# Answering in your harness

> Hermes renders Graft's ask as its own Allow/Deny card. OpenClaw shows no buttons, so the answer goes through the console.

Source: https://docs.getgraft.ai/graft/approvals/answering-in-your-harness

When a harness advertises MCP form-mode elicitation, Graft asks in place: the harness shows the ask, you answer, and the call proceeds or is refused without leaving the chat. Hermes does this. OpenClaw does not, and every approval reaches you as a link instead.

## What the ask says

Graft's message names your agent, the tool or connection, the vendor and every host it reaches, and says what your yes means. For a tool it quotes the tool's description, marked as the agent's model's own words, and says what kind of tool it is:

- for a write tool, *This tool can change data at the vendor.*
- for a destructive tool, *This tool is destructive, it can delete or overwrite data.*

Either way it then says that your answer holds for this agent from now on, and that you can turn on **Ask every time for this tool** on the agent's page in the console if you would rather be asked before each call. When that setting is already on, the message says so and that this answer is for this call only.

For a build ask it says that your agent wants Graft to run code against the connection, the moment Graft's model starts reading your data there through dry-run reads, and asks to allow it once for this agent and this connection.

The form itself is two booleans, **Allow** and **Ask every time for this tool**. Accepting without either field counts as allow and leaves the setting as it stands.

## Hermes

Hermes renders the form as its own approval card with four buttons: **Allow Once**, **Allow Session**, **Always Allow** and **Deny**.

**Allow Once, Allow Session, Always Allow**

All three are one `accept` to Graft, with no fields set. Graft does not guess which was pressed, so:

- On a **write or destructive tool**, any of them records the yes and it holds for this agent from now on, even when the button said once. Graft asks once by rule, and a destructive tool is no exception.
- None of them changes whether the tool asks every time. That switch is in the console, on the ask or on the agent's page, and the card's text says so.
- On a **build ask**, any of them grants the build approval for this agent and connection.

**Deny**

A `decline`. On a write or destructive tool the no is recorded and holds: later calls are refused with `tool_denied` until you withdraw the answer on the agent's page. On a build ask nothing is recorded, and the next `acquire` asks again.

**No answer**

A `cancel`. Nothing is recorded, and the ask falls back to a console link: the call returns `awaiting_approval` with the link, the agent relays it, and you answer under **Pending actions**. The next call finds your answer.

Hermes keeps no memory on its elicitation path, so its card appears on every ask Graft makes. If the card comes back for a tool you already allowed, you have set that tool to ask every time; turning the setting off on the agent's page is what stops it.

If Hermes cannot carry the elicitation for any reason, Graft falls back to the console link, so you are still asked.

## OpenClaw

OpenClaw does not advertise elicitation, so it never shows an ask. The call returns `awaiting_approval` with a link, the agent relays it, and you answer under **Pending actions** in the console. The call waits a short while for you first; answer within it and the call proceeds. Otherwise tell the agent when you are done, it calls again, and the answer is there.

## Any other client

A client that advertises form-mode elicitation gets the same two-boolean form Hermes does, and can set `askEveryCall` if it renders the field. A client that advertises nothing gets the link. See [Any MCP client](https://docs.getgraft.ai/graft/harnesses/any-mcp-client.md).

## What never comes through the harness

A secret. A connection's key, an OAuth client secret, a rotated token: those are always a link into the console, on every harness, because the MCP specification forbids requesting sensitive information through elicitation and Graft follows it. If an ask in your harness wants a key, it did not come from Graft.

## Try it

```text
Explain what this approval is asking before I press anything.
```

```text
I denied that tool by mistake. How do I undo it?
```

```text
Post the summary to the Slack channel. I know it will ask me first.
```