Notifications
Clear all
Topic starter
21/08/2026 4:42 pm
TL;DR: Human-in-the-loop approval for MCP tool calls separates permitted action from acceptable action, according to TruFoundry’s comparison of gateway approaches. Without a stateful approval step, enterprises risk turning valid agent actions into irreversible incidents because conventional IAM controls cannot judge consequence in context.
NHIMG editorial — based on content published by TruFoundry: Human in the loop for MCP: TrueFoundry vs Kong
By the numbers:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%).
Questions worth separating out
Q: How should teams implement human approval for high-risk MCP tool calls?
A: Place the approval at the gateway, not inside each agent.
Q: Why do binary allow/deny controls fail for agentic tool use?
A: They answer permission, not consequence.
Q: What breaks when approval workflows are built outside the gateway?
A: Control drift breaks first, followed by fragmented audit evidence.
Practitioner guidance
- Define consequence-based tool classes Separate MCP tools into routine reads, reversible changes, and irreversible or externally visible actions.
- Require stateful approval handling at the gateway Verify that the control can hold a pending request, notify approvers, resume execution, and persist the decision trail without pushing that logic into each agent service.
- Scope every approval to requester, server, and tool Make approval grants time-boxed and bound to the exact requester, server, and tool so they cannot become reusable standing access.
What's in the full article
TruFoundry's full article covers the operational detail this post intentionally leaves for the source:
- Gateway policy configuration for pausing selected MCP tool calls before execution
- Approval routing details for named approvers, including Slack, PagerDuty, Teams, and email
- Scoped and expiring approval grants tied to requester, server, and tool
- Evaluation prompts for comparing native gateway approvals with custom workflow code
👉 Read TruFoundry's comparison of human-in-the-loop MCP approvals and gateway controls →
MCP human-in-the-loop controls: is your gateway doing enough?
Explore further
21/08/2026 5:02 pm
Human approval is the missing decision layer in agent governance. Authentication proves identity and authorization proves permission, but neither control answers whether an irreversible action should proceed in context. That makes MCP HITL a governance boundary, not a nicer version of ACLs. Practitioners should treat it as the point where consequence control begins, especially for tools that can delete, pay, deploy, or expose data.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: Who should be accountable for irreversible MCP actions?
A: Accountability should sit with the policy owner for the tool class and the named approver for the specific request. Security, platform, and compliance teams should all be able to trace the decision, but the operational owner must be explicit or the approval layer becomes an unowned process.
👉 Read our full editorial: Human approval for MCP tool calls is the real control boundary
