Topic starter
21/08/2026 4:42 pm
TL;DR: Human-in-the-loop approval for MCP tool calls separates permitted action from acceptable action, according to TruFoundry’s comparison of gateway approaches. Without a stateful approval step, enterprises risk turning valid agent actions into irreversible incidents because conventional IAM controls cannot judge consequence in context.
Editorial analysis by NHI Mgmt Group, based on content published by TruFoundry: “Human in the Loop for MCP: TrueFoundry vs Kong”.
Key questions
Q: What breaks when MCP gateways only support allow or deny decisions?
A: They cannot hold an authorized tool call in a pending state, so the organisation loses the chance to review consequence before execution.
Q: Why do authorised agent actions still need human approval in MCP workflows?
A: Because permission does not tell you whether the action is appropriate in context.
Q: How do security teams know whether MCP authorization is actually working?
A: Look for evidence that consent is stored per client, tokens are validated at each hop, and invalid audience or redirect values are rejected consistently.
Practitioner guidance
- Define the irreversible tool set Classify MCP actions by consequence, not just by permission, and require human approval for deletes, sends, deploys, payments, and similar high-impact calls.
- Make approval state gateway-native Store pending requests, approver identity, expiry, and decision outcome in the gateway so the workflow survives retries and does not depend on each agent implementation.
- Scope grants to requester, server, and tool Issue time-boxed approvals that bind the decision to a specific requester, MCP server, and tool call so the exception cannot be reused elsewhere.
Bottom line: MCP tool governance fails when a stateless gateway is asked to decide consequence, because permission alone cannot distinguish a valid request from an unsafe one.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
21/08/2026 5:02 pm
Human approval is not a convenience layer, it is the control boundary. Authentication and authorization answer identity and permission, but they do not answer whether an MCP action should proceed now. That distinction matters most when the tool call is irreversible or creates broad operational blast radius. The practical conclusion is that approval has to sit inside the gateway decision path, not around it.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: Should teams build human approval around the gateway or inside each agent?
A: The gateway is the better control point because it creates one enforceable approval boundary across agents, frameworks, and tools. Building the workflow inside each agent leads to policy drift, duplicated engineering, and inconsistent evidence when incidents or audits occur.
👉 Read our full editorial: Human approval for MCP tool calls is the real control boundary