Product Build 17 / 19
Mendate Kernel: AI can propose a purchase. It shouldn’t control the money.
Security layer for AI-agent payments.
Explore the ProjectAboutMendate Kernel is a deterministic authorisation layer for AI-driven payments. It checks every proposed transaction against signed spending mandates, policy rules, catalogue data and limits before a payment can start, so a compromised or unreliable AI model cannot spend on its own.
- Client
- Mendate Kernel
- Industry
- AI security, fintech & payments
- Role
- AI safety & security engineering
- Type
- AI-agent payment security kernel
Project overview
A policy enforcement layer for agentic payments.
- Project
- Mendate Kernel
- Industry
- AI security, fintech, payment infrastructure
- Services
- AI safety engineering, payment authorisation, back-end architecture, security engineering
- Technology
- Python 3.11+, FastAPI, Pydantic, SQLite, hybrid Ed25519 and ML-DSA-65 signatures, Razorpay (test mode)
- Team
- Ishwra, with technical partner Jiyad Hussain
- Clients
- Not disclosed (confidential)
- Deployment
- A local Python package and API, with a demo that runs without API keys or a network connection
Once an AI agent can buy things, its mistakes and manipulations cost real money. Mendate Kernel separates planning a purchase from authorising it: the model proposes, the kernel evaluates, and only an approved decision reaches the payment executor.
The challenge
What happens when an AI agent can spend real money?
An agent can be steered by malicious instructions, wrong product data, invented prices, swapped products or repeated requests. If the same model proposes and approves its own purchases, one failure becomes a financial incident.
Untrusted model output
The model must not set the amount it spends, or approve itself.
Unauthorised transactions
Every purchase must fit a signed mandate and explicit limits.
Replay and concurrency
Retries or identical simultaneous requests must not double-charge or slip past cumulative limits.
Tampering and accountability
Operators need a verifiable record in which changes are detectable.
The aim was to make these guarantees structural, not dependent on careful prompts or good model behaviour.
Objectives & strategy
Separate intelligence from authority.
- The model proposes
- The kernel decides
- The executor acts
- Step 01
Constrain the mandate
Who or what may act, which operations, and the spending and validity limits.
- Step 02
Derive amounts independently
Amounts calculated on the server from trusted catalogue prices and quantities, never taken from the model.
- Step 03
Evaluate every rule
Signatures, permissions, caps, cumulative spend, velocity, replay, product identity and more.
- Step 04
Enforce atomically
Reservations and replay protection that hold under concurrent requests.
- Step 05
Keep an audit trail
Every decision and action recorded in a hash-chained ledger.
- Step 06
Defence in depth
Hybrid Ed25519 and ML-DSA-65 (post-quantum) signatures; both must verify.
What we delivered
A security-first architecture for agentic transactions.
Deterministic authorisation kernel
A policy engine that checks proposals against 21 documented rules; a model’s reasoning cannot override the outcome.
Mandate-based spending controls
Signed mandates with per-transaction caps, cumulative limits, validity checks, operator permissions and escalation.
Independent amount derivation
Amounts from catalogue prices and quantities, with field provenance recorded.
Replay-safe execution
Canonical intent IDs for idempotency, with atomic enforcement at the ledger write.
Tamper-evident ledger
A hash-chained audit log whose integrity can be verified.
API security and adversarial testing
Bearer authentication, ownership checks, scoped audit access, transport limits, plus automated, end-to-end, stress and benchmark suites.
Results & impact
Engineering results reported in the project repository.
- 14/14
- adversarial containment cases blocked, with zero unauthorised executions
- 0
- duplicate executions across the documented happy-path, adversarial and replay evaluations
- 0.842 ms
- median full decision time, including hybrid post-quantum signature checks (about 1,082 decisions a second)
- 66/66
- stress batteries passed: concurrency, malformed input, overflow, tampering, velocity, API cases
- 202
- automated tests, plus 51 end-to-end API checks
A documented concurrency fix means 12 identical simultaneous requests give one charge and 11 denials.
These are repository-reported engineering results, not an independent security certification. The project is scoped to a single merchant in INR test mode and is not production-ready for unrestricted real-money use.
Quick answers
Mendate Kernel, in brief.
Something we did not cover? Ask us directly and we will reply within 24 hours.
What did Ishwra do for Mendate Kernel?
Mendate Kernel is a deterministic authorisation layer for AI-driven payments. It checks every proposed transaction against signed spending mandates, policy rules, catalogue data and limits before a payment can start, so a compromised or unreliable AI model cannot spend on its own.
Which industry is Mendate Kernel in?
AI security, fintech & payments. It is part of our AI & SaaS Products work.
Can an AI agent change the price it pays?
No. Mendate Kernel derives every amount on the server from catalogue prices and quantities; a price suggested by the model is never treated as authoritative.
Can Ishwra do a similar project for my business?
Yes. This project used our Custom Software & Mobile Apps, AI Integration & Automation services. Tell us about your business through Discuss a Project and we reply within 24 hours.
Related capabilities & projects
View all projectsCustom Software & Mobile Apps
Web apps, back ends, dashboards and APIs built around your workflow.
AI Integration & Automation
WhatsApp bots and workflows that answer customers without retyping.
AI & SaaS Products
What we build for this sector, with its other case studies.
Outreach OS
Self-hosted AI sales outreach platform