Tool approvals and schema pins

1 min readUpdated 15 Sep 2026

Connector access combines the reviewed tool inventory, the agent’s declared tools, and current permission to use the declared connector. None of these alone authorizes a call.

Read Declare an integration for the simple authoring workflow. Tool review approves definitions; confirmation approves an individual call. The declared connector and any required personal account must be ready for execution.

Declare the allowed tools

Use an existing connector and its approved tools. Find them with tanomis mcp connector list and tanomis mcp connector tools CONNECTOR_ID.

integrations:
  issues:
    connector: tenant/issue-tracker
    required: true
    tools:
      allow: [search_issues, create_issue]
      approval_required: [create_issue]

tools.allow is non-empty and closed by default. Every tool must be approved on the referenced connector. tools.approval_required is a subset of that allowlist. Updating a connector cannot add tools beyond the agent’s declaration. Neither an MCP scope string nor an egress allowance substitutes for this access. See Agent manifest.

Require a person

Each approval-required call creates a permission request for the verified human run initiator. Review the tool and its arguments before answering. The approval is bound to that run and exact call and can be consumed only once. A repeated identical call needs another approval. If the provider fails after consuming an approval, retrying also requires a new approval.

The agent cannot answer its own request. Session ownership, the active run, and current grant are still checked. See Approval-required actions.

Use reviewed schemas

The platform automatically snapshots the requested tool descriptions and input schemas, and output schemas when present, during registration. Authors do not write hashes or contract references. Runtime compares served tool definitions against that version’s snapshot; changed or unapproved tools are not silently accepted.

After a provider schema change, review the changed inventory and deploy a new agent version to capture the updated definitions. The new version still declares its connector explicitly, and existing access disables remain in place. Discovery success alone does not approve inventory or grant agent access.