What an agent can ask
Every card opens with which agent is asking, when it asked and when the ask expires, then the vendor and the hosts it is against. Decline and the approve button sit at the bottom while the ask is open; once answered, the card says what was recorded. Run a tool.<agent> asks to run <vendor>__<name> against <connection> at <hosts>. This is the first call of a tool that is not a read, for this agent, or any call of a tool you set to ask every time. The card shows the tool’s write or destructive badge and quotes its description, marked written by the agent’s model: that sentence was not written by anyone accountable, and you are deciding on a write. Approve records a yes that holds for this agent’s next calls of the tool; Decline records a no that holds the same way. Either can be withdrawn later on the agent’s page. A switch, Ask every time for this tool, rides the same answer: left off, your yes holds; turned on, the tool asks before each call until you turn it off here or on the agent’s page. A destructive tool’s card says it can delete or overwrite data, and asks once like any other.
Acquire a tool. <agent> asks to acquire a tool against <connection>. Once per agent per connection, because this is the moment Graft’s model starts reading your data through dry-run reads. Approving lets it read from the connection while it authors and publish what it builds into your toolbox; writes the tool later makes still ask on their own terms. Declining records nothing, so the next acquire asks again.
Connect a vendor. <agent> asks to connect <name>. The agent proposed a connection: its vendor, primary host, other hosts, auth scheme and non-secret parameters, with the documentation page it read linked so you can check. The form opens pre-filled and editable, names every host the credential will be sent to, and has the scheme’s secret inputs, which only you fill. Connect creates the connection with its credential, puts it in the asking agent’s scope, and the agent’s waiting call answers connected. For an OAuth vendor the form also shows the redirect URI to register at the vendor and asks for the client id and secret; Connect then runs the consent in a popup and the card settles when the tokens are stored. See OAuth with your own client.
Widen a connection. <agent> asks to widen <name>. The agent proposed a host for a public API you already have connected without a credential, and the connection does not reach it: the card lists the hosts it adds and what the connection will reach, with no form, and the build choice. Connect adds the hosts to the connection you already have; nothing new is made, and the agent’s call answers connected. See Connecting a vendor.
On Graft Cloud, a vendor Pipedream Connect covers, Gmail first, shows a different card for the same ask: <agent> asks to connect <name>, marked via pipedream with the Pipedream app it maps to, and one button, Connect through pipedream. It opens Pipedream’s sign-in for the vendor in a popup; you sign in there, and when Pipedream sends you back the card settles and the agent’s call answers connected. Nothing is typed, and the vendor’s token stays with Pipedream. A sign-in you close leaves the ask open with the reason under the button. See Connecting a vendor.
Re-enter a credential. <agent> asks to re-enter the credential for <connection>, after a vendor answered 401 or 403, after you rotated a key, or after a revoke. What the vendor said is shown in the agent’s words, marked so. Save credential replaces the old credential and touches no approval. On an OAuth connection the button reads Reconnect and runs the consent again; after a revoke it asks for the client secret first.
The link the agent relays
A handoff URL points at/pending/<id> with a signed token in its query. The token is bound to that one action, expires, and is good for one opening. A link that was tampered with, has expired or was already used gets a refusal page saying which, and nothing is approved or declined; the action is still on this screen if it is still open. If you are signed out, sign in and the console returns you to the action.
The agent’s call waits a short while for your answer, 25 seconds by default, then returns awaiting_approval with the link so the agent can relay it and its turn can end. An open ask stays answerable for 24 hours by default. When you answer, the next identical call finds the answer and proceeds without asking again. An ask that expires without an answer is not a refusal; the agent asks again if it still needs to.
Hermes renders a tool’s ask as its own Allow and Deny card, and any of its allow buttons is one yes to Graft. Allow Once holds from then on, on a destructive tool as on a write, because Graft asks once by rule. No button turns Ask every time on or off: that is set here or on the agent’s page. OpenClaw shows no buttons, and every ask arrives as a link. See Answering in your harness.
Prompts to try
Where next
How approvals work
The rule behind every card on this screen.
Answering in the console
The handoff flow from the agent’s link to the recorded answer.