Approvals on messaging surfaces | Runtype Documentation

When you turn on Tool approval, you must approve a gated tool before the Agent runs it. Each Surface collects your decision differently. The authenticated dashboard Run interface, Slack, and Telegram show controls. SMS and iMessage collect your decision from your reply. Client Chat and chat widgets cannot host human approvals.

Use this table to check how each Surface collects an approval:

Surface	Approval method	Requirement
Dashboard Run interface	Explicit Approve and Deny controls	None
Slack	Native channel controls	Agent loop with Max turns set to 2 or higher
Telegram	Native channel controls	Agent loop with Max turns set to 2 or higher and a configured webhook secret
SMS	Your reply text	Agent loop with Max turns set to 2 or higher and a configured Twilio Auth Token
iMessage	Your reply text	Agent loop with Max turns set to 2 or higher and a configured Sendblue signing secret
Client Chat, chat widget	No approval path	Approval-gated requests return HTTP `501` with `APPROVAL_MODE_UNSUPPORTED`
Email, WhatsApp, Discord, generic messaging	No approval path	Approval-gated Agents fail closed

Single-pass Runtype Agents fail closed for approval-gated messaging runs because they cannot resume after an approval decision arrives. For a Runtype Agent on Slack, Telegram, SMS, or iMessage, turn on Agent loop and set Max turns to 2 or higher. A Managed external Agent is compiled into an effective Runtime Agent Loop and does not need an authored Agent Loop or Max turns setting. Telegram, SMS, and iMessage still require the inbound verification credential shown in the table.

Reply-based approval adds no approval-specific setting. Configure the Surface’s inbound credential and attach approval-required tools to an Agent. For an ordinary Runtype Agent, also enable Agent loop. Runtype accepts replies only when the Surface has the credential that its webhook verifies.

What the approval message looks like

The approval message contains three parts:

Question: The Agent generates a question that describes the action for you.
Action line: Runtype adds the tool name and a summary of its parameters. Runtype redacts hidden parameter values.
Reply instruction: Runtype adds the instructions Reply YES to approve or NO to deny.

The following sample shows all three parts in one message:

Is it okay if I email the quarterly report to dana@example.com?
Approval needed to run send_email (to: dana@example.com, subject: Quarterly report).
Reply YES to approve or NO to deny.

Read the action line before you reply. The question is generated from the Agent’s approval reason. The action line is generated by Runtype and identifies the tool call that the approval authorizes.

How your reply is read

Runtype reads your reply in two stages:

Exact keywords: Runtype checks exact keywords before it calls a language model. The set includes YES, NO, and close variants such as Y, OK, APPROVE, N, and DENY. It also includes approval and denial emoji such as 👍, ✅, 👎, and ❌.
Other replies: A language model classifies replies that do not match the keyword set. The classification produces an approval, a denial, an unrelated result, or an unclear result.

Apply these rules to replies that do not produce a clear decision:

Unclear or unrelated replies: Runtype leaves the approval pending. It sends a clarification while the re-prompt budget remains, then ignores further non-decisive replies after the budget is spent.
Uncertain approvals: Runtype asks you to confirm. It does not run the tool until you send a clear approval.
Denials: Runtype resumes the Agent with a denial and passes your reply text as context. For example, No, send it to finance instead denies the current tool call and gives the Agent your requested change.

Who can answer

Reply from the same conversation and participant that triggered the run. A reply from a different conversation or phone number does not resolve the approval.

If nobody replies

An approval request expires after 1 hour. After it expires, Runtype does not run the tool, and a later reply does not resume the execution. Start a fresh run to ask the Agent again.

While an approval is pending, reply to the approval before sending unrelated messages in the same conversation. Runtype processes each inbound message as a possible approval reply.

Limits of reply-based approval

Review these limits before you use reply-based approval:

Free-form replies can be misinterpreted. Exact keywords avoid the model classifier. Other replies go through a language model, and an unclear result does not approve the tool. For high-stakes tools, use an approval host with explicit controls: the authenticated dashboard Run interface, Slack, or Telegram.

Prompt injection affects model classification. Runtype excludes the Agent-generated question and parameter values from the classifier input. It limits the classifier to approval, denial, unrelated, or unclear outcomes. These mitigations reduce exposure but do not eliminate it.

Use NO to deny an SMS approval. Do not reply STOP or CANCEL. Carriers treat these terms as opt-out commands and can unsubscribe your number before Runtype receives the message. The approval stays unresolved, and future messages to that number stop.

Requests expire. If you do not reply within 1 hour, the tool does not run.

Compare approval methods

Use this comparison to choose a Surface for a high-stakes tool:

Client Chat and chat widgets do not appear in this comparison because they cannot capture a human approval decision. Their separate client-tool pause uses POST /v1/client/resume and does not authorize an approval-gated server-side tool.

Question	Explicit approval controls (dashboard Run, Slack, Telegram)	Reply-based approval (SMS, iMessage)
How you decide	Select Approve or Deny	Reply with text
Can Runtype misread your reply?	No. The control has one meaning.	Yes. The classifier interprets non-keyword text.
Does a model read your reply?	No. The control returns a decision.	Only when your reply misses the exact keyword set.
Unclear reply	The control returns a decision.	Runtype keeps the approval pending and sends a clarification while its re-prompt budget remains.
Prompt injection path	None	The model classification path has reduced exposure, but it is not eliminated.
Who can decide	You, when you select the control	You, when you reply from the conversation that triggered the run
No response	The request expires, and the tool does not run	The request expires, and the tool does not run
High-stakes tools	Use an explicit control.	Choose a Surface with explicit controls instead.

Next steps

Continue with one of these guides:

Creating and configuring Agents: turn on Tool approval and configure its scope
Setting up a Slack surface: use native approval controls in a channel
Setting up an SMS surface and setting up an iMessage surface: use reply-based approval over text messaging
What are Surfaces?: review the available Surface types