The tool approval flow (ToolLoopAgent toolApproval, or the UI approval request/response cycle) has its own error family. They all mean the approval handshake broke.

- InvalidToolApprovalError: approval metadata on a message is malformed.
- InvalidToolApprovalSignatureError: the approval signature did not verify.
- ToolCallNotFoundForApprovalError: an approval response arrived for a tool call id that does not exist in the history.

What to know:
1. These fire when approval state is persisted or relayed incorrectly: e.g. you stored messages, dropped the approval metadata part, and replayed the history.
2. Signature errors mean the approval was tampered with or signed with a different key/session than the one verifying. Check that signing and verification share config.
3. ToolCallNotFoundForApprovalError usually means a race: the user approved a call from a stale UI state after the conversation moved on, or two tabs approved concurrently.
4. Provider-executed tools do not use AI SDK approvals at all. If you expected an approval gate and the tool ran anyway, check whether the tool is provider-executed.
5. Keep approval round-trips in the same session when possible. Serializing approvals across restarts requires persisting the full approval metadata, not just the verdict.
6. Log the toolCallId on every approval error. It is the join key between your UI, your approval store, and the message history.