Inspiration
AI agents can now find products and start payments, but "ask before you buy" in a prompt is not an enforceable boundary. A page the agent reads can talk it into proposing a payment you never wanted. We wanted a layer where the agent can only ask, and something deterministic decides.
What it does
TrustGate sits between an AI agent and PayPal. The agent sends only references (merchant, product, quantity). The server resolves the price, payee and category from its own registry, evaluates your spending policy, and returns one of three results: ALLOW (the PayPal Sandbox order is created and captured), APPROVAL_REQUIRED (held until a signed-in human approves the exact facts), or BLOCK (PayPal is never called). Every step goes into a hash-chained audit trail. A scanner flags hidden payment instructions in pages the agent read, and flags can only tighten a decision, never loosen it.
How we built it
Python and FastAPI. PayPal Orders v2 (Sandbox) with a vaulted payment token, PayPal-Request-Id idempotency, and read-back verification of every order and capture against the facts we evaluated. A server-rendered console for approvals and audit, and a public sign-in-free playground at /try where a judge can write their own poisoned page, change the rules, and try to cheat as the agent. Plain-English spending rules are drafted by a model, validated by code against the registry and hard limits, and activated by a human. Approvals are bound to merchant, payee, amount, currency and policy version, and budget is reserved while a request is held. 215 automated tests. Deployed on Render.
Challenges we ran into
Keeping the agent untrusted: approvals bind to merchant, payee, amount, currency and policy version, and are refused if any change. PayPal quirks: all mock merchants pay one Sandbox business account, so the logical payee travels in custom_id and is verified on read-back.
Accomplishments that we're proud of
A live Sandbox check on 6 Oct completed two payments ($180 allowed, $320 after human approval), re-read both from PayPal, and confirmed that the held and blocked requests created no order. The audit chain verified.
What we learned
Treat the model as an untrusted proposer. The useful question is not "can we detect the attack" but "what can a fooled agent actually do".
What's next for TrustGate
PayPal webhooks, a database for intents and approvals, multi-user accounts, and measured red-team results on real models.
