The Protected card: the full-screen alert Ruth sees when Senior Sentinel stops a scam, with one clear action and no blame.
The caregiver's home screen: whether Ruth is protected, extra care on the card, dollars kept safe, and one tap to call or pause.
The Activity tab: every order and bill by store, with its status, and any refunds back to the card that paid.
Ruth's kiosk: the voice station where an older adult shops, pays bills and checks suspicious calls by speaking, in three languages.
The caregiver's approval request: a purchase above the ask-me line, with Ruth's own words, approved by passkey or declined.
The Safety feed: each scam check with Ruth's own words, what Senior Sentinel told Ruth, and the sources behind the verdict.
The rules the caregiver signs with a passkey, summed up in plain words, waiting for Ruth to agree by voice.
Host controls: the laptop-only demo console for confirming sandbox payments, marking pickups and resetting the demo.
The Trust Ledger: a live wall showing every decision Senior Sentinel makes, across four guards, with dollars protected.
The reciept screen: what Ruth bought, where and when to pick it up, and a QR code to the session's public record.
The kiosk after the caregiver declines: Senior Sentinel tells Ruth kindly that nothing was bought.

Senior Sentinel: Scam-Proof Shopping for Vulnerable People.

About the project

Inspiration

Last year, Americans over 60 reported $7.7 billion in losses to fraud (FBI IC3, 2025). The pattern is painfully familiar: a call from a "grandson" in jail, a "lawyer" who needs the bail within the hour, and a trip to a Bitcoin machine or the gift-card rack. The same people are often the ones today's shopping apps leave behind: older adults, people who don't read English comfortably, people without a smartphone. Their families already help with the money, just informally, from other cities, by phone.

Agentic commerce is arriving with spending limits, merchant restrictions and approvals, but those controls assume the cardholder sets them for themselves. We asked: what if a family could set them together, and the agent could say no to the scam, out loud, in Grandpa's own language?

We built Senior Sentinel for one community: older adults targeted by scams, and the family members who look after them.

What it does

Senior Sentinel is a shopping agent for an older adult (in our demo, Grandpa Ruthvik, "Ruth") and his caregiver (his son Priyank). It covers the whole journey, discover, decide, transact, continue, behind four guards:

Ask: a scam check on the call. Grandpa describes a call ("my grandson is in jail and needs bail, don't tell Mom") to the kiosk or on the phone. Senior Sentinel recognizes the scam in English, Spanish or Hindi, checks it against his own accounts ("your Peachtree Power bill is paid, so this call is a scam"; "call Alex at the number you have saved") and recent scam reports, speaks a calm two-sentence answer, and puts his card on a 24-hour cool-down. Priyank gets the alert with the sources and a plain-English Why?.
Card: every swipe checked. Grandpa's card is authorized in real time by our rules. The card never pays gift-card kiosks, crypto machines or money transfers. During a cool-down, a $480 charge at a drugstore is declined, and Senior Sentinel tells Grandpa why. Priyank can Allow once or Keep blocked. The rules are mirrored to Visa Transaction Controls.
Agent: errands inside signed rules. "My blood pressure medicine, denture adhesive, and pay my power bill." Senior Sentinel finds products (his usual items first, anything else live from Kroger), reads the cart back store by store, and on a clear "yes" places one signed order per store. Each store verifies the signature before taking the order. Payment runs through Visa Acceptance, and every order gets a Visa Decision Manager risk score. Anything over the approval line waits for Priyank's passkey.
Family: rules signed together. Priyank signs the rules (stores, categories, limits, card rules) with a passkey. Senior Sentinel reads them to Grandpa, and his spoken "yes" is recorded beside them.

After checkout: pickup codes, order status, cancellations, returns and refunds only to the card that paid, bills, rewards points, and a receipt with a QR code to a public page of the session's story. The Trust Ledger wall shows every decision live, in four lanes, with a dollars protected counter.

No smartphone? Grandpa can call a phone number and do all of this by voice, entering his PIN by voice or on the keypad.

Everything runs in sandboxes with test cards; no real money moves.

How it fits each track

Visa: Best use of Reimagining Shopping. A conversation is the whole shopping experience, from discovery to after the purchase.

Discovery: Grandpa says what he needs ("my blood pressure medicine", "denture adhesive") and Senior Sentinel finds it: his usual items first, then Kroger's live catalog at a real store's prices, narrowed by his preferences (lower sodium), his remaining budget and his approved stores.
Checkout: the cart is read back store by store, and only a fresh "yes" places the orders.
Payments: Visa Acceptance (Cybersource) Pay by Link on four merchant accounts, a Visa Decision Manager score on every order, and the card rules mirrored to Visa Transaction Controls. The caregiver's signed rules follow the shape of a Visa Intelligent Commerce mandate.
Secure: the AI never sees a card number, every agent request to a store is signed and verified, and anything over the approval line needs the caregiver's passkey.
Trust you can see: a spoken reason for every "no", a plain-English Why? for the caregiver, and the Trust Ledger wall.

SpaceXSI: Make it Legendary (xAI / Grok). Grok Voice is the kiosk's real-time voice in English, Spanish and Hindi, and xAI's Voice Agent Builder answers a real phone number that calls our own MCP server's tools, with the PIN spoken or typed on the keypad. That is what lets someone without a smartphone use it.

Cal Hacks Best People-First Social Impact Hack. Built for the people shopping apps leave behind: older adults, Spanish and Hindi speakers, and people with only a basic phone. Every answer, warning and receipt line is in their language. It never blames Grandpa ("You did nothing wrong"), and his family stays involved without taking over. Its impact is counted live: dollars protected, scam calls stopped, card declines.

Anthropic: Claude for Public Benefit. Built for one community: older adults targeted by scams, and the family members who look after them.

Claude where it helps, never where it could hurt: Claude explains every decision to the caregiver in plain words, weighs the purchases the rules can't settle, and runs the scam radar against five consumer-protection sites with the sources it found. It never authorizes a payment; signed rules and plain code do.
Honest about the AI: the caregiver app and the Trust Ledger label every answer Claude wrote ("Explained by Claude", "Checked by Claude"), and nothing that came from the rules, a cache or a fixed fallback is labelled as Claude's.
Safe when Claude is slow: every Claude call has a hard deadline. If the judge is late on a request the rules flagged, the purchase waits for Priyank's approval; a late scam check falls back to the rules and recent answers, and a late explanation to fixed plain words.
Works beyond the demo: a real phone number answers today, the card rules run on a card network's live authorization hook, and the whole system runs on sandbox rails shaped like production.

Microsoft "Built for the Real World" and the Customer Impact Award. Seniors lose billions to phone scams every year, and families already help with money informally. Senior Sentinel works on an ordinary phone line, a real card network's authorization hook and Visa's own card controls, so a bank, a pharmacy or a senior center could offer it to families.

Armadin: Best Security Hack.

The caregiver signs the rules with a passkey (WebAuthn) over a canonical (JCS) hash, and policy checks the signature, the origin and user verification.
Every agent request to a store is signed with RFC 9421 HTTP Message Signatures. The store checks it against our JWKS, with expiry and single-use nonces.
Every swipe of the card is decided against the signed rules.
Approvals use HMAC'd codes compared in constant time that lock after five failures. Refunds only go back to the card that paid. Cybersource webhooks are signature-verified.
Static analysis and a table of controls, each with the test that proves it, are in our repo's docs/security-evidence.md.

Cal Hacks Most Technically Complex Hack. Seven services (policy, merchant, catalog, relay, phone line, kiosk and caregiver app) share JSON Schema contracts. A signing chain runs from the caregiver's passkey to the store's verifier. Real sandbox calls go to Visa Acceptance, Decision Manager, Visa Transaction Controls, a card network's real-time authorization and Kroger. There is a phone line on MCP, and more than 900 automated tests.

How we built it

Voice. The kiosk talks through Grok Voice in real time. The phone line is an agent in xAI's Voice Agent Builder calling our own MCP server, with a PIN spoken or typed on the keypad.
Guardrails outside the model. The model never decides a payment. A policy service (FastAPI) re-prices every cart from the catalog and applies the signed rules deterministically: stores, categories, caps, approval threshold, monthly budget. A multilingual rule lexicon (English, Spanish, Hindi and Hinglish) screens every request. A Claude judge only weighs the ambiguous ones.
Scam radar. Claude with web search on five consumer-protection sites (FTC, IC3, AARP, BBB, FCC), under one time budget. Its sources are only search results it actually returned. A known scam gets its answer in under a second, and the sources for the caregiver's alert are fetched in the background.
Signed intent. The caregiver's passkey (WebAuthn) signs a canonical (JCS) hash of the rules. Each agent request to a store is signed with RFC 9421 HTTP Message Signatures in the Trusted Agent Protocol header format, and each store verifies it against our JWKS. The rules are also expressed in Visa Intelligent Commerce's mandates[] shape.
Payments. Visa Acceptance (Cybersource) sandbox Pay by Link, on four separate sandbox merchant accounts (grocery, pharmacy, home goods, power company), with Decision Manager scoring each order. Webhooks are signature-verified per account.
Card. A sandbox card on Lithic with Auth Stream Access: our service approves or declines each swipe in under a millisecond, about a second end to end. The rules are mirrored to the Visa Transaction Controls sandbox over two-way SSL.
Catalog. The Kroger Products API, live for anything our curated list doesn't carry, with real store prices; openFDA for over-the-counter medicines.
Caregiver app. Next.js on the caregiver's phone: passkey approvals, a Safety feed, card holds, rules, weekly activity, and live alerts over server-sent events.
Trust Ledger. Every service posts events validated against a JSON Schema contract to a relay, which drives the wall, the caregiver's alerts and the public session page.
Tests and evaluation. More than 900 automated tests. The scam evaluation covers 102 scripts in four languages. On the held-out half, rules plus the judge caught 25 of 25 scams and wrongly refused 1 of 24 honest requests, measured while the judge still ran on Grok. The scripts were written alongside the rules, so treat that as in-sample.
Claude in the product. Claude explains every decision to the caregiver, weighs the purchases the rules can't settle, and runs the scam radar with cited sources; it never authorizes a payment.

We built it in 36 hours with AI coding assistants (Claude Code and Cursor).

Challenges we ran into

Keeping the agent from being talked into things. Voice models are agreeable. We moved every money decision out of the model: a read-back gate, a fresh "yes" required after the read-back, deterministic pricing, and rules the model can't edit.
False positives versus real scams. "Buy a gift card for someone at church" is a request to refuse kindly; "my grandson called from jail, don't tell Mom" is a scam; "don't tell Mom, it's a surprise party" is fine. Getting that right in Hindi, in Devanagari and Hinglish, took a lot of care.
Sandbox reality. Card authorizations on our Cybersource sandbox account failed with a processor configuration error, so we paid through Pay by Link and a card-network sandbox instead. Visa Intelligent Commerce's API needs pilot credentials, so we modeled its mandate shape rather than calling it.
Latency. A scam check has to answer while Grandpa is still on the phone with the scammer: one time budget, fast answers from the rules, a late model answer kept for next time.
Multi-store checkout. One "yes" can place orders at a pharmacy and a power company, each separately signed, verified, paid and refundable.

Accomplishments that we're proud of

The whole journey works end to end on real sandbox calls: Visa Acceptance, Decision Manager, Visa Transaction Controls, a card network's real-time authorization and Kroger's live catalog.
A phone number anyone can call, with no app needed, in three languages.
The refusal is kind: it never blames Grandpa, and it always tells him the one thing to do next.
Trust is visible: every decision has a plain-English reason for the family and a public record.

What we learned

In agentic commerce, trust comes from who sets the rules and from making every "no" understandable, not from a smarter model.
Deterministic guardrails around a language model are what make it safe to hand it a wallet.
Inclusion is a design constraint, not a feature: voice first, any phone, their language.
Evaluate honestly: our numbers are strong but in-sample, and we say so.

What's next for Senior Sentinel

Run on a real issuer's card controls (Visa Transaction Controls in production) and join the Visa Intelligent Commerce pilot, so the mandate travels with the payment.
Pilot with a senior center and families, test with older adults, and add more languages.
Let several family members share caregiving, and bring in pharmacies and utilities directly.