# The Human Gate: Designing MCP Tool Approvals at the Gateway Boundary

[By Boyu Wang](/content/blogs/authors/boyu/index.html)

Published: August 14, 2026

## Built for Speed: ~10ms Latency, Even Under Load

Blazingly fast way to build, track and deploy your models!

- Handles 350+ RPS on just 1 vCPU — no tuning needed
- Production-ready with full enterprise support

MCP gives clients and servers a standard way to discover and invoke tools. It deliberately does _not_ standardize one approval UI or one human-in-the-loop workflow. The [2026-07-28 Tools specification](https://modelcontextprotocol.io/specification/2026-07-28/server/tools) says implementations are free to choose their interaction model, while recommending that applications keep a human able to deny tool invocations. TrueFoundry's [MCP Tool Approvals](/content/docs/ai-gateway/mcp/mcp-tool-approval/index.html) sit in that implementation space: the Gateway can hold a matched `tools/call`, create an approval request, notify an approver, and return a successful result carrying TrueFoundry-specific approval metadata so a compatible caller can distinguish _waiting for approval_ from _tool execution failed_.

### Key Takeaways

- **MCP recommends human control but does not define a universal approval protocol.** The 2026-07-28 tool specification leaves the user-interaction model to implementations.
- The 2026-07-28 revision still matters: MCP now has richer machinery for interrupted tool workflows, including multi round-trip input_required results and the separate Tasks extension.
- A gated call is held at the Gateway and the caller receives a successful result with _meta.approval_status set to pending.
- Approval can be **one execution or time-boxed authority.** A time-based grant applies to the documented requester + MCP server + tool tuple until expiry.
- The human is the **decision authority**; the Gateway is the **enforcement point** that holds or releases the tool call.
- Denial is intentionally non-durable: it rejects the moment in front of the approver.
- Tool annotations such as destructiveHint are useful inputs to approval policy, but MCP requires clients to treat annotations as untrusted unless they come from trusted servers.

## 1. Start at the Protocol Boundary

The most important distinction is between **what MCP standardizes** and **what the Gateway implements**. MCP standardizes tool discovery, invocation, schemas, results, and—in the 2026-07-28 revision—richer ways for a tool workflow to require additional input.

TrueFoundry's documented flow can be read as six steps..... (content continues)

**The pause is an implementation-level state, not a protocol error.**

**_Figure 1:_** _TrueFoundry MCP Tool Approval flow._

## 2. The Security Semantics Are in the Scope

The approval feature is easiest to reason about when it is treated as a narrow authorization checkpoint rather than as a universal safety layer. Four properties matter.

| Mechanism | Security property | Engineering caveat |
| --- | --- | --- |
| Pending success result with _meta | Separates "waiting for approval" from tool failure | TrueFoundry convention; callers must implement the branch explicitly |
| One-execution approval | Human decision is bound tightly to the pending execution | Higher interaction cost for repeated safe repetitions |
| Time-based grant | Temporary authority for requester + server + tool | Later invocations in the window are not fresh human reviews of their arguments |
| Requester-scoped grant | One principal's approval does not automatically transfer to another | Depends on trustworthy requester identity at the Gateway |
| Non-durable denial | Keeps momentary judgment separate from standing access policy | Use RBAC/tool exposure/policy for permanent prohibition |

## 3. Approval Fatigue Is an Operational Failure Mode

Human approval only adds safety when the human decision contains information that the static policy does not. ...

## 4. Where the Gate Sits — and What It Does Not Replace

A production tool path needs several controls with different jobs. ...

## References

- Primary MCP sources — [MCP 2026-07-28 Tools specification](https://modelcontextprotocol.io/specification/2026-07-28/server/tools)
- TrueFoundry documentation — [MCP Tool Approvals](/content/docs/ai-gateway/mcp/mcp-tool-approval/index.html);

**Product mechanics in this article are described from current TrueFoundry documentation; protocol claims are grounded in the MCP 2026-07-28 specification and official release material.**