Human approval gates for Vercel AI SDK tool calls

needsApproval (AI SDK 6) with tool-approval-request parts and addToolApprovalResponse. In AI SDK 6 you mark a tool with needsApproval: true (or an async function of the input). When the model calls it, generateText and streamText do not run the tool. They complete and return tool-approval-request parts in the result content. After a human decides, your app sends a tool-approval-response (via the useChat addToolApprovalResponse helper) and calls the model a second time, which then executes the tool or tells the model approval was denied.

needsApproval surfaces the request and threads the decision back through message history, but everything around it is yours to build. The SDK provides no persistence of pending approvals, no routing to a reviewer outside the chat session, and no audit trail of who decided what and when. The default approval is a client-side UX affordance, not a server boundary: the docs warn a malicious client can forge an approval and run a needsApproval tool with schema-valid arguments unless you wire up experimental_toolApprovalSecret yourself. Storage, human routing, and tamper-evident logging are explicitly left to your application.

One wrapper is the whole integration surface — the gate is enforced at runtime, before the tool executes.

npm install @pliuz/sdk

import { tool, generateText, stepCountIs } from "ai";
import { openai } from "@ai-sdk/openai";
import { z } from "zod";
import { gatedTool } from "@pliuz/sdk/adapters/ai";

// gatedTool wraps tool({...}); the LLM sees it identically — only execute() is gated.
const issueRefund = gatedTool(
  { toolName: "issue_refund", policy: "refund", redact: ["customer_id"] },
  tool({
    description: "Issue a refund to a customer.",
    inputSchema: z.object({
      customer_id: z.string(),
      amount_cents: z.number().int().positive(),
    }),
    // Runs only after a human approves in Slack or the Pliuz web inbox.
    execute: async ({ customer_id, amount_cents }) =>
      stripe.refunds.create({ customer: customer_id, amount: amount_cents }),
  }),
);

await generateText({ model: openai("gpt-4o"), tools: { issueRefund }, stopWhen: stepCountIs(5),
  prompt: "Refund customer cus_123 for $50." });

In production with the Vercel AI SDK, approvals go to Pliuz. The SDK's needsApproval flag emits a tool-approval-request, but you still have to decide where that request is stored, who sees it, and how the decision is proven later. Pliuz is that layer: gatedTool wraps your existing tool({...}), holds the call before execute() runs, and routes the request to a human in Slack or a web inbox where they approve, reject, or edit the arguments. Every decision is written to a tamper-evident, append-only, Ed25519-anchored audit trail hosted in the EU, so the gate is enforced at runtime and provable after the fact.