Skip to main content
Approval settings control when an agent must pause and ask you before running a tool. You set each tool to auto-approve, require approval, or disabled — balancing automation speed against safety.

​
Why approval

  • Trust builds incrementally. Start with write tools set to require approval, then auto-approve routine operations once you’ve verified agent behavior.
  • Reads stay fast, writes stay safe. Read-only tools run without prompts; anything that changes infrastructure can be gated.
  • You see the exact command first. Every approval prompt shows the command or script before it runs, so nothing executes sight unseen.
  • Every decision is logged. Approvals create an audit trail that answers “who approved what change and why” for compliance reviews.
  • High-risk operations stay gated. Keep IAM changes and database schema modifications permanently approval-required.

​
Configure tool permissions

Set the approval mode per tool, per connection.
1

Open Connections

Navigate to Connections and select the Built-in Connections tab.
2

Select a connection

Find the connection you want to configure, such as Amazon Web Services.
3

Open Tool Settings

Click Tool Settings to open the configuration modal.
4

Configure each tool

For each tool, set:
  • Enabled — allow or disallow agents from using this tool
  • Requires User Approval — require manual approval before execution
Tool Settings Configuration
The same per-tool flags also appear under Approval in workspace settings, on the Tool Permissions tab.

​
Approval modes

Each tool runs in one of three modes: A safe starting configuration separates reads from writes:

​
The approval prompt

When an agent attempts an operation that requires approval, it pauses and presents a prompt.
Agent Approval Prompt
Expand Details before deciding. Verify the exact command matches your expectations — approve the command, not just the summary.

​
When agents ask for approval

Tools set to require approval pause the agent for operations like these:

​
Approval, Auto Mode, and agent autonomy

Per-tool approval is a static rule: the same tool always asks, always runs, or is always blocked. Two other settings interact with it. Auto Mode replaces the static Requires approval flag with a classifier that reviews each write against what you asked for: Turn Auto Mode off and your per-tool rules resume unchanged. Agent autonomy applies when agents run on their own, outside a live chat: Per-tool approval governs individual tool calls; autonomy mode governs whether an agent’s proposed actions wait for a person at all.

​
FAQ

When first connecting a new service, set all write tools to require approval. As you build confidence in agent behavior, selectively auto-approve routine operations.
Yes. Every approval is logged, showing who approved which change and why — a change-management record without the overhead of a full ITSM workflow.
You can cancel an operation from the approval prompt before it runs. Once approved, the command executes as shown in Details.
The Requires approval flags are paused while the classifier decides case-by-case. Disabled tools stay disabled. Turning Auto Mode off restores your rules exactly as configured.

Auto Mode

Let a classifier auto-approve safe agent actions so chats flow without stopping

Agents

Learn how agents work and collaborate

Connections

Set up cloud and service connections