Laravel AI SDK 1.0 lets an application pause an agent before selected tools run, then approve, reject, or edit the proposed call. That decision applies to the tool invocation—not to a user’s right to access the conversation or to the records the tool can reach. Those safeguards remain application responsibilities.
Released on September 23, 2026, v1 also changes how conversation history stores tool activity: ordered steps now preserve each round trip and connect results to the calls that produced them. That affects upgrades, especially applications that query the old storage fields directly. Laravel’s v1.0 announcement and the Laravel 13.x AI SDK documentation describe the behavior and migration considerations.
As an Amazon Associate I earn from qualifying purchases.
What does approving a Laravel AI SDK tool actually approve?
It approves a pending tool call: a particular tool and its proposed arguments. If the tool implements Laravel’s Approvable behavior, the agent can pause before execution. The application can then approve the call, reject it with a reason, or edit its arguments before the tool runs. Laravel describes InteractsWithApprovals as the companion behavior for handling approvals.
The approval step does not certify the tool’s results, establish who is allowed to view a conversation, or determine which database records the tool may access. Those are separate checks that belong in the application’s authorization rules and tool implementation.
#1 Best Overall
Approval, conversation access, and data scope are separate layers
| Layer | Question it answers | Where it belongs |
|---|---|---|
| Tool approval | May this proposed call run with these arguments? | The approvable tool and the application’s decision about the pending call. |
| Conversation authorization | May this authenticated user access and resume this conversation? | Application authorization, such as a policy or Laravel Gate check. |
| Data authorization and scope | Which records or resources may the tool read or change? | Tool code and application safeguards: query scopes, tenant checks, policies, and least privilege. |
Laravel’s documented resume route makes the distinction concrete: it calls Gate::authorize('view', $conversation) before continuing the conversation with approval decisions. A person’s ability to submit an approval decision should not be treated as proof that they may access that conversation.
Likewise, a human approving a search or update does not automatically narrow what the tool can reach. The SDK documentation’s similarity-search example scopes a query by user_id; that scope is part of the developer’s query, not a guarantee supplied by the approval interface. Apply authorization and resource limits inside every tool that reads or changes data.
How do you require approval before a tool changes something?
Implement the tool’s approval behavior, then make the approval decision part of the application flow. The approval requirement can be conditional: needsApproval can return a boolean or an Approval object with a reason. An agent can also override a tool’s default using options such as requireApproval() or withoutApproval(). Treat these as configuration choices, not substitutes for authorization inside the tool.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11- Mark the relevant tool as approvable. Use the SDK’s
ApprovableandInteractsWithApprovalsbehavior for a tool whose execution should wait for a decision. - Define when approval is needed. Use
needsApprovalfor a conditional rule, or configure the tool as requiring or skipping approval when it is returned by the agent. - Persist and present the pending call. Show the reviewer which tool is waiting and the proposed arguments. Do not imply that the reviewer is seeing or approving every record the tool might return.
- Authorize access to the conversation. Before resuming it, check that the authenticated user may view or otherwise act on that conversation. Laravel’s documented flow uses
Gate::authorize('view', $conversation). - Submit a decision for each pending call. Approve it, reject it with a reason, or edit its arguments and then decide. The SDK documentation says each pending call needs a decision unless the application supplies a default.
- Keep checks in the tool itself. Enforce tenant boundaries, record-level policies, allowed operations, and other data limits when the tool executes, even if a human approved its arguments.
A rejection may include a result that is returned to the model, allowing it to continue. A rejection without a result stops the generation loop after the rejection is recorded. Choose the behavior deliberately: continuing can be useful when the model should respond to a denial, while stopping avoids continuing that generation path.
Rank #3
What happens when an approval pauses a conversation?
An approval is part of a continuing conversation, not a standalone permission token. The paused turn’s history must be available when the application resumes it so the agent can interpret the decision in context. Laravel recommends using a conversational agent or providing the history from the frontend, and its documented resume flow includes an authorization check on the conversation.
Plan for both parts of the resume flow: load the appropriate history and verify that the requester is authorized to access that conversation. A valid approval decision without the right conversation context—or from a user who should not access that conversation—does not make a safe resume flow.
What changes to conversation storage in v1?
Before v1, Laravel’s announcement describes tool calls and results as separate flat lists, with replay state in meta. That layout could obscure which round trip produced a call and make an unexecuted call harder to distinguish from one awaiting approval. V1 stores a steps JSON column with an entry for each round trip and associates results with the calls that produced them.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsIn the current 13.x documentation, accessors such as toolCalls, providerToolCalls, and toolResults flatten the steps in order. The underlying step sequence also gives the application a way to distinguish these states:
- Waiting for approval: a call has an approval reason but no result.
- Executed: the call has a result.
- Interrupted after failure: a call has no result after a failed turn. When the conversation resumes, Laravel marks it interrupted because it cannot determine whether the call ran.
Completed steps remain available when a turn fails. This is important when inspecting or resuming a conversation: an absent result after a failure is not proof that a side effect did not happen.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Do existing applications need to change database queries?
Applications that use Laravel’s documented accessors may need less direct storage work than those that query the old columns themselves. The v1 announcement specifically calls out raw SQL using tool_calls or tool_results: update those queries for the steps column and follow the upgrade guide’s one-time backfill instructions before deploying.
- Find application code, reporting jobs, exports, or analytics that read
tool_callsortool_resultsdirectly. - Update those consumers to work with the new
stepsrepresentation or the documented accessors, as appropriate. - Run the upgrade guide’s backfill once before deployment, as directed by Laravel.
- Test conversations containing multiple tool round trips, pending approvals, completed results, and failed turns.
The v1 announcement says the backfill should run once before deployment. Follow Laravel’s upgrade guidance for the actual migration sequence rather than assuming that changing application queries alone converts existing records.
What else does Laravel AI SDK 1.0 change?
Approval handling is one part of a broader Laravel toolkit, not the SDK’s only purpose. Laravel’s documentation covers APIs for agents and tools, structured output, embeddings, audio, images, reranking, files, and vector stores. The v1 release also establishes the changed conversation-history structure described above.
For version context, the implementation details here refer to Laravel’s 13.x AI SDK documentation. Laravel 13.x requires PHP 8.3 or later, according to the Laravel 13 release notes. The documented installation command is composer require laravel/ai; the documentation also describes publishing the SDK configuration and migration files through its provider’s Artisan command. This requirement does not establish compatibility for every Laravel or PHP version combination.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
