# Consent

> Review and approve an agent action before it runs.

Source: https://docs.synkro.sh/guides/consent

A Rule with `ask` pauses an action for your review. Only a human can approve it. The approval applies to that exact action for one retry.

Example Rules:

| Rule | What happens |
| --- | --- |
| Ask before deleting files in `reports/` | Synkro pauses the deletion. You can check the exact files, then approve that attempt. |
| Flag commands that add a dependency, such as `pnpm add` | The command can run, and Synkro records the match for later review. No approval is needed. |
| Block edits to generated API clients | The edit is refused. The agent must update the source schema and regenerate the client. |

If an action matches both an `ask` and a `block` Rule, the block wins.

## Approve in your signed-in session

These steps apply when you signed in to the CLI with `synkro login` or
`synkro install`. If you connected the agent through `synkro onboard`, use
the owner approval steps below.

1. Read the exact command or tool action Synkro refused.
2. Reply `allow it` in the same agent session.
3. The agent retries that same action.
4. The retry uses the approval once.

Approval does not cover a different command, destination, or set of inputs.

Use `allow it`, not a general "yes". Letter case and trailing punctuation do not matter.

## Approve an action after onboarding

For a connection set up through `synkro onboard`, an organization owner reviews
the request and approves it through the authenticated owner API:
`POST /api/v1/consents/{id}/decision`.

The request must name that exact consent ID, harness and stored session ID,
with `action: "grant"` and a non-empty `reason`. Use the stored session identity,
not just the provider's session string. The agent then retries the identical
tool call once. Ending its session cancels the request.

## Cancel or refuse

In your signed-in session, reply `cancel it` or `deny it` to close the pending
request without allowing it. For a connection approved through `synkro onboard`,
the human owner uses the same API with `action: "cancel"` or `action: "deny"`.

A new request replaces an older unapproved one. Read the latest request first.

## Time and session limits

Requests and approvals expire after **15 minutes by default**.

Approval belongs to the session that requested it. Ending that session clears it.

### Headless runs

Cursor CLI `--print` does not send `beforeSubmitPrompt`. It cannot grant
consent from a prompt containing `allow it`. Use interactive Cursor CLI with
the current Synkro integration; check `configuredHarnesses.cursor` in
`synkro status --json` and run `synkro update` if it is false.

`codex exec` ends its session when the run finishes. That cancels any pending
approval. `codex exec resume ... "allow it"` cannot approve the cancelled
request.

For work that needs your approval, keep the agent session open and use
the approval steps above before leaving it. In your signed-in interactive
`codex` session, you can reply `allow it`; a connection approved through
`synkro onboard` requires owner API approval. The same session limit applies
to other agents.

## What approval cannot do

- Override a `block` Rule.
- Remove the correction required by a `fix` Rule.
- Approve unrelated future work.

If approval storage is unavailable, Synkro refuses the action. Check [Troubleshooting](/troubleshooting#session-service-is-unavailable).

## MCP tool approvals are separate

MCP tool approval covers a server/tool coordinate. It is separate from the
single-action consent above: `allow it` and the consent API do not approve an
MCP server or change its approval mode.

In **observe** mode, an unapproved MCP tool receives a notice and may run.
In **enforce** mode, the approval gate blocks it. Project Rules and other
controls still apply in both modes, including Rules about the tool's arguments.
A notice alone does not establish that the call was refused; inspect its verdict.

`synkro status --json` reports the mode in
`health.enforcement.mcpApprovalMode`. Signed-out process health has no tenant mode and
reports `null`; a failed configuration read also remains unknown. `active`
describes enforcement readiness, not observe or enforce mode.

Use [Approve MCP tools](/guides/mcp-approvals) for persistent project declarations,
package defaults and revocation. Review the exact server, tool and project before
changing them. A limited agent connection's refusal does not authorize replacing
its credentials with the owner's credentials.