VANTA AI — The Trust Layer for Agentic Commerce
Inspiration
AI agents are evolving beyond answering questions. They can research products, compare options, make decisions, and increasingly interact with real-world services. But as agents gain more autonomy, an important question emerges: How do we let AI act on our behalf without losing control over what it does?
In commerce, a seemingly simple purchase can involve multiple decisions: finding the right option, evaluating its risks, checking whether it complies with our preferences, and deciding whether a transaction should be authorized. Giving an AI agent unrestricted access to these decisions creates potential risks around spending, policy violations, and accountability.
We wanted to explore a different approach: instead of choosing between fully autonomous AI and constant human supervision, what if we could combine intelligent automation with explicit boundaries, transparent decisions, and meaningful human control?
That idea inspired VANTA AI — The Trust Layer for Agentic Commerce.
Our vision is simple: let AI agents handle the complexity while people retain control over the decisions that matter.
What it does
VANTA is a trust and governance layer for AI-powered purchasing.
AI agents can discover products and recommend purchases, but giving an agent unrestricted authority to spend money introduces real risks: overspending, unsuitable products, untrusted sellers, incomplete evidence, and transactions that violate user intent.
VANTA addresses this problem by placing a policy-enforcement layer between an AI agent's recommendation and the payment workflow.
A purchasing mission moves through six stages:
- Discover: Find product offers relevant to the user's request.
- Assess: Evaluate product requirements, seller trust, available evidence, and transaction risk.
- Optimize: Compare eligible alternatives against cost, compatibility, budget, delivery, and seller criteria.
- Govern: Apply explicit purchasing policies before any transaction proceeds.
- Authorize: Require human approval when the applicable rules demand it.
- Transact: Route eligible, authorized purchases through PayPal Sandbox.
The key distinction is that an AI recommendation does not automatically authorize a payment. VANTA evaluates the proposed action against defined rules before allowing the workflow to continue.
A purchase can proceed, require approval, or be blocked. The goal is to make autonomous commerce useful without making it uncontrolled.
How we built it
VANTA combines a web application, AI-assisted product evaluation, policy enforcement, and PayPal's developer platform.
AI and product discovery: Google's Gemini API interprets the user's purchasing request into structured requirements (budget, category, compatibility needs, delivery constraints) and supports the product-evaluation workflow by assessing candidate offers against those requirements. Channel3 supplies product and offer data, including pricing, seller information, and availability, which VANTA uses to compare candidate purchases.
Policy enforcement: VANTA evaluates proposed purchases against configured constraints, including spending limits, seller restrictions, risk thresholds, evidence requirements, and human-approval conditions. The policy decision determines whether a proposed action can proceed; an AI-generated recommendation alone cannot override these rules.
PayPal integration: PayPal Sandbox provides the test payment environment. VANTA authenticates with OAuth 2.0 client credentials and uses the Orders API (v2) to create orders and capture payment after approval. The payment workflow is connected to the governance decision, so only eligible, authorized actions reach the create-order or capture step.
User experience: Built with Next.js, React, and TypeScript, the interface presents the purchasing mission, candidate offers, evaluation results, policy outcomes, and approval requirements in a unified command-center experience.
The main engineering challenge was balancing autonomy with control. VANTA separates product recommendation, policy evaluation, authorization, and payment status so that each stage has a distinct responsibility.
Our objective is not to give AI unrestricted purchasing power. It is to make AI-driven commerce auditable, bounded, and accountable.
System Architecture
VANTA follows a layered architecture that separates AI-driven product intelligence from financial authorization. The system consists of six major layers: Presentation, Application Backend, AI & Product Intelligence, Trust & Governance, PayPal Payment Integration, and Data & Audit.
Architecture Components
1. Presentation Layer: Provides the command center where users create purchasing missions, inspect product offers, review policy decisions, and respond to approval requests.
2. Application Backend: Coordinates mission execution, manages application requests, and maintains mission and transaction state.
3. AI & Product Intelligence: Uses the configured AI service to interpret purchasing requests and support product discovery, offer evaluation, compatibility assessment, and ranking. Channel3 provides product information where integrated.
4. Trust & Governance Layer: Applies deterministic purchasing policies covering spending limits, seller restrictions, risk thresholds, evidence coverage, and human approval requirements. The AI layer cannot independently override these policies.
5. PayPal Payment Integration: Connects authorized purchases to PayPal Sandbox through the implemented authentication, order, checkout, and capture workflow.
6. Data & Audit Layer: Maintains mission information, policy decisions, approval events, and transaction outcomes for traceability, according to the implemented storage functionality.
End-to-End Workflow
- The user creates a purchasing mission with product requirements, quantity, and budget.
- The backend coordinates the mission and invokes the AI-assisted discovery workflow.
- Candidate products are retrieved and evaluated against the requested requirements.
- VANTA's governance engine evaluates the proposed purchase against configured policies.
- The system blocks violations, requests human approval when required, or authorizes eligible purchases.
- Authorized purchases proceed through the PayPal Sandbox payment workflow.
- The resulting payment status is reflected in the application and recorded where supported.
Core Design Principle: AI recommends what to purchase, VANTA determines whether the purchase is permitted, and PayPal processes the authorized payment.
Challenges we ran into
One of the biggest challenges was balancing autonomy with safety.
An agent that requires approval for every minor step can become frustrating to use. On the other hand, an agent that can freely execute consequential actions may act outside the user's expectations. Designing the right boundary between these extremes is a core challenge of agentic commerce.
We approached this by making governance and authorization explicit parts of the workflow rather than treating them as optional additions.
Another challenge was making the system understandable. Agentic workflows can involve multiple decisions, checks, and handoffs. Presenting these processes clearly without overwhelming the user requires careful interaction design.
Payment integration introduces another important consideration: a recommendation is not an authorization, and an authorization is not proof that a payment succeeded. These stages need to remain distinct, with appropriate safeguards and clear transaction status.
Finally, building a coherent product under hackathon constraints required prioritization. We focused on the core trust workflow and how its components fit together, while identifying more advanced automation and governance capabilities as areas for further development.
Accomplishments that we're proud of
We are proud of turning a broad question about AI autonomy into a concrete product direction: a trust layer designed specifically for agentic commerce.
Our key accomplishments include:
- A governance-first approach: Trust is part of the agent workflow, not an afterthought.
- A structured decision journey: Discovery, assessment, optimization, governance, authorization, and payment form a coherent process.
- Human control by design: The concept preserves a meaningful authorization step for consequential actions.
- A payment-oriented architecture: VANTA connects agent decision-making with the practical requirements of commerce and PayPal integration.
- A product-focused experience: We are treating transparency and usability as core parts of the solution, not just visual polish.
Most importantly, VANTA represents a shift in how we think about AI agents. The objective is not maximum autonomy at any cost. It is useful autonomy that operates within clear, understandable boundaries.
What we learned
Building VANTA reinforced that intelligence alone is not enough to make an autonomous system trustworthy.
A useful agent must understand the user's objective, but a trustworthy agent must also respect constraints, explain its decisions, recognize when approval is necessary, and communicate what actually happened.
We also learned to think about the complete lifecycle of an action. Finding an option, recommending it, passing policy checks, receiving authorization, and completing a payment are different events. Treating them as interchangeable can create confusion and undermine trust.
Another important lesson was that safety and user experience should be designed together. Governance that is invisible can be difficult to understand, while governance that creates unnecessary friction can make automation less useful. The challenge is to provide the right amount of visibility and intervention at the right time.
These lessons shaped our central belief: the future of agentic commerce depends not only on what AI can do, but also on how reliably we can govern what it does.
What's next for VANTA AI — The Trust Layer for Agentic Commerce
We see VANTA as a foundation for a broader trust and governance platform for autonomous transactions.
Our next steps include:
- Configurable user policies: Allow users to define spending limits, permitted merchants, purchase categories, and other constraints.
- Risk-aware authorization: Determine when an action can proceed automatically and when additional approval should be required.
- Explainable decisions: Show users why an option was selected, which policies were evaluated, and what influenced the outcome.
- Stronger auditability: Build a traceable record of agent decisions, policy evaluations, authorization events, and payment outcomes.
- More robust agent orchestration: Support more complex tasks involving multiple agents, services, and decision stages.
- Expanded payment workflows: Further develop PayPal integration, including reliable handling of payment states, failures, and verification events.
- Broader commerce applications: Explore how the same governance approach could support procurement, recurring purchases, business expenses, and other agent-driven transactions.
Our long-term vision is to make VANTA a reusable trust layer that sits between AI intent and real-world action—helping users and businesses adopt agentic commerce without giving up visibility, control, or accountability.
VANTA AI: Let agents act. Keep humans in control.
Built With
- agentic
- agents
- ai
- api
- artificial
- development
- enforcement
- fintech
- generative
- human-in-the-loop
- integration
- intelligence
- management
- next.js
- paypal
- policy
- react
- risk
- safety
- sandbox
- security
- transaction
- typescript
- web
