PurseString open-source server puts AI agent spending rules outside the agent

The developer of PurseString, an open-source MCP server that mediates between AI agents and payments, submitted it to the PayPal AI Hackathon. The post explains a design where governance logic lives in PurseString rather than inside the agent, so the agent cannot bypass it when it is the only path to payment rails. Each approved spend is issued as a credential with built-in limits, such as fixed payout recipients and hashed tool arguments that prevent reuse of an approval. Approvals are recorded in an append-only audit log, and human sign-off uses a one-time code delivered to Slack or Discord that the agent cannot see. The author also notes a gap: human-approved intents are not rechecked against tightened policy before the card is issued.