One definition per tool

import { defineTool } from '@astroloop/sdk'

export const github = defineTool({
  name: 'github',
  reads:  ['repos', 'issues', 'pulls'],
  writes: ['comments', 'branches'],
  approval: ['merge', 'force-push'],
  audit: true,
})

Why not the prompt

An instruction that says “always ask before merging” works almost every time, which is the worst possible result: often enough to trust, not often enough to be safe. Long runs fill their context, early instructions fall out of the useful window, and the model does the reasonable thing with what it can still see.

approval is checked where the call is made. The agent is not asked to respect it, so there is nothing to talk its way around.

Revoking

Delete a line and the capability is gone on the next call, including in the middle of a run that is already in flight.