Allow the reads. Approve the writes.
Every MCP tool your organization connects becomes a policy decision. This page covers how that decision is expressed, who is allowed to change it, and exactly what a reviewer sees before a write reaches production data.
How allow and approve resolve per tool, per policy.
Agent BuildersWorking inside policyWhat your agent can call without waiting.
Agent BuildersWhen a run pausesReading a run that stopped on policy or approval.
How a decision is expressed
A policy is a pair: a tool and a mode. Allow lets the agent call the tool unattended. Approve pauses the run and puts the call in front of a human, with its inputs visible, before anything executes. The same pair governs scheduled agents and ad-hoc runs — there is no second path.
Reads resolve straight through. The dashed path is taken only when the tool is set to Approve.
Configure a tool
Open the policy in Settings → Policies
A policy is edited as a matrix: one tab per connected server, one row per tool, two columns — Allow and Approve. A header row sets every tool on the server at once.
Choose Allow or Approve per tool
Reads are usually safe to allow. Anything that creates or updates a record should require approval until you have watched it run. Tools with neither mode selected are simply unavailable to agents under that policy.
Decide about future tools
Each server tab has an Include all future tools checkbox. Leave it off for servers that may grow write tools — new capabilities should arrive disabled, not pre-allowed.
Editing a policy requires the policy-management permission, which the built-in Admin role carries. When an agent hits an Approve-mode tool, the pending call lands in the approval queue; it is resolved by the owner of the run’s session, from the run page or the session view.
Policy changes are themselves audited. The log records who changed a policy, when, and the change applies to the very next tool call — including runs already in flight.
A pending approval expires after one hour, and expiry fails the run — it is not skipped or silently retried. Check the run’s terminal reason before assuming the tool broke, and keep approvers within reach of the approval queue when scheduled agents fire.
Setting a delete or bulk-update tool to Allow removes the only human checkpoint on destructive writes. Point the agent at a non-production server first.
Scoping data
Mode answers whether a call may run; scope answers what it may see. Scope is carried by the credential a call runs on — a member’s own connection or the organization’s — and by any conditions the policy attaches to the tool. See Data scoping for the full model.