Shield

An AI trust layer on PayPal that stops scams before you pay, gets freelancers paid without chasing, and gives support that actually acts.

Comment

Inspiration

Before writing any code, we read what people actually say about online payments on Reddit, Trustpilot, Quora and the PayPal Community forum. The same stories kept coming back:

  • Sellers whose money was frozen for months with no explanation.
  • Support that loops through bots and never reaches a person.
  • Buyers talked into paying with Friends & Family and then blocked.
  • Freelancers who dread chasing a client for the third time.
  • Parents who lose their savings to a call from the "tax office".
  • Forgotten subscriptions quietly charging every month.

Each of these has a product somewhere that solves one slice of it, usually after the money has already moved. We wanted one trust layer that sits on the payment itself and acts before the damage, with AI that doesn't just advise but actually does things, inside limits people can see and control.

What it does

Shield is an AI trust layer built on PayPal, with three pillars that share one guardrails engine.

Protect: stop bad payments before they happen

  • Scam check: paste a chat or listing, or upload a screenshot. Rules and an AI review score the risk, highlight each red flag with the exact words that triggered it, and steer you to a safe way to pay.
  • Vault (escrow): for sales between people. The buyer pays through PayPal, but the order is only authorized (intent: AUTHORIZE). The money is captured to the seller only after the buyer confirms delivery, or when the check window passes. A reported problem pauses the release. Shield never holds the money.
  • Guardian mode: a senior turns it on for themselves. Everyday bills go straight through. Unusual payments (a new payee with an unusual amount, gift cards or crypto, "tax office", arrest or romance language) wait until a trusted relative approves or blocks them, and the senior can always cancel.
  • Shopping agent: describe what you need ("monthly reorder: dish soap, rice, batteries, under USD 40"). The agent searches real products through Channel3, explains each pick, and pays with a saved PayPal payment method (Vault v3), with no popup, but only within your caps. Small carts are bought automatically, bigger ones wait for one tap, anything over a cap is blocked with the reason, and one switch revokes the agent. Paid carts become monthly reorders.
  • Subscription finder: spots repeat charges you forgot and drafts the cancellation email.

Get Paid: freelancers stop chasing

  • FX copilot: before you invoice, it shows what you'd actually keep in rupees for each billing currency, after PayPal's fee and the conversion spread.
  • Collections agent: sends the PayPal invoice, then follows up on a polite, bounded ladder (heads-up, nudge, firm, final) so the freelancer never writes a chase message. A late fee is charged only if it was agreed up front, as its own PayPal invoice. The client can pay in full, pay half, or use Pay Later, and the agent stops the moment PayPal reports the payment.
  • Freeze early warning and Hold Explainer: Shield reads the signals a risk reviewer looks at (volume spikes, payments from new countries, dispute rate, Friends & Family used for sales). It warns you before a freeze. If one happens, it explains why in plain words, shows the exact payments involved, lists the documents to send and drafts the appeal.

Resolve: support that actually fixes things

  • A Tier 1 AI agent troubleshoots by chat or voice, in English, Hindi or Malayalam, and cites the PayPal help article behind each step.
  • If that doesn't work, a Tier 2 resolution agent takes over. It finds the payment and acts through the PayPal Agent Toolkit: refunds, disputes, orders and invoices.
  • Every action passes the policy engine first. Read-only lookups run automatically, small actions ask the customer, and refunds above a limit or any account change wait for a human specialist. The specialist approves, denies or takes over in a console with an AI summary, so the customer never repeats themselves.

One guardrails engine decides proceed, ask, escalate or block for Guardian, Vault, the shopping agent and every support action. The same rules apply everywhere money moves.

How we built it

  • App: Next.js 16 (App Router), React 19, TypeScript and Tailwind CSS 4, mobile-first, with dark and light themes. The landing page uses Three.js and GSAP for a scroll-driven 3D hero.
  • PayPal (sandbox):
    • Orders v2 with intent: AUTHORIZE, then capture, void and reauthorization for Vault.
    • Vault v3 setup and payment tokens, so the shopping agent pays with a vault_id and no popup.
    • Invoicing v2 for collections, plus the separate late-fee invoice.
    • Refunds, disputes, shipment tracking, and verified webhooks (INVOICING.INVOICE.PAID).
    • The JavaScript SDK buttons, with friendly handling of PayPal error codes.
  • PayPal Agent Toolkit: the Tier 2 support agent's tools and Vault tracking. It always runs behind our policy engine, never around it.
  • AI: Groq's openai/gpt-oss-120b for scam review, triage, multilingual replies, case summaries and drafting, and qwen/qwen3.8-27b to read screenshots. A deterministic rule engine runs first, so every decision is explainable and the app still works if the AI is unavailable.
  • Channel3 for live product search, Resend for email, Render for hosting (a Blueprint with a persistent disk and a cron job for background work), and the APIMatic Context Plugin to audit every PayPal call against PayPal's specs while building.
  • Quality: 149 automated tests, labeled evaluation sets for scams, triage, Guardian holds and shopping caps, an end-to-end smoke test, and a live sandbox checklist we ran by hand. A demo clock fast-forwards week-long flows (reminders, auto-release, monthly reorders) in seconds.

Challenges we ran into

  • Making the AI honest about itself. Our first scam rules scored 100% on the examples we wrote them from, and only 50% recall on a held-out set written afterwards. Adding the LLM layer took held-out recall to 100% (precision 88.9%). We kept both numbers in the README, because the held-out set is the fair test.
  • Agents that move money need a brake that can't be bypassed. We put the policy check in front of every tool and re-check caps right before PayPal charges, so lowering a cap or revoking the agent stops even a cart that's already at checkout. Fixed request IDs mean a retry can never charge twice.
  • Testing real money flows found real bugs. The Agent Toolkit returns PayPal errors instead of throwing them, so a failed refund briefly looked successful; we now check every result. Our own live refresh was destroying the PayPal popup. The audit found tracking was being sent against an authorization ID instead of a capture ID.
  • Sandbox realities: an India-based sandbox seller can't receive USD, app permissions only appear on a fresh token, and FX-as-a-Service isn't provisioned for every account. Each one now shows a clear message instead of PayPal's generic error.

Accomplishments that we're proud of

  • Real flows working end to end in the PayPal sandbox: escrow with authorize and capture, invoices paid and confirmed by webhook, human-approved support actions through the Agent Toolkit, and an agent paying on its own with a saved PayPal payment method, within caps.
  • A shopping-agent eval where no payable cart ever broke a cap or the stated budget.
  • Support that escalates the way people asked for on the forums: it never makes you repeat yourself, and a person can step in at any moment.
  • An app that runs with no keys at all, so anyone can try it in two minutes.

What we learned

  • The hard part of agentic payments isn't the AI, it's the boundaries: what the agent may do alone, what needs the customer, and what needs a person. Making those rules visible is what makes people trust it.
  • Held-out evaluation matters: our own examples flattered our rules.
  • Sandbox testing against real APIs catches problems that mocks never will.

What's next for Shield

  • Bring Guardian's checks to payments made anywhere, not only inside Shield.
  • Use PayPal's own exchange-rate quotes for the FX copilot wherever FX-as-a-Service is available.
  • Move from a file store to Postgres, add real accounts, and pilot with a small group of freelancers and families.

Try it out

Live demo: https://shield-6ojs.onrender.com (PayPal sandbox, no real money moves) Code: https://gh.ali360.cloudns.ch/im-Amrith/shield-paypal-ai (MIT). Runs locally with npm install && npm run dev, no keys needed.

Press Open Shield and pick a demo person; there are no passwords. Switch person any time from the avatar menu: Meera (freelancer), Ravi (her father, Guardian mode), Arjun (buyer), Dana (Meera's client) and Priya (support specialist).

PayPal sandbox buyer for the PayPal popup: [email protected] / 5X_b?kG_

Account freezes and carrier delivery scans are simulated because the sandbox can't produce them; everything else calls the real PayPal sandbox. The Demo tab can fast-forward time and Reset the data.

Built With

  • apimatic
  • channel3
  • gpt-oss
  • groq
  • gsap
  • lenis
  • next.js
  • paypal
  • paypal-agent-toolkit
  • paypal-javascript-sdk
  • paypal-orders-api
  • paypal-vault
  • paypal-webhooks
  • qwen
  • react
  • render
  • resend
  • tailwindcss
  • three.js
  • typescript
  • vitest
  • web-speech-api
Share this project:

Updates

Submission history