If your team wants a WhatsApp booking agent built on eve, and you will answer for every booking it makes and what each step costs, this is for you. If you have no chat volume to measure yet, this can wait. The worked example is a clinic; the same rules hold for viewings, deliveries or service calls. The first decision is not the model. It is which steps run without a person, because eve leaves that to you, tool by tool, and its default asks nobody.
Why does the approval setting matter more than the model?
Because the model's mistakes reach the customer only through tools. A wrong answer costs a follow-up message; a wrong booking puts a patient at the door with no doctor free. In eve, approval belongs to each tool, and a tool that sets nothing runs without asking.
The eve docs say it plainly: "By default, omitted approval behaves like never(), so tool calls may execute without human approval." The same page tells you to require approval or other safeguards for sensitive, irreversible, regulated, financial, healthcare or external side-effecting actions. There is a second reason on WhatsApp: anyone with your number can type text that steers the model toward a tool. The approval on a write tool is what stops an injected message from becoming a booking.
How does one WhatsApp message run through eve?
Each message is a turn in a durable session. The session can pause for a person for seconds or days and pick up where it stopped.
- 01The patient's message reaches the WhatsApp Business Cloud webhook, which eve's WhatsApp channel mounts at /eve/v1/whatsapp.
- 02eve starts a session or resumes the open one. Sessions run on Vercel Workflows, so they survive cold starts and redeploys.
- 03The model reads the instructions in agent/instructions.md and picks a tool. Each file in agent/tools/ is one tool.
- 04The tool's approval rule runs it, refuses it, or parks the turn until a person decides.
- 05The reply streams back to WhatsApp. If the turn waited, it resumes when the answer arrives.
The WhatsApp adapter owns provider sign-in, verification and delivery. eve owns the session, streaming and the pause for a person. Since version 0.78.0, the changelog says, an approved call runs with the identity and credentials of the person whose turn requested it, not the approver's. Before that, a requester could get a call to run with the approver's access, a privilege escalation the release closed.
Which tools should ask a person first?
Anything that changes a booking. Reading the calendar can run alone; writing to it waits for your front desk. Our rule for loosening a gate: a tool moves from always() to once() only after a month in shadow in which the front desk checked every proposed booking and found none wrong, and it moves back the day one is.
A sample clinic setup, not a client, with the reason for each line:
What about auto()? It asks a decision model whether the exact call is clear or needs a person, and it defaults to TypeSafe AI's Jev, a small model that answers a yes-or-no question with a confidence. A caution, a failed review or incomplete input sends it to a person. The docs add one line a clinic must read: "The tool input is sent to the decision model's provider." Patient names and phone numbers in that input leave your stack. We implement Jev for clients, so weigh our view with that in mind: we use auto() on steps whose input carries no personal data, and always() on the rest.
A brokerage reads the same table with viewings in place of appointments. Our clinics page shows the rest of the front desk work this sits beside.
What does it cost to run?
eve has no price of its own. Vercel's eve pricing docs say usage is billed through the Vercel resources and third-party services your agent uses.
The bill comes from Functions (agent routes, channel webhooks, tool runs), Workflows (session and turn progress), Sandbox (if the agent runs commands), AI Gateway and the model tokens, and Always-on Tracing. WhatsApp's own message charges sit on your Meta account, outside all of these.
The model tokens are usually the line that grows. AI Gateway adds no markup to provider token prices, and it logs the provider, latency, tokens and cost of every request, so each step's cost is a number you can read rather than estimate. Its budgets are soft caps, not hard stops, so set Spend Management as well. Zero data retention is the default on the Gateway, and inference can be pinned to the US or EU only.
The docs give a method, not a number, and it is the right one. Take one real booking conversation and record:
- How many turns it takes.
- How many model calls and tool calls each turn makes.
- Input, cached and output tokens per model call.
- How much data streams back.
- Whether it uses the sandbox.
Agent Runs shows those counts per session. Multiply by your monthly chats and you have a cost per booking you can defend. Run it on 20 of your own conversations in shadow before you budget.
Our model-mix rule for this agent: turns that only read (slots, opening hours, directions) go to a small model; any turn that can call a write tool goes to the larger one, because a wrong write costs more than the tokens saved. Move repeated instructions into skills so they load only when needed, as the eve pricing page suggests, and use eve's evals on every deployment to catch a drop before patients do.
What is still Beta, and what stays your job?
eve itself. The docs say it is in beta under Vercel's beta terms, and that "the framework, APIs, documentation, and behavior may change before general availability". It is Apache-2.0, and eve.dev describes self-hosting the whole runtime, which answers the lock-in question.
What stays yours:
- Testing the channel where you are. Run the WhatsApp channel on your own UAE or Saudi number in shadow mode first.
- Where it runs. Vercel's 19 compute regions include none in the UAE or Saudi Arabia; Mumbai (bom1) is the nearest. AI Gateway pins inference to the US or EU only. Confirm residency per project before you sign.
- Upgrades. Pin the version and read the changelog. The privilege fix in 0.78.0 is the kind of change you want to know about.
For the wider rule on who approves an agent's action, see human approval for agents. For WhatsApp agents built outside eve, our WhatsApp agents page covers the other route.
When should you not build on eve yet?
When the agent would book with no person watching from day one, or when your legal team needs a generally available framework under contract. A beta under a written gate is fine; a beta with no gate is not.
If you have no production chat volume to measure yet, wait: run the front desk's own WhatsApp for a month and count the bookings first.
We are not a Vercel partner, and eve is open source, so the code and the Vercel account stay yours. When you are ready, we use the method we call Spec, shadow, gate: write which tools exist and which ask, run the agent in shadow beside your front desk, then let it book behind always(). The written assessment is free, the first build week is a fixed AED/SAR 14,900, and the Vercel hub shows what else we build there.
