@housecall Get started
Docs menu

Approvals

# it-helpThread

  1. Sam

    @housecall I left my laptop on the train 😬

  2. @housecall App

    I can lock it and sign you out everywhere. Each one needs your OK.

    Lock device: MacBook Pro C02FK3, message “Found it? Call +1 415 555 0134”

    kandji_lock_device {"serial":"C02FK3"}

    ✓ Approved by Sam · Locked

    Approval needed: Sign Sam out of every Okta session

    okta_clear_sessions {"user":"sam"}

    Only Sam can approve or deny.

Some tools change things, like locking a laptop. Before one of these tools runs, @housecall asks the person who asked for help. It posts a message that says what it will do, with an Approve button and a Deny button. Only that person’s click counts.

Code extension tools with write: true ask first. MCP tools ask first unless they are listed in read_only.

Approving is not IT saying yes

Anyone can approve their own request. That does not mean IT said yes. So:

  • Each tool should only change the account of the person who asked, or check first that they’re allowed. In a code extension, requester(api, context) tells you who asked; see Code extensions.
  • Don’t give everyone tools that only admins should use, like resetting someone else’s MFA.
  • For MCP servers, tools listed in read_only run without asking. Only list tools that are safe for anyone to use. Don’t add MCP servers that have admin tools.

What happens

  1. The model calls a write tool.
  2. @housecall posts a card in the thread with a one-line summary, the tool name and its arguments, and Approve and Deny buttons.
  3. The person who asked clicks Approve or Deny. If someone else clicks, it doesn’t count, and they’re told only the person who asked can choose.
  4. The card shows what they chose.
  5. If they approve, the tool runs once. If they deny, the model is told not to try again unless that person asks again.
approvals: { timeout_minutes: 60 }

If nobody chooses within approvals.timeout_minutes (default 60), the tool does not run. The model asks whether to try again.

On each platform

PlatformCardIf someone else clicks
SlackBlock Kit buttonsA note only the person who clicked can see
Microsoft TeamsAdaptive CardA short message to the person who clicked
Google ChatCard with buttonsA reply visible in the conversation
ConsoleType approve <id> or deny <id>

Restarts

Approvals are saved. If @housecall restarts, a waiting approval and its buttons still work. If @housecall crashes at the exact moment it posts the message, it may post it twice.

If @housecall stops after someone approved but before the tool finished, it won’t run the tool again. It tells the model the change may already have happened and asks it to check first.

While an approval is waiting

New messages in the same thread are added to the same request. They don’t start a new one. If the model wants to use a write tool because of someone else’s message, that person is the one asked to approve.