# Tool approvals and schema pins

Choose approved connector tools and require confirmation for individual calls.

Connector access combines the **reviewed tool inventory**, the **agent's declared tools**, and
**current permission to use the declared connector**. None of these alone authorizes a call.

Read [Declare an integration](/guides/connect-tools/integration-contracts) for the simple
authoring workflow. Tool review approves definitions; confirmation approves an
individual call. The declared connector and any required personal account must be ready for execution.

## Declare the allowed tools

Use an existing connector and its approved tools. Find them with `tanomis mcp connector list` and `tanomis mcp connector tools CONNECTOR_ID`.

```yaml title="agent.yaml"
integrations:
  issues:
    connector: tenant/issue-tracker
    required: true
    tools:
      allow: [search_issues, create_issue]
      approval_required: [create_issue]
```

`tools.allow` is non-empty and closed by default. Every tool must be approved on the referenced connector.
`tools.approval_required` is a subset of that allowlist. Updating a connector cannot
add tools beyond the agent's declaration. Neither an MCP scope string nor an egress allowance
substitutes for this access. See [Agent manifest](/reference/agent-manifest#governed-mcp-connectors).

## Require a person

Each approval-required call creates a permission request for the verified human run initiator.
Review the tool and its arguments before answering. The approval is bound to that run and exact
call and can be consumed only once. A repeated identical call needs another approval. If the
provider fails after consuming an approval, retrying also requires a new approval.

The agent cannot answer its own request. Session ownership, the active run, and current grant are
still checked. See [Approval-required actions](/guides/run/approval-required-actions).

## Use reviewed schemas

The platform automatically snapshots the requested tool descriptions and input schemas, and
output schemas when present, during registration. Authors do not write hashes or contract
references. Runtime compares served tool definitions against that version's snapshot; changed
or unapproved tools are not silently accepted.

After a provider schema change, review the changed inventory and deploy a new agent version to
capture the updated definitions. The new version still declares its connector explicitly, and existing access disables remain in place.
Discovery success alone does not approve inventory or grant agent access.