razorpay ai buildathon 2026 · track 1 · test mode

Agents can finally pay.
Safely.

Customs is the checkout AI buyers transact on — and the desk merchants trust. Every rupee an agent moves is signed, bounded, and provable: a mandate in plain code, ten checks at bind time, a hash-chained ledger, a human desk over ₹10,000.

agent GMV

—

orders cleared

—

attacks blocked

—

chain intact

—

Watch it clear.

rendered live by this page — not a recording · hover holds it

one agent · one mandate · one receipt — rendered live, not recorded

desk open · 21 catalog items · rail: sandbox (labeled)

intent → search → refusal → attest → mandate → approve → gate → capture → ledgerplaying

How a payment clears.

Mandate01

The buyer signs a mandate: amount cap, item list, expiry, trust tier. Ed25519 over canonical JSON. No mandate, no money.

sign(mandate.body)

Bind02

At checkout the gate re-checks everything in plain code: signature, tier bounds, live catalog prices, allowlist. The agent's arithmetic is never trusted.

decide(mandate, order)

Settle03

Capture on the rail (test mode or labeled simulation), receipt issued, every span hash-chained into a ledger you can replay.

capture(orderId)

What an agent may spend.

a human desk over ₹10,000, always

unverified walk-in

₹500

No identity on file. One item, up to ₹500, ten minutes.

mandate lifetime10 min

distinct items1

attested agent

₹5,000

Attested identity (OTP-bound). Three items, up to ₹5,000, half an hour.

mandate lifetime30 min

distinct items3

mandated agent

₹50,000

Signed standing mandate. Ten items, up to ₹50,000, twenty-four hours.

mandate lifetime1440 min

distinct items10

One gate, three transports.

naivebaseline

Direct in-process tool calls. The baseline: zero protocol overhead.

MCP-stylejson-rpc 2.0

JSON-RPC 2.0 tool envelopes (tools/list → tools/call), MCP-shaped.

ACP-styleenvelopes

Agent-to-agent message envelopes with ack + signed receipt per call.

conformance-fuzzed per adapter · overhead measured in results/ablation.json · x402 pre-declared as a stretch, not a promise

Built to be judged by a machine.

the proof layer

make triage60-second self-guided judge tour — prints claims, runs checks, exits 0

make verifythe exact evidence checks CI runs on every push (zero deps)

make fuzzthe authored attack corpus vs the production gate — 12/12, reason codes

make ablationsame batch through three protocols, overhead measured

make meterchannel P&L over the deterministic ledger — GMV minus AI cost

make projectthe at-1M-payments projection, assumptions declared

the bar, verbatim

“Every money action explainable, bounded and gated. Show the audit trail and one failure handled gracefully.”