> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gc.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Tool permissions

> Control GC AI actions in personal API key requests.

## GC AI actions

When GC AI actions are enabled for your account, a personal API key can use
supported member actions within its owner's access. GC AI checks the owner's
current organization membership when the completion starts. Actions also enforce
the owner's permissions and access to each requested resource. Organization API
keys do not receive these member actions.

Your saved tool choices apply to personal-key requests:

| Choice | API behavior |
| - | - |
| Always allow | The action can run, subject to its normal permission and resource checks. |
| Needs approval | The action is unavailable because an API request has no approval card. |
| Block | The action is unavailable. |

Actions that require approval by default are also unavailable unless the optional
safety check approves the call. Actions that run without approval by default
remain available unless your saved choices restrict them.

Use `blocked_tools` to exclude additional actions for one request. Values are tool
names, such as `projects_delete`. Request Blocks can only restrict your saved
choices. They cannot grant permission or make an unavailable action run.

```json theme={null}
{
  "message": "Find the project materials and summarize the outstanding work.",
  "blocked_tools": ["projects_delete"]
}
```

## Optional safety check

Set `auto_accept: true` to request a safety check for actions that require approval
by default. The API safety check must be enabled for your account, and you must
also turn on the safety check in your own tool settings. Each request must opt in.

The check evaluates each proposed call against your request. It never approves
deleting, sharing, or sending. Your explicit Needs approval and Block choices
still withhold the action. If the check rejects a call or cannot decide, the call
does not run and the completion can continue without it.

The result includes `judge_approved_steps` for calls the check approved and
`skipped_steps` for calls it rejected. Each entry is a tool name. These fields
describe calls evaluated by the check. They do not list every action excluded
before the completion started. Approval by the check does not guarantee that an
action succeeds or passes its normal authorization checks.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.