Spendlatch: a payment firewall for AI agents

Inspiration

AI agents are starting to shop and pay on our behalf. Giving an agent a payment credential is all-or-nothing trust, and agents read untrusted pages: a hidden instruction on a web page can steer a payment. We wanted a layer between the agent and the money, so the agent never holds PayPal credentials and every payment is checked before it moves.

What it does

Spendlatch is an open-source payment firewall for AI agents (PayPal sandbox only). An agent sends a payment intent, and Spendlatch approves it, denies it, or asks a human. Each intent passes:

Idempotency: retries and loops cannot double-pay.
Mandate rules: payee allowlist, per-payment cap, currency and time window (deterministic).
Atomic budget reservation in Redis: parallel requests cannot overspend.
Canary scan: a deliberately gullible model with fake tools. If it calls one, the page contained an injection (LLM-based).
Risk judge: an LLM compares the payment with the user's original request, not just the page text (LLM-based).
Human approval: escalated payments appear live in the operator console.
Settlement and audit: approved payments are paid through PayPal Payouts and confirmed by verified webhooks. Every step is written to a hash-chained audit log.

If an LLM layer fails, the firewall fails closed.

Try it

The Judge Playground runs the real pipeline. Pick an attack or write your own poisoned page, switch protections on and off, watch what each layer decided, and approve or reject escalations. Playground payments are forced to dry run and never reach PayPal. If the free-tier server is asleep or the demo quota is used up, the page switches to recorded real outputs. A sample operator console is also available.

How we built it

FastAPI, PostgreSQL as the source of truth, and Redis with Lua scripts for atomic budget reserve, commit and release. The dashboard is Next.js with AG Grid and live WebSocket updates. PayPal usage: Payouts API, OAuth, webhook signature verification through PayPal's verification API, and the idempotency key reused as the payout request ID. AI usage: the demo shopping agent, the canary and the judge call configurable OpenAI-compatible LLM providers (Gemini and Groq free tiers). We also added an MCP server so agents can call the firewall as a tool, plus Docker, GitHub Actions and Render.

What we measured

We split scenarios into dev and test, tuned only on dev, froze the configuration with a git tag, and ran the test split once. On the test split (counts, small samples):

Out-of-policy attacks (6 intents): all 6 were denied by deterministic rules before any AI layer ran.
In-policy attacks (6 intents): rules alone approved all 6. The risk judge stopped 2 (a wrong-item purchase) and did not stop the 4 payee reroutes between two allowed sellers.
Approval-required payees: a deterministic control escalated all 6 by construction, because the test mandate marks the attack payee as requiring approval. The cost is that every legitimate payment to that payee also needs a human.
Legitimate purchases: 0 of 2 wrongly stopped on clean pages and 0 of 9 on pages containing injections.

Full protocol, deviations and per-scenario outcomes are in the repo.

Challenges

Our first benchmark was wrong. A stale-mandate bug made a failed run look like a defense success. We found it, archived the results as invalid, and re-ran.
A labeling bug counted correct refusals as false positives. We fixed the classification and recorded it as a deviation in the protocol.
Free-tier LLM quotas produced errors that look like detections. We excluded fail-mode outcomes from every rate and made the harness stop and resume instead of recording them.
An allowlist is not intent. Our judge first treated an allowed payee as proof the payment was wanted.

What we learned

Allowed does not mean intended: an AI judge alone missed reroutes between allowed payees, and a deterministic approval-required rule was the reliable fix. Small, honest numbers with the sample size next to them beat large unsupported ones.

Limitations and what's next

Spendlatch is a sandbox-only, single-tenant prototype. LLM detection is probabilistic, our evaluation samples are small, and free hosting can take up to a minute to wake. Next: a larger evaluation, anomaly detection on spending patterns, signed mandates, and the PayPal Orders flow.