SENTINEL — Proof-of-Execution for Financial AI
Inspiration
AI agents are increasingly capable of initiating financial actions, but what happens when an agent makes a false claim, follows a malicious instruction, or attempts an unauthorized transaction?
Traditional security often focuses on authentication and API access. SENTINEL focuses on a different question:
Can we verify that an AI agent is authorized to perform a specific financial action before that action executes?
We built SENTINEL to make financial AI systems safer, more transparent and accountable.
What It Does
SENTINEL is an AI transaction firewall designed to sit between AI agents and PayPal operations.
Its core capabilities include:
- Pre-Action Security Gateway: Evaluates proposed actions against permissions, transaction limits, currency restrictions and human approval requirements.
- Trust Engine: Agents earn higher permission levels through verified safe behavior. Harmful actions can revoke those permissions.
- Independent Claim Verification: Compares agent claims against recorded transaction state to detect contradictions.
- Attack Lab: Demonstrates defenses against prompt injection, unauthorized refunds and attempts to bypass security controls.
- Financial Time Machine: Replays simulated scenarios to illustrate financial outcomes with and without SENTINEL.
- PayPal Sandbox Integration: Provides sandbox-only, gateway-controlled transaction operations and read-only transaction verification.
How We Built It
SENTINEL uses Python, a security-focused tool gateway, a browser-based dashboard, PayPal Sandbox APIs and an OpenAI model integration.
The architecture separates the public simulation dashboard from private PayPal operations.
Every proposed financial action is evaluated against security rules before execution. Sensitive operations require explicit human authorization, while unsafe requests are denied or escalated.
The system also includes an independent verification layer and an earned-permissions model based on observed behavior.
Challenges We Faced
The biggest challenge was ensuring that an AI agent could not bypass financial safety controls.
We addressed several risks:
- Non-finite transaction amounts, including NaN and Infinity
- Nested foreign-currency values
- Invalid quantities and negative prices
- Unauthorized refunds and excessive transaction amounts
- Prompt injection and false claims of successful payments
- Preventing private credentials from entering public builds
Another challenge was making the project publicly demonstrable without exposing credentials or enabling real financial operations.
We solved this by creating a separate, read-only public simulation experience.
Accomplishments
- 504 offline automated tests passed, with one live test skipped in the offline suite
- 16/16 simulated Attack Lab scenarios stopped
- Verified fail-closed behavior for unsafe transaction inputs
- Gateway-controlled PayPal Sandbox write path
- Successful user-executed PayPal Sandbox OAuth and read-only Transaction Search verification
- Public Docker-based demonstration deployed on Render
- MIT-licensed public GitHub repository
What We Learned
We learned that financial AI safety requires more than trusting an agent's output.
Security decisions must be independently enforced, permissions should be earned and revocable, and financial claims should be checked against transaction evidence.
We also learned the importance of separating simulation, recorded evidence and live integration when presenting an AI-powered financial application.
What's Next
Our next goals are to integrate live model-generated proposals with the gateway-controlled PayPal execution path, expand adversarial testing, improve transaction observability and develop stronger deployment-ready controls for real-world financial workflows.
Try SENTINEL
Interactive Demo: https://sentinel-ai-firewall-g6zl.onrender.com/
GitHub: https://github.com/kavitharachel/sentinel-ai-firewall
Demo Video: https://youtu.be/RQdW3VtAIEI
Evidence Transparency
The hosted dashboard is a simulation. PayPal and LLM evidence displayed within it is recorded, not executed live during a visitor's session. The public demonstration cannot initiate PayPal transactions.
SENTINEL is a prototype, not a production financial security system.## Inspiration
