# Tool approvals

> Require an administrator to approve the tools agents connect.

Source: https://docs.runbear.io/administration/tool-approvals

Last updated: 2026-08-26

By default anyone who can configure an agent can connect a tool to it. Tool
approvals put an administrator between that decision and the running agent: newly
connected tools wait in a pending state until they are approved.

> **Note**
>
> Tool approvals are rolled out per organization. If **Settings → Tool Approvals**
> does not appear for you, the feature is not enabled for your organization yet.
> Requires the Admin role.

## What happens when it is on

A tool connected to an agent is created as pending rather than approved. The agent
cannot call it until an administrator acts on the request.

Administrators see every request on the Tool Approvals page and can approve or deny
them one at a time or in bulk. Denying a request leaves the integration attached to
the agent but unusable, so the person who added it can see the decision instead of
finding the tool silently gone.

## Scope of a decision

Approvals are recorded against the integration, identified by its type and server,
and can be narrowed to individual tools within a server. That means you can allow a
server's read-only tools while withholding the ones that write.

Both managed servers from the [catalog](/agents/tools/catalog.md) and
[custom MCP servers](/agents/tools/custom-mcp.md) go through the same queue.

## Related

- [Tools](/agents/tools/overview.md)
- [Custom MCP](/agents/tools/custom-mcp.md)
- [Audit log](/administration/audit-log.md)