Spend guardrails for Vercel AI SDK tools
Give an AI SDK agent a tool that spends money and only the prompt stands between the model and your card. sipi.bot is one fetch that returns approve, block, or flag before the spend happens. Works in Node 18+ and edge runtimes.
import { tool } from "ai";
import { z } from "zod";
import { evaluateSpend } from "./sipiGuard";
const buy = tool({
description: "Spend money with a supplier (USD). A spend firewall decides if it is allowed.",
parameters: z.object({
amount: z.number(), merchant: z.string(), category: z.string().optional(),
}),
execute: async ({ amount, merchant, category }) => {
const d = await evaluateSpend({ amount, merchant, category });
if (d.decision === "BLOCKED")
return { ok: false, message: `BLOCKED: ${d.reason}. Do not retry.` };
if (d.decision === "FLAGGED")
return { ok: false, message: `NEEDS HUMAN APPROVAL: ${d.reason}.` };
return { ok: true, message: await reallyBuy(amount, merchant) };
},
});
Return an object, not a thrown error. The AI SDK feeds the return value back to the model as the tool result, so { ok: false, message } lets the model reason about the block and stop, while throwing surfaces an error it cannot act on.
Edge-ready TypeScript client
The sipiGuard.ts client uses global fetch, so it runs unchanged in Node, Vercel Edge Functions, and Cloudflare Workers — no SDK, no Node-only dependencies.
Frequently asked
Does this run on Vercel Edge Functions?
Yes. sipiGuard.ts uses global fetch with no Node-only dependencies, so it runs on Vercel Edge, Cloudflare Workers, and standard Node 18+ runtimes.
Why return an object instead of throwing?
The Vercel AI SDK passes the tool's return value back to the model. Returning { ok: false, message } lets the model reason about the block and stop; throwing surfaces an error the model cannot gracefully handle.
Does it work with streamText and generateText?
Yes. The guard runs inside tool.execute, which both streamText and generateText invoke during multi-step tool calls.