Permissions & approvals
Allow, ask or block each tool; approve calls at runtime; admin floors that members cannot loosen.
Last updated 2026-11-14
Levels
Every tool has one of three levels, as in Claude and Codex:
| Level | Effect |
|---|---|
| Allow | The call runs without asking. |
| Ask | The execution pauses until you approve the call. |
| Block | The call is refused, and the tool is hidden from search. |
Defaults
| Source | Annotation | Default |
|---|---|---|
| Directory | readOnlyHint: true | Allow |
| Directory | write or destructiveHint | Ask |
| Free URL | any | Proposed, you confirm on first setup |
| Any | none | Treated as a write: Ask |
The bridge checks the level on every call, not only during discovery. When a tool’s signature changes, an approved level goes back to to confirm and the tool behaves as Ask.
Admin floors
In company workspaces, admins set a minimum level for the whole workspace or per tool. Members can make permissions stricter, never looser. The effective level is the most restrictive of the defaults, the workspace floor, the per-tool floor and the member’s own choice.
Runtime approvals
- With elicitation (your client supports it): a dialog shows the connector, the tool, the main arguments and the workspace, with approve this call, approve every call to this tool in this script, or reject.
- Without elicitation:
executereturns a link to the Toolkien approval page and a waiting status; after you decide, the agent callsexecution_statusto resume.
Approvals come only from a signed-in human: there is no MCP tool that approves, and nothing the model sends counts as an approval. Owners and admins of a company workspace can also decide a member’s pending approval; the log records who approved (the user, an admin, or the policy). Pending approvals expire after 30 minutes.