> ## Documentation Index
> Fetch the complete documentation index at: https://resources.athenaintel.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Workspace tool policy

> Set workspace approval modes and understand session overrides and public API refusals

The Tool Registry sets workspace policy for tool availability and approval. Use it to decide which tools require review and whether eligible session approvals can cover later calls.

![A tool call branches into three approval modes: no approval required runs, approval required with override asks and allows a session approval, approval required with no override asks every time.](https://mintcdn.com/athenaintelligence-e46bc9d3/6ueVSVCwufwDQRFe/images/diagrams/tool-approval-modes.webp?fit=max\&auto=format\&n=6ueVSVCwufwDQRFe\&q=85\&s=dad94aa04a3ba38cb9700f7874664beb)

The approval mode set for a tool decides whether a call runs, asks, or asks every time.

## Who can change policy

Workspace owners and administrators with live membership in the workspace can change its tool policy. Athena staff can also administer policy. A manager role alone does not grant this permission.

The sidebar lists **Tool Registry** under **Workspace** for workspace owners.

## Set a tool's approval mode

1. Select **Tool Registry** under **Workspace**.
2. In **Tool Registry Management**, find the tool under **Available Tools**.
3. Use the search field to find it by name or ID.
4. In **Approval Mode**, select the policy you need.

The selection saves the tool's configuration. Review the selected value after the update completes.

| UI label | Stored value | Registry behavior |
| - | - | - |
| **No approval required** | `no_approval` | The registry does not add an approval requirement. |
| **Approval required (allow override)** | `required_with_override` | Approval is required unless an eligible override applies. |
| **Approval required (no override)** | `required_no_override` | Approval is required and session overrides cannot bypass it. |

## Keep mandatory checks

A tool call can have requirements beyond its registry row. For example, a calendar deletion keeps an approval requirement even when routine calendar updates use **No approval required**.

For public API calls, a tool's own mandatory approval or sensitivity gate remains in force whatever the registry says. **No approval required** does not remove those gates.

In chat, a tool's definition supplies the default when there is no registry entry. An explicit registry policy can change that default. Call-specific mandatory checks still apply.

> [!NOTE]
>
> The registry's mode alone does not guarantee that a call runs without review. The tool, the action being performed, and the execution surface can impose additional requirements.

## Relate workspace policy to session approvals

An eligible approval request can offer **Approve all for this session**. It approves the displayed actions and later eligible calls covered by that allowance in the same session.

**Approval required (allow override)** permits eligible overrides. **Approval required (no override)** keeps individual approval in place and does not offer the session allowance for that tool.

A session allowance does not change workspace policy or carry into a new session. Review [session approvals](https://resources.athenaintel.com/docs/pillars/applications/session-approvals.md) for the controls and limits on edited proposals and subagent dispatches.

## Call tools through the public API

Public API tool calls do not pause and wait for a person to click an approval button.

When workspace policy requires approval, the public tool invocation routes refuse the call with HTTP `403` and the code `tool_requires_approval`. Both required modes refuse these calls. The allow-override mode does not give a person's or agent's API call a standing approval grant.

1. Check the response code and message.
2. If the call needs a person's approval, run it in an Athena chat session where the approval can be reviewed.
3. For automated work that needs a reviewer, use an approval step in an Automation. An API request is not an approval.

Tool availability is checked separately. Setting an approval mode does not enable a disabled tool or grant access to an asset the caller cannot use.

## Related

* [Session approvals](https://resources.athenaintel.com/docs/pillars/applications/session-approvals.md)
* [Audit records](https://resources.athenaintel.com/docs/getting-started/audit-records.md)
* [API overview](https://resources.athenaintel.com/docs/developer-integrations/api-reference.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.