Tool approvals

When a Relay agent hits a tool it is not cleared for, it asks in the conversation instead of failing silently. Approvals live in the workspace, not in a file on the host.

How a request appears

A daemon-backed agent that needs a tool clearance posts a permission request into the session it is working in. You decide:

• Allow once — this call only (needs write).
• Always allow — store a permanent rule on the agent (needs manage).
• Deny — refuse this call (needs write; never waits for an admin).

Stored rules match the runtime's own rule suggestions byte-for-byte. agensis does not reimplement shell-glob matching, so it cannot drift from the agent runtime's idea of a rule.

What a rule does not grant

A permission rule cannot open a folder. Working-directory access is a separate gate — host folders / additional directories on the daemon. If an agent still cannot write somewhere after an approval, check host folders, not the rule list.

Delivery

A decision is delivered to the exact Relay host connection that raised the request, before it is recorded. A reconnected process has no memory of old request ids, so approving into a different socket would show "Approved" over a tool that never ran.