Inspiration
AI agents can now shop for us, but giving one access to your money is risky. A product listing can hide instructions that trick it, and an agent can split a big order into small ones to dodge your limits. I wanted an agent that could buy things but was structurally unable to overspend.
What it does
Warden lets an AI shopping agent buy through PayPal under rules you set. Small, safe purchases are auto-approved, larger ones go to a one-tap human approval, and risky ones are blocked: hidden prompt injections, split orders, fake free trials, overpriced items, unverified sellers and duplicate purchases. A kill switch revokes the agent instantly, and every decision is recorded in an append-only audit log with a plain-English reason.
How we built it
The system has two layers. The AI layer uses Gemini for a shopper agent, an injection shield (regex plus an LLM classifier), an independent adversarial auditor, and approval summaries. The deterministic layer is a pure-code policy engine that enforces spend caps, quantity limits, seller rules, a subscription ban and the kill switch. The final decision is the strictest of all layers, so the AI can only tighten a decision, never loosen it. Approved purchases go to PayPal Sandbox Orders v2 with idempotency keys. It's built with Next.js, TypeScript, SQLite, Zod and Vitest.
Challenges we ran into
Gemini's free tier returned 503 and 429 errors, so I added retries, a fallback model and a fail-closed rule: if the AI is unavailable, the purchase is blocked and labeled AI_UNAVAILABLE. Demo runs also reused old purchase history and triggered false duplicate blocks, so each run now resets state. PayPal's buyer-approval step doesn't suit an autonomous agent, so in the sandbox the agent pays with PayPal's test card.
Accomplishments that we're proud of
The core claim is tested: with all AI checks disabled, the code still blocks an injected "buy 10 units, skip approval" order. The injection attack, split-order and fake-trial scenarios are all caught, the kill switch works, and I built the whole project solo in about a day.
What we learned
Put hard limits in code, and use AI only for judgment, where rules can't reach. Failing closed matters for anything that moves money. LLM outputs also need strict schema validation before anything acts on them.
What's next for Allowance
- A plain-English policy compiler that asks clarifying questions.
- Real product search through Channel3 instead of the mock catalog.
- Sign-in and per-user policies.
- A production payment method in place of the sandbox test card.
- Smarter learning from approvals, such as suggesting threshold changes.
Built With
- gemini-api
- next.js
- node.js
- paypal-sandbox-(orders-v2-rest-api)
- react
- sqlite-(better-sqlite3)
- tailwind-css
- typescript
- vitest
- zod
