GC AI actions
When GC AI actions are enabled for your account, a personal API key can use supported member actions within its owner’s access. GC AI checks the owner’s current organization membership when the completion starts. Actions also enforce the owner’s permissions and access to each requested resource. Organization API keys do not receive these member actions. Your saved tool choices apply to personal-key requests:
Actions that require approval by default are also unavailable unless the optional
safety check approves the call. Actions that run without approval by default
remain available unless your saved choices restrict them.
Use
blocked_tools to exclude additional actions for one request. Values are tool
names, such as projects_delete. Request Blocks can only restrict your saved
choices. They cannot grant permission or make an unavailable action run.
Optional safety check
Setauto_accept: true to request a safety check for actions that require approval
by default. The API safety check must be enabled for your account, and you must
also turn on the safety check in your own tool settings. Each request must opt in.
The check evaluates each proposed call against your request. It never approves
deleting, sharing, or sending. Your explicit Needs approval and Block choices
still withhold the action. If the check rejects a call or cannot decide, the call
does not run and the completion can continue without it.
The result includes judge_approved_steps for calls the check approved and
skipped_steps for calls it rejected. Each entry is a tool name. These fields
describe calls evaluated by the check. They do not list every action excluded
before the completion started. Approval by the check does not guarantee that an
action succeeds or passes its normal authorization checks.