PayBound

Demo

About

Autonomous AI agents can now settle payments directly, but current architectures place an agent’s reasoning engine and its financial authority in the same trust domain. When an agent reads untrusted text—webpages, PDFs, tool responses, or invoices—prompt injection, poisoned context, or hallucinations can manipulate the agent into signing transactions to attacker-controlled addresses or draining balances. Rather than relying on fragile heuristic prompt filters, PayBound removes the agent's vocabulary needed to express an unauthorized payment. PayBound enforces capability-based payment isolation for autonomous AI agents. The untrusted agent environment never holds private keys, never accesses signing primitives, and never specifies payment parameters. Before the agent touches untrusted input, a trusted Broker pre-authorizes and issues an unforgeable, single-use, cryptographically bound Capability object. The agent’s payment tool accepts exactly one parameter: pay(capability_id). There are no destination or amount parameters for untrusted text to manipulate. When the agent invokes the capability, the Broker validates a formal 9-clause security invariant: 1. Exact amount match (no dynamic price inflation). 2. Fixed recipient address immutability. 3. Pre-vetted resource ID matching. 4. Canonical task definition hash binding. 5. Attested sandbox workload session verification. 6. Payment request digest match. 7. Atomic single-use nonce burning (preventing replay attacks). 8. Expiration timestamp validation. 9. Global task cumulative spend budget cap. Even if an attacker achieves full prompt injection in the agent's context window, structurally zero unauthorized funds can move. PayBound settles payments over Hedera testnet via x402 and Blocky402, logs immutable audit trails to the Hedera Consensus Service (HCS), verifies enterprise spend policies inside a Chainlink CRE TEE enclave, and signs authorizations via Ledger hardware review.

How it's made

PayBound was built as a strict-mode TypeScript monorepo on Node.js 24 LTS, managed with Turborepo and pnpm workspaces. Architecture and Core Technologies: 1. Trusted Broker (apps/broker): Built on Hono with @hono/zod-validator for strict runtime boundary schema checks. It runs a deterministic state machine (ISSUED -> RESERVED -> SUBMITTED -> SETTLED / FAILED / RECOVERABLE). Nonce-burning and budget enforcement happen atomically within a single synchronous SQLite transaction (better-sqlite3), preventing time-of-check to time-of-use (TOCTOU) race conditions. 2. Isolated Sandbox & Agent Runtime (apps/sandbox): The agent executes inside a containerized environment with strict Docker iptables egress policies that drop all outbound routes to RPC nodes, wallets, and payment facilitators—only allowing an authenticated channel to the Broker. The agent loop is driven by the Vercel AI SDK (ai) using Gemini Flash (with Groq fallback), exposing a strictly single-argument tool: pay({ capabilityId }). 3. Hedera Settlement & x402 Micropayments (packages/settlement, apps/gated-content-service): We built an x402-gated resource server on Hono serving paywalled research data on Hedera testnet. Payments settle via the Blocky402 facilitator using a two-signature fee-payer model: - The Broker signs the exact HBAR transfer transaction (@x402/hedera). - Blocky402 co-signs as the gas fee-payer (account 0.0.7162784) and submits directly to consensus. - The Broker's settlement engine features two-stage reconciliation (consensus node receipt + mirror node REST polling fallback) and an idempotent startup recovery sweep for broker crash resilience. 4. Immutable Audit Trail on HCS: Every capability issuance, authorization decision, and settlement outcome is committed as a structured message to Hedera Consensus Service topics (0.0.10423726 and 0.0.10423727), verified via Hedera Mirror Nodes and HashScan. 5. Hardware Review (packages/ledger-signer): Broker payment authorizations route through Speculos, the Ledger device emulator running the native app-hedera.elf binary, performing on-device APDU screen review before cryptographic signature issuance. 6. Confidential Policy Enforcement (cre-workflow): Enterprise spend policies are evaluated using a Chainlink Runtime Environment (CRE) workflow compiled to WebAssembly via @chainlink/cre-sdk. Using handlerInTee, confidential spending thresholds are checked inside a hardware-isolated TEE enclave without exposing sensitive corporate caps to the host. Notable Engineering Highlights: - Pluggable settlement seam (createX402Submitter) in apps/broker/src/settlement.ts allowed integrating x402 and Blocky402 without modifying the Broker's core state machine or widening the agent's single-parameter interface. - Built an automated Speculos driver (global-setup.speculos.ts) that executes on-device APDU button presses over HTTP during end-to-end testing. - Live adversarial testing proves prompt injections attempting to divert payments or alter amounts fail immediately at Invariant Clause 7 without needing heuristic filters.