AI agents will render anything. Yours shouldn't.
SINA is a React design system with a server-side gate. Your agent proposes UI as intent, a Zod constitution decides what is allowed, and only governed components mount.
Two requests on a loop: one passes, one hits the constitution.
How it works
The agent emits intent
The model never writes JSX and never picks what renders. It emits intent: a component name plus structured props, like a bank transfer with an amount and two accounts.
The constitution checks it
The rulebook is Zod running on your server, before anything streams to the client. Strict schemas reject unknown keys; policy rules check limits, approvals, and privacy.
Mount, swap, or block
A clean pass mounts the component. A risky request gets the governed version forced in its place, like a bank transfer dialog that demands a second approval. A bad one never renders, and every decision cites the rule it applied.
What a rule looks like
const wireTransfer = z
.object({
amount: minorUnits,
currency: iso4217,
debtor: party,
creditor: party,
})
.strict();
if (amount > usd(50_000)) {
escalate("AMOUNT_REQUIRES_APPROVAL", "SecureWireDialog");
}
Why SINA
- Product teams
Governance you can prove
When someone asks why the interface blocked a transfer, the answer is a rule id and an audit event, not a screenshot and a guess. Every decision cites the rule it enforced.
- Designers
The blocked state is designed
Rejection is part of the interface: a keyboard-operable component that names the rule, not an error page. Every primitive passes automated axe checks in the build.
- Engineers
No new runtime to trust
React, Zod, five npm packages, MIT licensed. The gate is a function on your server. If SINA disappeared tomorrow, your components would still render.
In ten seconds
Letting an agent generate UI means trusting it with what renders. SINA removes that trust from the agent: it can only propose, a server-side constitution decides, and a refusal mounts a governed component instead of failing. Fintech is live today; healthcare and defense are next.
Free and MIT licensed, so the safety layer is not the reason a small team skips governance.
Read the docs