01What it is

Pakka is a safety check for AI agents that shop and pay on your behalf. Before the money moves, it answers one question: did the agent buy the thing you actually asked for?

02The problem

Identity is solved: Cloudflare, Visa TAP, Skyfire and Basis Theory answer who the agent is. Authorisation is solved: Mastercard Agentic Tokens, AP2 with FIDO, Kite and Locus answer whether it was allowed to spend. Whether it bought what the human asked for is still open. AP2 says the cart is verified against intent; it does not say how.

03The attack it stops

A merchant hides instructions to your agent inside its own product copy. The agent obeys, and a request for a wall sconce comes back as a hard drive, quantity three. Pakka blocks that without reading the merchant's text at all: it compares a declared category field, so there is nothing in the prose for the attacker to win.

04How it decides

Two layers, and the verdict is the stricter of the two: allow, escalate or block. The model is only ever allowed to escalate to a human. Blocking needs proof, never a model's opinion.

05The proof, and its limits

On a real agent's carts, 7.1% diverged from the instruction (n=70, every case checked by hand). The layer allowed to block raised zero false positives across 813 cases. One number is withheld on purpose, and the weakest part of the system is named. Both are in the deck. 556 tests pass, with mutation testing on top, and every decision is written to an Ed25519-signed, hash-chained audit trail.

06Where it is now

Live, running on real Razorpay test-mode orders: no install, no signup. The code is public on GitHub.