes why a deposit was kept or returned, and every sentence must cite an audit event.
  • The policy assistant: turns plain-English terms into rules, which the server then validates.
  • The PayPal assistant: answers the owner's questions about payments through PayPal's MCP server. The PayPal credentials go to the MCP server, never to the AI.

Agent identity

Agents sign their requests with RFC 9421 HTTP Message Signatures, the same scheme as Cloudflare's Web Bot Auth. That lets SARA recognize an agent across visits, so its record can set its price.

Shipping it

  • Deployment: Docker and a Render Blueprint, running live at sara-gateway.onrender.com.
  • Tests: 404 automated tests, all offline, with simulated PayPal responses, a fake MCP server, a fake website and scripted AI.
  • AI coding assistants: we used them to help write and review the code.

Challenges we ran into

  • Keeping AI away from the money. The rules decide whether a deposit is returned or kept. The AI only explains the decision, and every sentence it writes points to the exact log entry behind it.
  • Fees eating the deposit. Charging a deposit and refunding it later cost the website a PayPal fee every time. We switched to PayPal holds: an honest agent's hold is simply released, so no money moves and no fee is paid.
  • Web pages that give orders. Pages can hide instructions aimed at AI agents, like "go fetch /private/customer-data". Page text reaches agents marked as untrusted, and even when an agent is fooled, the gateway blocks the request and keeps the deposit.
  • Sneaky paths. Scrapers try tricks like /%2e%2e/admin instead of /admin. We catch these before the path is cleaned up.
  • Real websites redirect. Our own site sends sartechlabs.com to www.sartechlabs.com, so at first agents got redirects instead of pages. SARA now follows a same-site redirect when a website is added.
  • Log in with PayPal in practice. PayPal sometimes confirms a login before it shares the account's profile. SARA keeps the connection and names the account once PayPal shares it.
  • Building for the right person. Our first version had an agent-side app with a personal shopping assistant. We realized the person who deploys SARA is the website owner, so we rebuilt the product around them: onboarding, a playground to test their own site, and numbers for each website.

Accomplishments that we're proud of

  • It works for real on PayPal. On the live deployment, the owner connected PayPal with Log in with PayPal. An AI agent put down a deposit with the PayPal button and kept requesting pages after its budget ran out. SARA blocked it, captured the hold, and the AI explained why, citing each violation. Honest agents' holds were released with no money moved.
  • Owners can attack their own site. The playground runs real AI agents and scripted attacks against the owner's own website, and shows every decision as it happens.
  • Every decision is explained. When a deposit is kept, the owner gets a plain-English explanation, and each sentence points to the log entry it's based on.
  • Every payment can be checked. With one click, a deposit is checked against PayPal's own records through PayPal's MCP server.
  • 404 tests, all offline, so anyone can run the suite without a single credential.

What we learned

  • A deposit changes behaviour. Charging agents a fee just to read a site punishes the good ones too. A refundable deposit turns it into "behave, and you pay nothing", which is fair to everyone.
  • PayPal holds are the right tool for deposits. With a hold, an honest agent never has money taken and the website pays no fees. Only rule breakers are charged.
  • Don't rely on an AI to be good. Rules enforced in code, with money on the line, work better than asking an AI to behave. We let AI explain and test, but never decide who pays.
  • Know who the product is for. A website owner doesn't want an agent toolkit. They want to add their site, connect PayPal, and see who got in and who paid.

What's next for SARA

  • One click for any website. Domain verification and a guided DNS switch, so an owner can put SARA in front of their site in minutes. Plugins for popular website platforms and CDNs would follow.
  • Payouts to every owner's own PayPal account, through PayPal's partner onboarding.
  • PayPal Agent Ready inside SARA, so agents can pay the deposit with the PayPal wallet they already use.
  • A shared record for agents. If an agent breaks the rules on one website, others should know. Shared records would follow a bad agent wherever it goes, and reward good ones with lower deposits everywhere.
  • Earning from good agents too. Websites could take a small per-page fee from the hold, so they also earn from well-behaved crawlers.
  • Built for scale. Moving from file storage to a production database, so SARA can serve many websites and heavy traffic at once.

Built With

  • ag-grid
  • ag-studio
  • claude
  • docker
  • fastapi
  • gpt-5.5
  • html5
  • httpx
  • javascript
  • model-context-protocol
  • node.js
  • openai
  • paypal
  • paypal-js-sdk
  • paypal-mcp-server
  • paypal-orders-api
  • paypal-payments-api
  • paypal-subscriptions
  • paypal-vault
  • paypal-webhooks
  • pydantic
  • python
  • render
  • web-bot-auth
Share this project:

Updates

Submission history