[donework]

Summary

Tools can now ask the user before they run. A model which wants to search the web no longer sends its query to a third party unnoticed: the call waits in the answer, shows its arguments, and runs only once the user allows it.

Which calls ask. Users choose on the tools settings page, and organizations may lock the choice through a configuration plugin (DataTools.ToolApprovalMode):

• Only critical calls (default): calls whose arguments leave for a third party, such as the web search, or which open a web address the AI chose itself. Tools which stay within the organization, such as the Confluence search, the data sources, or the mailboxes, run without asking. Read Web Page opens addresses the user or a tool gave the model without asking, so the Confluence search can still open the pages it found.
• Every call of every tool.
• No call, as before.

The outbound data restriction of a chat applies in every mode.

Confirming a call. The request offers Run, Always allow in this chat, and Decline. Allowing a tool for the whole chat can be switched off by the user or the organization (DataTools.AllowApprovingToolsForWholeChat), for people who must confirm every single call. A declined call does not run; the model is told so and continues with the rest of the request. Each answer keeps one notice per tool: blue when the user allowed it, red when they declined it, orange when both.

Nothing waits unnoticed. Chats and assistants run on when the user leaves them. While a confirmation waits, a warning triangle marks the chat in the workspaces, the assistant on its card, and both in the navigation, and an orange notification appears until nothing waits anymore.

Assistants which work out of sight, such as the batch processing and the SWOT analysis, cannot show a single call. They ask once before the run whether the tools which need confirmation may be used; without permission for whole chats, they do without them.

How did you test it?

• Ran dotnet test; all tests pass, including the new ToolApprovalTests and AssistantSessionToolApprovalTests.
• Ran the app locally with a self-hosted model and tried out: allowing, declining, and allowing for the whole chat in the chat and in the Coding assistant; stopping a request while a call waits; leaving a waiting chat and assistant (notification, badges) and coming back; all three approval modes and the switch for whole chats; batch processing with and without permission.
• Tested the text the model reads after a declined call against a small local model in several scenarios, so that it continues with the rest of the request without looking up the declined subject again.

Required statements

• Review: I have reviewed every change in this pull request and can explain it when asked.
• License: I license my contribution in this pull request, including all commits I add to it later, under the MIT License, and I agree that it is distributed as part of MindWork AI Studio under the project license or under the MIT License.
• Right to contribute: The contribution is my own work, or I have permission to submit it, including the consent of my employer or client where needed. To the best of my knowledge, it does not infringe the rights of others, and AI-generated parts do not reproduce third-party code under incompatible terms.
• Changes by maintainers: I understand that the maintainers will change this pull request to fit the product, and that they may close it.