PAYPAL AI HACKATHON 2026 · TRUST & POLICY FIREWALL FOR AGENTIC COMMERCE
Give AI permission to act — without giving it unlimited authority.
IntentShield converts human intent into enforceable payment policy, evaluates every AI-proposed transaction against it deterministically, and only lets authorized payments reach PayPal.
01 / MANDATE CONSOLE
Turn intent into authorization.
Describe what an AI agent may buy on your behalf. IntentShield's AI drafts a structured interpretation of your intent — you review it, correct anything, and confirm it. Nothing is authorized until you do.
NEW MANDATE
Natural language in, structured draft out. The AI interprets; authorization stays with you.
MANDATES
02 / AGENT & EXECUTION
The agent proposes. Policy decides.
Pick an ACTIVE mandate and describe what to buy. The AI agent proposes by SKU only — deterministic code composes the transaction, and the policy engine decides before anything can reach PayPal.
AGENT BRIEF
A real AI shopping agent, proposing against a controlled catalogue under your authorization.
RESULT
No proposal yet
Run an agent search to see a proposal, its policy evaluation and its execution path.
LIVE MARKET — POWERED BY CHANNEL3
ADVISORY · READ-ONLY · NOTHING PAYSGround the request in the real live market — Channel3's product graph covers 100M+ products across thousands of real merchants with live prices. Every offer below is judged by the same deterministic policy engine against the selected mandate. Nothing is persisted, nothing executes, and nothing here can ever reach PayPal.
Live market grounding
Search any product and watch the same policy engine judge real live-market offers — merchant allowlists, amount ceilings, currency and condition rules, applied to the real world.
Channel3's merchant checkout is coming soon — external retailers are not payable through this prototype. The controlled catalogue remains the agent's only payable world, and PayPal execution stays guarded there. This market check is advisory: no transaction record is created.
03 / ADVERSARIAL LAB
Ten attacks. One wall.
Every scenario runs the REAL pipeline — deterministic composition, the same policy engine, the same guarded executor. No mocks. Outcomes land in the activity ledger.
No scenario has run yet
Run any scenario — its attempts, fired rules and PayPal outcome will appear here.
Fixture mandates are system-owned and clearly labeled (ADVERSARIAL LAB FIXTURE). Re-running a scenario cancels its previous still-live transactions — outcomes stay comparable, history is preserved.
04 / ACTIVITY LEDGER
Every action, on the record.
The append-only activity ledger — every proposal, decision, human review and PayPal leg, newest first. Click any row for its full Payment Intent Record.
CLICK A ROW FOR ITS PAYMENT INTENT RECORD
05 / POLICY CHAIN
One request, five checkpoints
Every AI payment action passes through the same guarded pipeline before any money moves.
USER INTENT
Natural-language spending mandate becomes structured policy.
PHASE 2AGENT PROPOSAL
AI searches the catalogue and proposes a transaction.
PHASE 3POLICY EVALUATION
Deterministic engine returns ALLOW, REVIEW or BLOCK.
PHASE 4PAYPAL EXECUTION
Guarded server-side Orders v2 call. Browser never holds credentials.
PHASE 5AUDIT RECORD
Immutable, human-readable trail of the whole chain.
PHASE 6
DECISION SEMANTICS
06 / TRUST BOUNDARY
What the model may never touch
External content can be reasoned about. It can never acquire authority.
TRUSTED
User mandate — the human's actual authorization
System policy — deterministic rules, versioned
Server-side executor — the only path to PayPal
UNTRUSTED
Merchant descriptions — arbitrary third-party text
Product metadata — prices, categories, claims
Model-generated reasoning — suggestions, not authority
Agent suggestions — proposals, never authorization
PROMPT-INJECTION DEFENCE: malicious text inside product data cannot modify the mandate, the policy, or execution privileges.
07 / POLICY RULES
Sixteen deterministic rules
The engine has zero LLM dependency. Every decision carries explicit, machine-readable reasons.
| CODE | RULE | OUTCOME |
|---|---|---|
| R-01 | Amount ceilingTotal exceeds the mandate maximum | BLOCK |
| R-02 | Shipping ceilingShipping exceeds the mandate maximum | BLOCK |
| R-03 | Currency mismatchCurrency differs from the mandate currency | BLOCK |
| R-04 | Recurring chargeSubscription/recurring charge where the mandate forbids it | BLOCK |
| R-05 | Condition violationRefurbished item where the mandate requires new | BLOCK |
| R-06 | Category restrictionCategory outside allowed list or on blocked list | BLOCK |
| R-07 | Merchant restrictionMerchant outside allowed list or on blocked list | BLOCK |
| R-08 | Quantity limitQuantity exceeds mandate maximum | BLOCK |
| R-09 | Mandate expiredMandate validity window has elapsed | BLOCK |
| R-10 | Mandate not yet validBefore the mandate validity window | BLOCK |
| R-11 | Missing fieldCritical transaction field absent or malformed | BLOCK |
| R-12 | Duplicate executionSame transaction already executed (idempotency) | BLOCK |
| R-13 | Untrusted metadataSuspicious external signals (e.g. injected instructions) | REVIEW |
| R-14 | Structural inconsistencyTransaction shape inconsistent with the mandate | BLOCK |
| R-15 | Approval modeMandate requires human review of every transaction (MANUAL_REVIEW) | REVIEW |
| R-16 | Mandate not activeMandate is not in ACTIVE status (e.g. revoked or draft) | BLOCK |
08 / SYSTEM STATUS
Integration state, honestly reported
IntentShield never fakes a PayPal response. Unconfigured means unavailable.