Tool approval is a control that pauses an AI agent before a sensitive tool call and asks an authorized person or policy engine to allow or reject the action. It keeps the model from deciding by itself whether to send, delete, purchase, publish, or change protected data.
Microsoft Agent Safety recommends approval for high-risk operations. The control belongs between the model’s proposal and the external system that performs it.
How does tool approval work?
The agent emits a structured tool call. Agent middleware or the runtime classifies its risk, shows the exact arguments to an approver, and executes only after a valid decision. Approval should bind to the specific action and parameters, so changing the recipient or amount requires a new decision.
Is tool approval the same as a guardrail?
It is one kind of human-in-the-loop guardrail, but many guardrails run automatically. An approval button is meaningful only when rejection truly prevents execution. Strong AI agent security also limits credentials and permissions so a compromised agent cannot bypass the approval path.
Frequently asked questions
Which AI agent actions should require approval?
Actions that move money, send external messages, publish content, delete data, change production systems, reveal sensitive information, or exceed a defined operating limit should normally require approval.
Can some tool calls be approved automatically?
Yes. A policy can allow narrow, read-only, or reversible calls while pausing higher-risk actions. The rule should depend on the action and scope, not only the tool name.
No advertising or tracking cookies, and our visitor counts are anonymous. The Cal.com booking widget loads only if you allow it. Privacy Policy.
The page itself, anything our host sets to serve and secure it, and the anonymous visitor count. Always on, and none of it stores anything on your device.
The Cal.com booking widget. Left off, a booking link opens the booking page instead of a popup, so you can still book a call.