Approvals
Tools marked write: true and every MCP tool not listed in read_only wait for approval. The requester approves: the person whose message led the model to call the tool.
Approval is not an IT sign-off
Approval means the requester confirms the action they asked for. Anyone who can message Deskhand can confirm their own request, so approval does not check that they are allowed to do it.
- A write tool must act only on the requester’s own account, or check for itself that the requester may do what it does. Code extensions get the requester with
requester(); see Code extensions. - Don’t give everyone admin tools, such as resetting someone else’s MFA.
- For MCP servers, list the tools that are safe for everyone in
read_only, and leave admin servers out.
What happens
- The model calls a write tool.
- Deskhand posts a card in the thread with a one-line summary, the tool name and its arguments, and Approve and Deny buttons.
- The requester presses one. Clicks from anyone else don’t count; that person is told only the requester can decide.
- The card updates to show the outcome.
- On approve, the tool runs once. On deny, the model is told not to retry unless the requester asks again.
approvals: { timeout_minutes: 60 }If nobody decides within timeout_minutes (default 60), the approval expires, the tool does not run, and the model asks whether to try again.
On each platform
| Platform | Card | Someone else’s click |
|---|---|---|
| Slack | Block Kit buttons | A note only they can see |
| Microsoft Teams | Adaptive Card | A short message shown to them |
| Google Chat | Card with buttons | A reply visible in the conversation |
| Console | Type approve <id> or deny <id> |
Restarts
Approvals are stored in the data volume, so a pending approval survives a restart and its card still works. If Deskhand crashes in the moment between posting a card and recording that it posted it, it can post the card a second time.
If Deskhand stops after an approval but before the tool finishes, it does not run the tool again. It tells the model the write may have happened, so the model checks before trying again.
While an approval is pending
A pending approval keeps the conversation busy until it is decided or expires. New messages in that thread are added to the same request rather than starting a new one. If the model calls a write tool after reading someone else’s message, that person is the one asked to approve.