Tool Confirmations
Every tool in Thallus can have confirmation enabled, so you always have the option to review an action before it runs. High-impact tools — sending messages, deleting records, creating tickets — have confirmation turned on by default. When confirmation is active, the tool pauses before executing and shows a confirmation card in the chat. This prevents accidental actions: Thallus won't send a Slack message or delete a calendar event without your explicit approval.
The confirmation prompt
When an agent tries to use a tool that requires confirmation, the chat displays a confirmation card instead of executing immediately:
The card shows the action name, a description of what will happen, and a preview of key parameters (like the channel and message content). Below that are two buttons:
- Approve — Executes the action immediately and shows the result inline
- Deny — Cancels the action. Thallus notes the denial and continues without taking the action
Confirmations expire after a timeout if you don't respond. An expired confirmation is treated the same as a denial.
Which tools require confirmation by default
The following tools ship with confirmation enabled. These are all write or delete operations that could have side effects outside of Thallus. You can also enable confirmation on any other tool — including read-only tools — from the Tool Settings panel.
| Agent | Tools requiring confirmation |
|---|---|
| Airtable | airtable_create_records, airtable_delete_records |
| Apple iCloud | icloud_send_email |
| Asana | asana_create_task |
| ClickUp | clickup_create_task |
| Confluence | confluence_create_page, confluence_delete_page |
| GitHub | github_create_issue, github_create_pull_request, github_merge_pull_request |
| GoHighLevel | ghl_send_message, ghl_create_contact, ghl_create_opportunity |
google_send_email, google_create_event, google_delete_event |
|
| HubSpot | hubspot_create_record |
| Jira | jira_create_issue, jira_delete_issue |
| Linear | linear_create_ticket, linear_create_issue |
| Microsoft 365 | m365_send_email, m365_reply_email, m365_create_calendar_event, m365_delete_calendar_event, m365_send_channel_message, m365_reply_to_message |
| Monday.com | monday_create_item, monday_delete_item |
| Nextcloud | nextcloud_delete_file, nextcloud_create_share, nextcloud_create_event |
| Notion | notion_create_page, notion_delete_block |
| Salesforce | salesforce_create_record |
| Shopify | shopify_create_product, shopify_create_draft_order |
| Slack | slack_send_message |
| Stripe | stripe_cancel_subscription |
| Zendesk | zendesk_create_ticket, zendesk_delete_ticket |
Managing confirmations
You can enable or disable confirmation on any tool. To add confirmation to a tool that doesn't require it by default, or to remove it from one that does:
- Go to the Agents page
- Expand the agent card (e.g. Slack)
- Open Tool Settings
- Find the tool and its Require confirmation toggle
- Check to enable, or uncheck to disable
Every tool shows a shield icon and a confirmation toggle. Orange means confirmation is active; dimmed means it's off. You can toggle confirmation on any tool regardless of its default setting.
Restoring defaults
To re-enable confirmation on a default tool you previously turned off, or to disable confirmation on a tool you previously turned on, follow the same steps above and toggle the Require confirmation checkbox. The change takes effect immediately for the next tool call — no need to refresh or restart a conversation.
Confirmations can't be bypassed by prompts
Tool confirmations are enforced by code, not by the AI. The model decides which tool to call, but it has no control over whether the confirmation card appears. After the model generates a tool call, a programmatic check runs before execution — if the tool requires confirmation, the card is shown regardless of what the conversation says.
This means prompt injection attempts like "do not ask for confirmation" or "skip the approval step" have no effect:
channel id: C0AHXANUDKM
The confirmation still appears because the check is a simple code path: look up the tool's requires_confirmation flag, check for any user preference override in the database, and enforce the result. The model's output — including any user instructions it may have been given — is never consulted.
The only ways to change confirmation behavior are through the Tool Settings panel (per-user preference) or, in workflows, the per-node "Skip tool confirmations" advanced setting.
Confirmations in workflows
When a workflow action node calls an agent that triggers a confirmation-required tool, the entire workflow pauses — the same way it pauses at an Approval node. The pending confirmation appears in the workflow's approval queue, and the workflow remains in an Awaiting Approval state until you respond.
- Approve — the tool executes with the stored parameters, the result is saved as the action node's output, and the workflow continues to the next node
- Deny — the tool is not executed and the action node fails
Skipping confirmations per node
For fully automated workflows where you don't want execution to pause, action nodes have a Skip tool confirmations setting in the Advanced Settings panel. When enabled, all tools execute immediately without confirmation — even tools that would normally require it.
How it works with access control
Tool confirmations are independent from tool access control (allow/deny). These are separate concerns:
- A tool can be allowed but require confirmation — it will run, but only after you approve
- A tool can be allowed with confirmation disabled — it runs immediately when the agent decides to use it
- A tool that is disabled entirely (via the main toggle) won't run at all — no confirmation needed
Disabling a tool via access control is a stronger restriction than requiring confirmation. If you don't want a tool to run under any circumstances, disable it. If you want it available but want to review each use, keep confirmation on.
For more on access control, see Agent Access Control.
Next steps
- Turning Agents & Tools On/Off — Toggle agents and individual tools
- Agent Access Control — Understand the 4-tier permission hierarchy
- Available Agents — See which agents exist and what they do
- Approval Nodes — Explicit human-in-the-loop steps in workflows
- Node Types — Action node settings including confirmation overrides