I Built an AI Money Agent That's Structurally Incapable of Touching the Money

[ EXECUTIVE TEARDOWN // TL;DR ]

• Sable has no cloud backend: every financial record lives in on-device SQLite, so privacy is a topology, not a policy.
• Every model function call is a dry run rendered as a Review & Confirm card — the human commits, so a hallucination's blast radius is one dismissible card.
• Serialized writes, a daily local RAG Morning Briefing, and offline-first design make the trust model production-real.
• The propose/confirm pattern transfers to any enterprise domain where data wants AI leverage but cannot tolerate AI authority.

Personal-finance apps ask for the most sensitive data a person owns and then ship it to someone else's cloud. AI finance apps go further: they hand that data to a language model and let probabilistic text decide what happens to real money. I built Sable to reject both premises at the architecture level — a local-first AI financial agent where all data lives on-device in SQLite, and where the model can propose but is structurally incapable of committing.

Trust boundary #1: the data never leaves

Sable is a React Native app with no cloud backend. Every debt, every payment, every balance lives in on-device SQLite — full stop. When the AI layer needs context ("how is my spending pacing this month?"), it queries the local database. What crosses the network to the model is a distilled, minimal context — never the ledger. Most products bolt privacy on as a policy. Sable has it as a topology: there is no server to breach because there is no server.

Trust boundary #2: the model proposes, the human commits

The agent uses OpenAI function calling — but every function call is a dry run. When the model decides "log a ₹5,000 payment against the car loan," that intent renders as a Review & Confirm card in the UI. The model's output is a proposal object; the database mutation only executes when a human taps confirm. An LLM hallucination in Sable can produce, at worst, a card you dismiss. It can never produce a wrong number in your ledger.

The question that should govern every agentic product: what is the blast radius of the model's worst output? In Sable the answer is "one dismissible card" — by architecture, not by prompt engineering.

What makes a local-first AI agent production-real?

• Serialized writes: a queue funnels every SQLite mutation through one at a time, eliminating the write-lock contention that plagues on-device databases.
• A daily local RAG job: each morning the agent reads the on-device ledger and delivers a proactive Morning Briefing to the lock screen — spend pacing, upcoming obligations, anomalies — without a single byte of financial data leaving the phone.
• Offline-first by default: the app is fully functional in airplane mode; the AI layer is an enhancement, not a dependency.

Why this pattern matters beyond finance

Every enterprise deploying agents faces Sable's problem in costume: healthcare records, legal documents, internal financials — data that wants AI leverage but cannot tolerate AI authority. The propose/confirm boundary and the local-context pattern transfer directly: give the model read access to distilled context, render its intents as reviewable artifacts, and reserve the commit for a human or a deterministic policy. I built the reference implementation into a product I use every day — the full breakdown is on Sable's product page.

~/keep-reading

• 6 min readI Shipped 5 Products in 12 Months — Solo, Unfunded, and Faster Than Most Teams Ship OneFive production systems — a realtime telemetry cockpit, a workflow engine, a local-first AI finance agent, and two autonomous pipelines — designed, built, and shipped by one engineer. Here's the operating model.
• 6 min readMy Networking Runs Itself: The LinkedIn Pipeline That Grew My Reach While I SleptHow I engineered consistency: an autonomous GitHub Actions pipeline that turns real work into scheduled LinkedIn posts, tracks state in Git, costs $0 to run — and what the same pattern automates inside a company.
• 6 min readThe $0 Content Engine: My Blog Writes, Commits, and Deploys Itself Twice a WeekA cron-scheduled pipeline drafts articles with Gemini, writes MDX, commits to Git, and redeploys the static site — no CMS, no server, no database, no bill. The architecture of refusing infrastructure.

YK

Yaseen Khatib · MERN + AI Architect

Ships autonomous AI products solo — five in the last twelve months. More about Yaseen →

Need an engineer who can build this?

I'm Yaseen Khatib — a Senior Full-Stack AI Engineer (MERN + TypeScript) who ships production AI systems solo. Open to senior and lead roles, remote or on-site.

Get in touch →See what I've shipped

---

Originally published at yaseenkhatib.streamerosai.com/blog/sable-ai-agent-never-touches-money/.