Approvals & policy

Pause risky actions wherever they originate.

Use the same approval rule whether the request comes from an MCP client, hosted session, package-backed tool, GitHub action, workflow, or another sensitive call.

Exact-call review

Review the action that will execute, not a vague request to continue.

Pending GitHub pull request approval with exact owner, repository, title, head branch, and base branch
In this Ask-mode example, the request pauses before provider execution and shows the exact arguments plus the named caller.

What an approval means

Approvals should pause one exact action, not bless a whole run.

Ask mode stores one exact action and its normalized arguments for review. It is a decision on a specific call, not a blanket blessing for the whole run.

Exact payload

Approve the call the agent actually asked to make.

The queued action carries normalized arguments so the human can approve or reject the concrete change.

Policy modes

Use Off, Ask, or Allow per tool or action.

Read actions can be allowed while writes, comments, deploys, merges, or document changes pause for review. Without a grant, the tool or action is unavailable.

Revocation

Stop future calls when the job is done.

Disable, revoke, expire, or rotate identities and grants. Completed provider actions are not magically rolled back.

Where teams start

Risky actions teams usually gate first.

1Ask before PR creation or Slack update.
2Allow repo reads but deny direct main pushes.
3Expire an Agent identity after triage.