Agentic Payment Guard
Your study sheet for the pitch, the demo and the judges' questions. Read it top to bottom once, then use the menu to jump.
Status right now
Checked on main at commit eff09c2, 15 Nov 2026. I ran the tests myself on that commit.
| Capability | State | What you can say |
|---|---|---|
| Policy gateway rejects poisoned PDF and replay | Shown | Recorded live PostgreSQL demo runs. |
| Attack comparison through the live gateway | On main | When the gateway is connected, the panel shows the gateway's decision ID. If no gateway is connected, it uses a labelled fixture policy. |
| Owner-scoped API keys, history and review queue | API only | Gateway routes exist: /history/decisions, /history/executions, /history/review-queue. No full review UI yet. |
| GOAT Authority V1 (claim, checkpoints, recovery) | Code + tests | Hardened and tested offline. No real Testnet3 payment is recorded. |
| Qatom gateway authority V1 + HTTP client | Code + tests | The client exists. No real checkout is recorded. |
| Escrow, rolling budgets | Not built | Future work. |
1 · The parts we use, with everyday comparisons
Picture a company where a new intern buys supplies with the company card. Each part of our system has a role in that office.
AI agent
OpenAI Agents SDK. It finds products and suggests purchases. Fast and keen, but easy to trick. We assume it will be fooled.
Trusted intent
"One chair from IKEA, under $50, this week." The human decides in advance what "allowed" means.
Gateway / policy engine
Fastify server. It compares each proposal with the intent. No mood, no persuasion. The same input always gets the same answer.
HMAC capability token
Works once, for one exact payment. A stolen token pays only the approved amount to the approved seller.
PDF inspection
PyMuPDF. It finds hidden text in invoices. It flags problems, but the gate agent (policy) decides.
Audit hash chain
Each entry contains a fingerprint of the entry before it. If someone changes or removes a page, the check fails.
PostgreSQL
Two requests cannot take the same approval at the same time, so a token cannot be spent twice.
GOAT Network Testnet3
A Bitcoin-secured blockchain (chain 48816). A settlement rail with public receipts.
GOAT AgentKit + viem
Toolkits that send blockchain transfers. Only our adapter uses them, never the agent.
Qatom
catalog_search is browsing. agent_checkout is tapping to pay. A sponsor payment rail built for agents.
USD-TDN
Qatom's digital US dollar, with 3 decimal places.
MCP
Model Context Protocol. One standard plug for agents to call outside services. How we connect to Qatom.
Sentinel console
Next.js + React. Judges see intents, decisions and attacks live.
Zod
Input validation. Bad data never reaches the logic.
2 · The problem
The sector: corporate accounts payable and procurement
Companies pay suppliers by reading invoices. Attackers have always attacked that step. Now AI agents read the invoices.
Humans already lose billions to fake invoices
- Business email compromise cost US businesses $3.05 billion in 2025. It is the second-largest loss type, up from $2.77B in 2024. AI-assisted BEC alone caused more than $30M. — FBI IC3 2025, Abnormal summary
- Google and Facebook paid about $122 million (2013–2015) to a man who sent fake invoices from a spoofed supplier, Quanta. — Sophos, CyberScoop
- Arup lost $25.6 million (2024) in 15 transfers after a deepfake video call with a fake CFO. — CNN
AI agents are easier to trick
- Freysa (Nov 2024): its only rule was "never send money". A user talked it into sending 13.19 ETH (≈ $47,000), after 482 attempts. — OECD AI Incidents, The Decoder
- Grok / Bankrbot (May 2026): a prompt in Morse code made agents transfer 3B DRB tokens (≈ $150K–$200K). — OECD AI Incidents
- Hidden web prompts (July 2026): fake API docs told visiting agents to pay. — OECD, SecurityWeek
- Google found 32% more malicious pages that target agents (Nov 2025 → Feb 2026). One held a fully written PayPal transaction. — Decrypt
Money at stake: $900B–$1T in US retail by 2030, and $3–5T globally. This does not include B2B. — McKinsey
3 · Our product
Others try to make the AI smarter so it cannot be tricked. We assume it will be tricked, and we remove its ability to move money.
- Intent. A human sets the seller, item, maximum amount, asset, expiry and number of uses.
- Proposal. The agent finds a product and proposes a payment. It holds no keys, card or wallet.
- Policy. The gateway checks the exact seller, recipient, amount, asset, chain and expiry. No AI takes part. The PDF scanner only advises.
- Token. If everything matches, the gateway saves an approval and issues a single-use HMAC token for that one proposal.
- Settlement. The adapter accepts only a binding saved by the gateway, then pays through GOAT Testnet3 or Qatom.
- Audit. Each decision goes into a tamper-evident hash chain.
Payment-loop stages we focus on: Intent, Policy and Audit. Settlement is guarded; Quote is out of scope.
4 · The 3-minute pitch
Speak slowly. Pause after each number. The story has five beats.
0:00–0:40Hook: the story
"In 2013, a man in Lithuania sent fake invoices to Google and Facebook. Just PDFs, from a supplier that looked real. Employees paid them. One hundred and twenty-two million dollars.
Those were trained finance people. Today we are replacing them with AI agents that read ten thousand invoices a day, never get tired and never get suspicious.
Last year, someone built an AI with exactly one rule: never send money. It took 482 messages to talk it into sending $47,000. This May, a prompt in Morse code made two AI agents give away up to $200,000 in tokens.
Business email compromise already costs US companies three billion dollars a year, and that is with humans checking. Now give that inbox to an AI."
0:40–1:10The insight
"Everyone is trying to make the AI harder to trick. We think that is the wrong fight. You cannot patch persuasion. Prompt injection is OWASP's number-one AI risk, and there is no reliable fix.
So we asked a different question: what if it doesn't matter when the AI gets tricked?"
1:10–1:50The product
"Agentic Payment Guard works like the cheque desk at a bank.
A human sets an intent: this seller, up to fifty dollars, once, this week. The AI agent shops and proposes a purchase. It holds no keys, no card and no wallet.
Our gateway checks the proposal against the intent: the exact seller, recipient, amount and expiry. No AI is involved, only code. If everything matches, it issues a single-use token for that one payment. The payment adapter accepts nothing else.
Every decision goes into a tamper-evident audit chain.
Prompt injection can change what the agent wants. It cannot change what gets paid."
1:50–2:40Live demo
Run the demo script below.
2:40–3:00Business impact and close
"Agentic commerce could be a one-trillion-dollar US market by 2030. No CFO will hand an AI a corporate wallet without three things: limits a human sets, enforcement the AI can't bypass and an audit trail. That is the missing layer, and we built it.
The agent can be fooled. The money can't. Thank you."
5 · Demo script
- The attack. Open the Sentinel comparison panel and connect it to the gateway, so it shows a decision ID.
"Same poisoned listing, two agents. The unprotected agent changes the recipient to the attacker. Our live gateway rejects it. Here is its decision ID, and here is the hidden text that caused it."
- Poisoned invoice. Run
npm run demo:pdf"This PDF has invisible text. Our scanner flags it, but the policy rejects the proposal anyway, because the scanner is only advice."
- Replay. Run
npm run demo:replay"The attacker reuses the token. Rejected. The intent is used up. Rejected. It expired. Rejected."
- Real payment. Do this only if a Testnet3 transaction hash exists today: show it in the GOAT block explorer.
- Audit. Run
npm run demo:audit"The chain is valid. If anyone changes one record, this check fails."
6 · Judge questions and answers
Isn't this just a spending limit, like a corporate card?
Card limits check how much. We bind exactly what: seller, recipient, item, amount, asset, chain and expiry, for one use. A $49 payment to the attacker passes a $50 card limit. It fails our check.
Why not use a better model or an injection detector?
Detectors are probabilistic. Freysa had one rule and still lost. We keep our scanner, but only as advice. The final decision is deterministic code, so you cannot persuade it.
What if the attacker compromises the gateway?
Then you have a server breach, which has known defences: isolated keys, least privilege and audit. Our point is to move trust from an AI that anyone can talk to, to a small server that nobody can talk to. API keys are bound to one owner, and the audit chain detects changed records.
What if the human's intent is wrong, or the human is phished?
That is outside automatic checks, the same as a manager who signs a bad purchase order today. The review queue and the audit trail help find it.
Doesn't this kill autonomy?
The human approves rules, not each purchase: "up to $500 from these five suppliers". The agent is free inside those limits. That is how companies already manage employees.
Why blockchain and not Stripe?
The design does not depend on the rail. GOAT gives public, checkable receipts and needs no bank onboarding. Qatom is built for agents. A Stripe adapter would use the same token check.
What happens if a payment fails halfway?
We save the execution before we send anything, with checkpoints after signing and after broadcast. If the result is not clear, it is marked unknown and never retried automatically, because a blind retry can pay twice. A human reconciles it.
What is the business model?
Companies that deploy purchasing agents: procurement, accounts payable and SaaS buying. Charge per protected transaction, or per seat, as compliance middleware. Auditors and insurers will push for it.
How is this different from Visa Intelligent Commerce, Mastercard Agent Pay or Google AP2?
Those are networks that let agents pay. We are the control layer in front of any of them, owned by the business, not by the network. Do not claim detailed knowledge of their internals.
How do you know it works?
157 root tests and 166 gateway unit tests pass on the current main branch. Live PostgreSQL demos record the PDF and replay attacks. The comparison now asks the live gateway for its decision.
7 · Limitations (say them before the judges find them)
| Limitation | How to say it |
|---|---|
| No real provider payment recorded (GOAT or Qatom) | "Settlement is guarded and tested offline. We chose to prove the defence before we move money." |
| Qatom checkout not proven | "The client exists. Checkout stays off until we can bind the exact price." |
| Review queue is API only | "The owner-scoped review API exists. The reviewer UI is next." |
| No escrow, no refunds | "On-chain payments are final. Escrow is on our roadmap." |
| Limits are set per intent, not as a rolling daily or monthly budget | "Each intent has a maximum and a use count. Rolling budgets are next." |
| The scanner does not catch everything | "That is why it only advises. The policy decides." |
| Testnet only | "No real money has moved, by design." |
| GOAT AgentKit pulls in a vulnerable Zod 3 (high advisory) | "No upstream fix exists. We expose only the native transfer action, and we document it." |
| PyMuPDF is AGPL-3.0 | "Fine for open source. A commercial product needs a licence or a replacement." |
8 · Submission answers
Pitch: what problem do we solve? (≈140 words)
AI agents now have wallets and payment credentials, which makes them a direct target. An attacker can hide instructions in an invoice, a PDF or a product listing. When the agent reads that content, it can change the recipient or raise the amount. If the agent holds the keys, the attacker gets the money. Agentic Payment Guard removes payment authority from the agent. A human sets a trusted intent: seller, maximum amount, expiry and single use. The agent can only propose a payment. A deterministic gateway, not an AI model, checks each proposal against the intent. It then issues a single-use token that only the payment adapters accept. Prompt injection can change what the agent proposes, but it cannot change what gets paid. Our prototype focuses on Intent, Policy and Audit, with a hash-chained log of each decision. Settlement through GOAT and Qatom is guarded but not yet complete.
Dependencies and licences
Rails: GOAT Network Testnet3 (public network) · USD-TDN (proprietary)
APIs: Qatom MCP API (proprietary) · OpenAI API (proprietary)
Libraries: @goatnetwork/agentkit (no licence declared) · viem, @modelcontextprotocol/sdk, @openai/agents, Next.js, React, Fastify, pg, Zod, Vitest, ESLint (MIT) · dotenv (BSD-2-Clause) · PyMuPDF (AGPL-3.0) · ReportLab (BSD) · TypeScript (Apache-2.0)
Infrastructure: PostgreSQL (PostgreSQL Licence) · Node.js (MIT) · Python (PSF)
Final checklist
- Make sure
mainon GitHub has the latest work. The judges read the public repository. - Record the backup demo video.
- Connect the console to the gateway so the comparison shows a real decision ID.
- Practise the hook out loud twice. The $122M line and the "never send money" line do most of the work.
- Check for a Testnet3 transaction hash. No hash means no payment claim.