TrapLedger

Autonomous AI agents are increasingly capable of initiating real payments on behalf of users and enterprises. TrapLedger exists to answer a critical question no one is asking yet: what governs an agent's payment before the wallet signs? TrapLedger sits between an Agent Client and a Paid Resource. When an agent initiates a Payment Attempt, TrapLedger first fetches a Payment Challenge (x402-shaped 402 response) from the target resource, then applies a deterministic Policy Set, destination allowlist, maximum spend limits, sensitive data blocklist, and prompt injection detection — before any Payment Proof is created. An optional Gemini Classifier produces Intent Signals that provide human-readable reasoning for the Policy Decision. Critically, the LLM never overrides deterministic policy, it explains, not decides. Every Payment Attempt, whether allowed or blocked, creates an Audit Event with the full enforcement trace: challenge, decision, reasons, and signing outcome. Blocked attempts expose the x402-shaped Payment Challenge and all block reasons, but no Payment Proof is ever created. The MVP is intentionally simulated, no real wallet signing, facilitator calls, or testnet transactions. Instead, it draws a clear X402 Payment Adapter boundary showing exactly where signing would happen, with inspectable simulated PAYMENT-SIGNATURE and PaymentPayload evidence for allowed attempts. Built with FastAPI (Python), Gemini API for intent classification, and a Guided Enforcement Replay UI, a step-by-step walkthrough of one approved and one blocked canonical Payment Attempt that advances manually so the enforcement boundary is impossible to miss.