Implement generative AI and agentic solutions 2.2 Build agents by using Foundry
An agent uses an MCP tool configured with require_approval set to always.
Study guide skill: Build autonomous or semiautonomous workflows with safeguards and approval flow controls
Question B3-014
An agent uses an MCP tool configured with require_approval set to always. The response to a user request contains an output item of type mcp_approval_request. What should your application do next?
Select one answer.
Answer: B
When approval is required, the run pauses and returns an mcp_approval_request; your app reviews the server, tool, and arguments and continues by sending an mcp_approval_response that references the request ID, together with previous_response_id. Microsoft recommends requiring approval for high-risk tools and reviewing the tool name and arguments before you approve, so removing the approval step defeats the safeguard. Tool descriptions and results from remote MCP servers should be treated as untrusted input because they can contain prompt injection.
Deep dive
How it works
An MCP tool's require_approval setting decides whether a developer must approve calls:
- always: approval is needed for every call. It's also the default if you don't provide a value.
- never: no approval is required.
- Lists such as {"never": [...]} or {"always": [...]} set it per tool.
With approval required, the tool doesn't run yet. The response contains an mcp_approval_request item that names the server label, the tool and its arguments. Your app then:
- Shows a reviewer the server, tool name and arguments.
- Adds an mcp_approval_response item with approval_request_id set to the request's ID and approve set to true or false.
- Calls the Responses API again with previous_response_id so the agent continues where it stopped.
The Microsoft samples print exactly these fields and say to approve only after you review the tool call, and to build your own approval UX and policy in production.
The security guidance adds: use an allow list (allowed_tools), require approval for high-risk operations (especially tools that write data or change resources), review the tool name and arguments before you approve, and treat tool descriptions, annotations and results from remote MCP servers as untrusted input, because they can contain indirect prompt injection.
The other options, and when you'd use them
- Auto-approve when the tool description says it's safe: Tool descriptions are untrusted input and can carry prompt injection.
- Switch require_approval to never and resend: That removes the safeguard Microsoft recommends for high-risk operations.
- Do nothing because it already ran: With always, a developer must provide approval for every call. The run waits for your response.
Exam tip
mcp_approval_request -> review -> mcp_approval_response (approval_request_id + approve) + previous_response_id.
References
Last reviewed: