Human approval for MCP tools: design the interruption, not just the button

The concrete problem: MCP meets approval

The hard part appears when the happy path meets authorization, failures, and operational constraints.

In “Human approval for MCP tools: design the interruption, not just the button”, scenario mcp-human-approval-interruption-design-c11 starts at tool call and treats resume as an explicit boundary rather than an implicit assumption. The first control requires MCP to emit an observable result before approval can trigger the intended effect around RunState. This detail makes “Human approval for MCP tools: design the interruption, not just the button” reviewable because each operational statement points to resume, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by MCP and RunState: anything not demonstrated by scenario mcp-human-approval-interruption-design-c11 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Capture the exact pending action, show material parameters, obtain approval, then resume without silently changing the request. It turns tool call into a reviewable decision point with a named input and a retained output.

In “Human approval for MCP tools: design the interruption, not just the button”, scenario mcp-human-approval-interruption-design-c12 starts at resume and treats MCP as an explicit boundary rather than an implicit assumption. The first control requires approval to emit an observable result before RunState can trigger the intended effect around tool call. To test MCP, fixture mcp-human-approval-interruption-design-c12 contains both an allowed state and a rejected state; rejection must occur before any change attributed to approval. Operations then observes the transition between approval and RunState, while security checks that tool call receives neither implicit authority nor unnecessary data. If the RunState verification fails, rollback restores the configuration around tool call, replays mcp-human-approval-interruption-design-c12, and compares the new state with the control evidence from resume.

In “Human approval for MCP tools: design the interruption, not just the button”, scenario mcp-human-approval-interruption-design-c13 starts at MCP and treats approval as an explicit boundary rather than an implicit assumption. The first control requires RunState to emit an observable result before tool call can trigger the intended effect around resume. This detail makes “Human approval for MCP tools: design the interruption, not just the button” reviewable because each operational statement points to approval, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by RunState and resume: anything not demonstrated by scenario mcp-human-approval-interruption-design-c13 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Capture the exact pending action, show material parameters, obtain approval, then resume without silently changing the request. It turns MCP into a reviewable decision point with a named input and a retained output.

In “Human approval for MCP tools: design the interruption, not just the button”, scenario mcp-human-approval-interruption-design-c14 starts at approval and treats RunState as an explicit boundary rather than an implicit assumption. The first control requires tool call to emit an observable result before resume can trigger the intended effect around MCP. To test RunState, fixture mcp-human-approval-interruption-design-c14 contains both an allowed state and a rejected state; rejection must occur before any change attributed to tool call. Operations then observes the transition between tool call and resume, while security checks that MCP receives neither implicit authority nor unnecessary data. If the resume verification fails, rollback restores the configuration around MCP, replays mcp-human-approval-interruption-design-c14, and compares the new state with the control evidence from approval.

Trust boundaries around RunState

A robust implementation separates what the model proposes from what the application authorizes and verifies.

In “Human approval for MCP tools: design the interruption, not just the button”, scenario mcp-human-approval-interruption-design-c21 starts at resume and treats MCP as an explicit boundary rather than an implicit assumption. The first control requires approval to emit an observable result before RunState can trigger the intended effect around tool call. If the RunState verification fails, rollback restores the configuration around tool call, replays mcp-human-approval-interruption-design-c21, and compares the new state with the control evidence from resume. This detail makes “Human approval for MCP tools: design the interruption, not just the button” reviewable because each operational statement points to MCP, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by approval and tool call: anything not demonstrated by scenario mcp-human-approval-interruption-design-c21 is labeled as a limitation or inference, never promoted to fact.

In “Human approval for MCP tools: design the interruption, not just the button”, scenario mcp-human-approval-interruption-design-c22 starts at MCP and treats approval as an explicit boundary rather than an implicit assumption. The first control requires RunState to emit an observable result before tool call can trigger the intended effect around resume. That sequence serves this concrete job: Capture the exact pending action, show material parameters, obtain approval, then resume without silently changing the request. It turns MCP into a reviewable decision point with a named input and a retained output. To test approval, fixture mcp-human-approval-interruption-design-c22 contains both an allowed state and a rejected state; rejection must occur before any change attributed to RunState. Operations then observes the transition between RunState and tool call, while security checks that resume receives neither implicit authority nor unnecessary data.

In “Human approval for MCP tools: design the interruption, not just the button”, scenario mcp-human-approval-interruption-design-c23 starts at approval and treats RunState as an explicit boundary rather than an implicit assumption. The first control requires tool call to emit an observable result before resume can trigger the intended effect around MCP. If the resume verification fails, rollback restores the configuration around MCP, replays mcp-human-approval-interruption-design-c23, and compares the new state with the control evidence from approval. This detail makes “Human approval for MCP tools: design the interruption, not just the button” reviewable because each operational statement points to RunState, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by tool call and MCP: anything not demonstrated by scenario mcp-human-approval-interruption-design-c23 is labeled as a limitation or inference, never promoted to fact.

In “Human approval for MCP tools: design the interruption, not just the button”, scenario mcp-human-approval-interruption-design-c24 starts at RunState and treats tool call as an explicit boundary rather than an implicit assumption. The first control requires resume to emit an observable result before MCP can trigger the intended effect around approval. That sequence serves this concrete job: Capture the exact pending action, show material parameters, obtain approval, then resume without silently changing the request. It turns RunState into a reviewable decision point with a named input and a retained output. To test tool call, fixture mcp-human-approval-interruption-design-c24 contains both an allowed state and a rejected state; rejection must occur before any change attributed to resume. Operations then observes the transition between resume and MCP, while security checks that approval receives neither implicit authority nor unnecessary data.

Prepare the starting state and prerequisites

The starting point is not a feature; it is an observable decision boundary.

In “Human approval for MCP tools: design the interruption, not just the button”, scenario mcp-human-approval-interruption-design-c31 starts at MCP and treats approval as an explicit boundary rather than an implicit assumption. The first control requires RunState to emit an observable result before tool call can trigger the intended effect around resume. Operations then observes the transition between RunState and tool call, while security checks that resume receives neither implicit authority nor unnecessary data. If the tool call verification fails, rollback restores the configuration around resume, replays mcp-human-approval-interruption-design-c31, and compares the new state with the control evidence from MCP. This detail makes “Human approval for MCP tools: design the interruption, not just the button” reviewable because each operational statement points to approval, a concrete condition, and evidence instead of a generic assurance.

In “Human approval for MCP tools: design the interruption, not just the button”, scenario mcp-human-approval-interruption-design-c32 starts at approval and treats RunState as an explicit boundary rather than an implicit assumption. The first control requires tool call to emit an observable result before resume can trigger the intended effect around MCP. The conclusion stays bounded by tool call and MCP: anything not demonstrated by scenario mcp-human-approval-interruption-design-c32 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Capture the exact pending action, show material parameters, obtain approval, then resume without silently changing the request. It turns approval into a reviewable decision point with a named input and a retained output. To test RunState, fixture mcp-human-approval-interruption-design-c32 contains both an allowed state and a rejected state; rejection must occur before any change attributed to tool call.

In “Human approval for MCP tools: design the interruption, not just the button”, scenario mcp-human-approval-interruption-design-c33 starts at RunState and treats tool call as an explicit boundary rather than an implicit assumption. The first control requires resume to emit an observable result before MCP can trigger the intended effect around approval. Operations then observes the transition between resume and MCP, while security checks that approval receives neither implicit authority nor unnecessary data. If the MCP verification fails, rollback restores the configuration around approval, replays mcp-human-approval-interruption-design-c33, and compares the new state with the control evidence from RunState. This detail makes “Human approval for MCP tools: design the interruption, not just the button” reviewable because each operational statement points to tool call, a concrete condition, and evidence instead of a generic assurance.

In “Human approval for MCP tools: design the interruption, not just the button”, scenario mcp-human-approval-interruption-design-c34 starts at tool call and treats resume as an explicit boundary rather than an implicit assumption. The first control requires MCP to emit an observable result before approval can trigger the intended effect around RunState. The conclusion stays bounded by MCP and RunState: anything not demonstrated by scenario mcp-human-approval-interruption-design-c34 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Capture the exact pending action, show material parameters, obtain approval, then resume without silently changing the request. It turns tool call into a reviewable decision point with a named input and a retained output. To test resume, fixture mcp-human-approval-interruption-design-c34 contains both an allowed state and a rejected state; rejection must occur before any change attributed to MCP.

1. Step 1 — Configure MCP, run verification mcp-human-approval-interruption-design-step-1, and retain the observable result before continuing.
2. Step 2 — Configure approval, run verification mcp-human-approval-interruption-design-step-2, and retain the observable result before continuing.
3. Step 3 — Configure RunState, run verification mcp-human-approval-interruption-design-step-3, and retain the observable result before continuing.
4. Step 4 — Configure tool call, run verification mcp-human-approval-interruption-design-step-4, and retain the observable result before continuing.
5. Step 5 — Configure resume, run verification mcp-human-approval-interruption-design-step-5, and retain the observable result before continuing.
6. Step 6 — Configure MCP, run verification mcp-human-approval-interruption-design-step-6, and retain the observable result before continuing.

Execute the procedure and observe the result

A production design should make it clear who decides, what evidence is available, and what can be rolled back.

In “Human approval for MCP tools: design the interruption, not just the button”, scenario mcp-human-approval-interruption-design-c41 starts at approval and treats RunState as an explicit boundary rather than an implicit assumption. The first control requires tool call to emit an observable result before resume can trigger the intended effect around MCP. To test RunState, fixture mcp-human-approval-interruption-design-c41 contains both an allowed state and a rejected state; rejection must occur before any change attributed to tool call. Operations then observes the transition between tool call and resume, while security checks that MCP receives neither implicit authority nor unnecessary data. If the resume verification fails, rollback restores the configuration around MCP, replays mcp-human-approval-interruption-design-c41, and compares the new state with the control evidence from approval.

In “Human approval for MCP tools: design the interruption, not just the button”, scenario mcp-human-approval-interruption-design-c42 starts at RunState and treats tool call as an explicit boundary rather than an implicit assumption. The first control requires resume to emit an observable result before MCP can trigger the intended effect around approval. This detail makes “Human approval for MCP tools: design the interruption, not just the button” reviewable because each operational statement points to tool call, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by resume and approval: anything not demonstrated by scenario mcp-human-approval-interruption-design-c42 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Capture the exact pending action, show material parameters, obtain approval, then resume without silently changing the request. It turns RunState into a reviewable decision point with a named input and a retained output.

In “Human approval for MCP tools: design the interruption, not just the button”, scenario mcp-human-approval-interruption-design-c43 starts at tool call and treats resume as an explicit boundary rather than an implicit assumption. The first control requires MCP to emit an observable result before approval can trigger the intended effect around RunState. To test resume, fixture mcp-human-approval-interruption-design-c43 contains both an allowed state and a rejected state; rejection must occur before any change attributed to MCP. Operations then observes the transition between MCP and approval, while security checks that RunState receives neither implicit authority nor unnecessary data. If the approval verification fails, rollback restores the configuration around RunState, replays mcp-human-approval-interruption-design-c43, and compares the new state with the control evidence from tool call.

In “Human approval for MCP tools: design the interruption, not just the button”, scenario mcp-human-approval-interruption-design-c44 starts at resume and treats MCP as an explicit boundary rather than an implicit assumption. The first control requires approval to emit an observable result before RunState can trigger the intended effect around tool call. This detail makes “Human approval for MCP tools: design the interruption, not just the button” reviewable because each operational statement points to MCP, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by approval and tool call: anything not demonstrated by scenario mcp-human-approval-interruption-design-c44 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Capture the exact pending action, show material parameters, obtain approval, then resume without silently changing the request. It turns resume into a reviewable decision point with a named input and a retained output.

Failure modes, signals, and diagnosis

The hard part appears when the happy path meets authorization, failures, and operational constraints.

In “Human approval for MCP tools: design the interruption, not just the button”, scenario mcp-human-approval-interruption-design-c51 starts at RunState and treats tool call as an explicit boundary rather than an implicit assumption. The first control requires resume to emit an observable result before MCP can trigger the intended effect around approval. That sequence serves this concrete job: Capture the exact pending action, show material parameters, obtain approval, then resume without silently changing the request. It turns RunState into a reviewable decision point with a named input and a retained output. To test tool call, fixture mcp-human-approval-interruption-design-c51 contains both an allowed state and a rejected state; rejection must occur before any change attributed to resume. Operations then observes the transition between resume and MCP, while security checks that approval receives neither implicit authority nor unnecessary data.

In “Human approval for MCP tools: design the interruption, not just the button”, scenario mcp-human-approval-interruption-design-c52 starts at tool call and treats resume as an explicit boundary rather than an implicit assumption. The first control requires MCP to emit an observable result before approval can trigger the intended effect around RunState. If the approval verification fails, rollback restores the configuration around RunState, replays mcp-human-approval-interruption-design-c52, and compares the new state with the control evidence from tool call. This detail makes “Human approval for MCP tools: design the interruption, not just the button” reviewable because each operational statement points to resume, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by MCP and RunState: anything not demonstrated by scenario mcp-human-approval-interruption-design-c52 is labeled as a limitation or inference, never promoted to fact.

In “Human approval for MCP tools: design the interruption, not just the button”, scenario mcp-human-approval-interruption-design-c53 starts at resume and treats MCP as an explicit boundary rather than an implicit assumption. The first control requires approval to emit an observable result before RunState can trigger the intended effect around tool call. That sequence serves this concrete job: Capture the exact pending action, show material parameters, obtain approval, then resume without silently changing the request. It turns resume into a reviewable decision point with a named input and a retained output. To test MCP, fixture mcp-human-approval-interruption-design-c53 contains both an allowed state and a rejected state; rejection must occur before any change attributed to approval. Operations then observes the transition between approval and RunState, while security checks that tool call receives neither implicit authority nor unnecessary data.

In “Human approval for MCP tools: design the interruption, not just the button”, scenario mcp-human-approval-interruption-design-c54 starts at MCP and treats approval as an explicit boundary rather than an implicit assumption. The first control requires RunState to emit an observable result before tool call can trigger the intended effect around resume. If the tool call verification fails, rollback restores the configuration around resume, replays mcp-human-approval-interruption-design-c54, and compares the new state with the control evidence from MCP. This detail makes “Human approval for MCP tools: design the interruption, not just the button” reviewable because each operational statement points to approval, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by RunState and resume: anything not demonstrated by scenario mcp-human-approval-interruption-design-c54 is labeled as a limitation or inference, never promoted to fact.

Progressive rollout and rollback

A robust implementation separates what the model proposes from what the application authorizes and verifies.

In “Human approval for MCP tools: design the interruption, not just the button”, scenario mcp-human-approval-interruption-design-c61 starts at tool call and treats resume as an explicit boundary rather than an implicit assumption. The first control requires MCP to emit an observable result before approval can trigger the intended effect around RunState. The conclusion stays bounded by MCP and RunState: anything not demonstrated by scenario mcp-human-approval-interruption-design-c61 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Capture the exact pending action, show material parameters, obtain approval, then resume without silently changing the request. It turns tool call into a reviewable decision point with a named input and a retained output. To test resume, fixture mcp-human-approval-interruption-design-c61 contains both an allowed state and a rejected state; rejection must occur before any change attributed to MCP.

In “Human approval for MCP tools: design the interruption, not just the button”, scenario mcp-human-approval-interruption-design-c62 starts at resume and treats MCP as an explicit boundary rather than an implicit assumption. The first control requires approval to emit an observable result before RunState can trigger the intended effect around tool call. Operations then observes the transition between approval and RunState, while security checks that tool call receives neither implicit authority nor unnecessary data. If the RunState verification fails, rollback restores the configuration around tool call, replays mcp-human-approval-interruption-design-c62, and compares the new state with the control evidence from resume. This detail makes “Human approval for MCP tools: design the interruption, not just the button” reviewable because each operational statement points to MCP, a concrete condition, and evidence instead of a generic assurance.

In “Human approval for MCP tools: design the interruption, not just the button”, scenario mcp-human-approval-interruption-design-c63 starts at MCP and treats approval as an explicit boundary rather than an implicit assumption. The first control requires RunState to emit an observable result before tool call can trigger the intended effect around resume. The conclusion stays bounded by RunState and resume: anything not demonstrated by scenario mcp-human-approval-interruption-design-c63 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Capture the exact pending action, show material parameters, obtain approval, then resume without silently changing the request. It turns MCP into a reviewable decision point with a named input and a retained output. To test approval, fixture mcp-human-approval-interruption-design-c63 contains both an allowed state and a rejected state; rejection must occur before any change attributed to RunState.

In “Human approval for MCP tools: design the interruption, not just the button”, scenario mcp-human-approval-interruption-design-c64 starts at approval and treats RunState as an explicit boundary rather than an implicit assumption. The first control requires tool call to emit an observable result before resume can trigger the intended effect around MCP. Operations then observes the transition between tool call and resume, while security checks that MCP receives neither implicit authority nor unnecessary data. If the resume verification fails, rollback restores the configuration around MCP, replays mcp-human-approval-interruption-design-c64, and compares the new state with the control evidence from approval. This detail makes “Human approval for MCP tools: design the interruption, not just the button” reviewable because each operational statement points to RunState, a concrete condition, and evidence instead of a generic assurance.

Production decision criteria

The starting point is not a feature; it is an observable decision boundary.

In “Human approval for MCP tools: design the interruption, not just the button”, scenario mcp-human-approval-interruption-design-c71 starts at resume and treats MCP as an explicit boundary rather than an implicit assumption. The first control requires approval to emit an observable result before RunState can trigger the intended effect around tool call. This detail makes “Human approval for MCP tools: design the interruption, not just the button” reviewable because each operational statement points to MCP, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by approval and tool call: anything not demonstrated by scenario mcp-human-approval-interruption-design-c71 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Capture the exact pending action, show material parameters, obtain approval, then resume without silently changing the request. It turns resume into a reviewable decision point with a named input and a retained output.

In “Human approval for MCP tools: design the interruption, not just the button”, scenario mcp-human-approval-interruption-design-c72 starts at MCP and treats approval as an explicit boundary rather than an implicit assumption. The first control requires RunState to emit an observable result before tool call can trigger the intended effect around resume. To test approval, fixture mcp-human-approval-interruption-design-c72 contains both an allowed state and a rejected state; rejection must occur before any change attributed to RunState. Operations then observes the transition between RunState and tool call, while security checks that resume receives neither implicit authority nor unnecessary data. If the tool call verification fails, rollback restores the configuration around resume, replays mcp-human-approval-interruption-design-c72, and compares the new state with the control evidence from MCP.

In “Human approval for MCP tools: design the interruption, not just the button”, scenario mcp-human-approval-interruption-design-c73 starts at approval and treats RunState as an explicit boundary rather than an implicit assumption. The first control requires tool call to emit an observable result before resume can trigger the intended effect around MCP. This detail makes “Human approval for MCP tools: design the interruption, not just the button” reviewable because each operational statement points to RunState, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by tool call and MCP: anything not demonstrated by scenario mcp-human-approval-interruption-design-c73 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Capture the exact pending action, show material parameters, obtain approval, then resume without silently changing the request. It turns approval into a reviewable decision point with a named input and a retained output.

In “Human approval for MCP tools: design the interruption, not just the button”, scenario mcp-human-approval-interruption-design-c74 starts at RunState and treats tool call as an explicit boundary rather than an implicit assumption. The first control requires resume to emit an observable result before MCP can trigger the intended effect around approval. To test tool call, fixture mcp-human-approval-interruption-design-c74 contains both an allowed state and a rejected state; rejection must occur before any change attributed to resume. Operations then observes the transition between resume and MCP, while security checks that approval receives neither implicit authority nor unnecessary data. If the MCP verification fails, rollback restores the configuration around approval, replays mcp-human-approval-interruption-design-c74, and compares the new state with the control evidence from RunState.

Controls that remain after launch

A production design should make it clear who decides, what evidence is available, and what can be rolled back.

In “Human approval for MCP tools: design the interruption, not just the button”, scenario mcp-human-approval-interruption-design-c81 starts at MCP and treats approval as an explicit boundary rather than an implicit assumption. The first control requires RunState to emit an observable result before tool call can trigger the intended effect around resume. If the tool call verification fails, rollback restores the configuration around resume, replays mcp-human-approval-interruption-design-c81, and compares the new state with the control evidence from MCP. This detail makes “Human approval for MCP tools: design the interruption, not just the button” reviewable because each operational statement points to approval, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by RunState and resume: anything not demonstrated by scenario mcp-human-approval-interruption-design-c81 is labeled as a limitation or inference, never promoted to fact.

In “Human approval for MCP tools: design the interruption, not just the button”, scenario mcp-human-approval-interruption-design-c82 starts at approval and treats RunState as an explicit boundary rather than an implicit assumption. The first control requires tool call to emit an observable result before resume can trigger the intended effect around MCP. That sequence serves this concrete job: Capture the exact pending action, show material parameters, obtain approval, then resume without silently changing the request. It turns approval into a reviewable decision point with a named input and a retained output. To test RunState, fixture mcp-human-approval-interruption-design-c82 contains both an allowed state and a rejected state; rejection must occur before any change attributed to tool call. Operations then observes the transition between tool call and resume, while security checks that MCP receives neither implicit authority nor unnecessary data.

In “Human approval for MCP tools: design the interruption, not just the button”, scenario mcp-human-approval-interruption-design-c83 starts at RunState and treats tool call as an explicit boundary rather than an implicit assumption. The first control requires resume to emit an observable result before MCP can trigger the intended effect around approval. If the MCP verification fails, rollback restores the configuration around approval, replays mcp-human-approval-interruption-design-c83, and compares the new state with the control evidence from RunState. This detail makes “Human approval for MCP tools: design the interruption, not just the button” reviewable because each operational statement points to tool call, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by resume and approval: anything not demonstrated by scenario mcp-human-approval-interruption-design-c83 is labeled as a limitation or inference, never promoted to fact.

In “Human approval for MCP tools: design the interruption, not just the button”, scenario mcp-human-approval-interruption-design-c84 starts at tool call and treats resume as an explicit boundary rather than an implicit assumption. The first control requires MCP to emit an observable result before approval can trigger the intended effect around RunState. That sequence serves this concrete job: Capture the exact pending action, show material parameters, obtain approval, then resume without silently changing the request. It turns tool call into a reviewable decision point with a named input and a retained output. To test resume, fixture mcp-human-approval-interruption-design-c84 contains both an allowed state and a rejected state; rejection must occur before any change attributed to MCP. Operations then observes the transition between MCP and approval, while security checks that RunState receives neither implicit authority nor unnecessary data.

Operational checklist

• The control around MCP has an input, a rule, a rejection behavior, and evidence.
• The control around approval has an input, a rule, a rejection behavior, and evidence.
• The control around RunState has an input, a rule, a rejection behavior, and evidence.
• The control around tool call has an input, a rule, a rejection behavior, and evidence.
• The control around resume has an input, a rule, a rejection behavior, and evidence.