Configure approvals
Where approval requirements are declared — per integration operation, per MCP tool, and built in for writes and workflow changes — and where to see what will ask before it runs.
3 min read
Approval requirements in Tale are declarative: each capability carries its own flag saying whether an agent must ask first, and the flag travels with the integration or server that provides the capability. There is no central rules table to maintain — this page shows where each flag lives and how to read what will ask before it runs.
The model of what an approval card is and who decides it lives on Approval concepts. What follows is the configuration surface, capability by capability.
Integration operations
Every integration declares its operations, and each operation carries its own approval flag. Open Settings > Integrations, click an integration, and its operations list badges the ones marked Requires approval — for the shipped connectors, that is the write side: sending mail, posting messages, creating issues. Reads run without a card; flagged writes hold in chat with their exact parameters until someone approves.
For a custom integration, the flag is requiresApproval per operation in the config.json you package with Add integration — decide at authoring time which of its operations are consequential enough to ask.
MCP tools
An MCP server's manifest marks which of its tools need sign-off. Open Settings > API > MCP, expand a server, and its Discovered Tools list badges each flagged tool with Requires approval — those ask in chat every time an agent calls them. The flag comes from the server's author; connecting a server is how you accept its tool contract, so review the list before activating one. MCP servers covers registration.
Built-in write gates
Some gates ship on and are not configurable, because the action is consequential by nature:
- Document writes — an agent saving files to the document hub always asks (Save to documents).
- Knowledge writes — an agent storing an org-wide fact always asks (Save to knowledge base).
- Workflow creation, updates, and runs — an agent building, editing, or starting a workflow always asks; see Approvals in workflows.
Verifying what will ask
Before putting an agent in front of real systems, read its capabilities the way an approver would: the integration's operations list for flagged writes, the MCP server's Discovered Tools for flagged tools, and the agent's tool tab for whether it holds write tools at all. The audit log then records every decision the setup produces.
Where this fits
Configuration here is distribution — flags live with the integrations and servers that own the capabilities. Read Approval concepts for the card lifecycle those flags produce, and Agent tools for the capability side of the same boundary.