User Approval for Sensitive MCP Actions

Approval is effective only when the user understands what they are approving.

Show exact context

• Tool/server identity.
• Target account/resource.
• Arguments and proposed changes.
• Whether the action is reversible.
• Any estimated cost or external side effect.

Risk-tier policies

Do not ask for approval before harmless reads. Reserve interruption for meaningful risk so users do not develop approval fatigue.

Persist decisions carefully

“Always approve” should be scoped to the specific tool identity and run/context, not become a global forever permission by accident.