Every permission check returns one of three results
- allowed means the tool can execute immediately. Your agent should proceed.
- requires_approval means a human must review and approve the action before it executes. Your system should create an approval request and wait for a decision.
- disabled means the tool must not execute under any circumstances. Your agent should not attempt the action.