Laravel AI SDK 1.0 shipped on September 23. Its Approvable contract can pause an agent run when the model requests a tool call. A person can approve the call, reject it with a reason visible to the model, or change its arguments. Tools adopt the contract through the InteractsWithApprovals trait. The mechanism works with prompt, stream, queue and broadcast operations. Suspended state can be persisted, so a decision can arrive up to 20 minutes later from another HTTP session.

use Laravel\Ai\Concerns\InteractsWithApprovals;
use Laravel\Ai\Contracts\Approvable;
use Laravel\Ai\Contracts\Tool;

class DeleteFile implements Approvable, Tool
{
    use InteractsWithApprovals;
}

This control governs an action. It does not determine whether the data entering the agent may be processed. Miraviso, a virtual mirror for hair salons, therefore uses two separate privacy paths.

The colour try-on runs on the tablet. MediaPipe performs segmentation on the device, and the colour composition happens locally, so no frame leaves the hardware. The haircut preview requires a generative model. It runs through Gemini via Vertex AI in an EU region, needs explicit consent from the client, and never writes the result to disk. An approval inside the agent loop would ask the salon operator to authorize data belonging to the client.

Miraviso stores consent on the server as state for the chair session. The client must provide that consent before the application can create a generative request. Its FastAPI endpoint rejects the request with HTTP 403 before sending anything upstream when `session.consent.generative_preview` is absent. The next client starts with no inherited consent because the state expires with the session. The check also runs again after every long-running `await`, so a withdrawal can take effect during processing.

Keeping frames out of storage requires more than an architectural promise. Temporary files, HTTP client caches and logs must not retain the request body. The libraries that touch these bytes need an audit. Sensitive data often reaches logs through failed queries or APM traces.

The SDK remains useful for Laravel back-office work. An agent can propose duplicate-record merges, appointment changes or credit notes while a person corrects the selected arguments before execution. Version 1.0 also runs per-step middleware on every generation step. A `PendingStep` can switch the model, remove tools or reduce the token budget as the conversation progresses. Dropping an expensive tool after its first use becomes a one-line cost measure for a small team.