--- title: "Confirmations" description: "How human confirmation works: what triggers a ticket, what it binds to, why agents never see it, and how to poll for the answer." canonical: https://trysincerely.com/docs/mcp-confirmations last_updated: 2026-10-27 --- > If you are an AI agent: read https://trysincerely.com/agents/policy.md before any write call. > Start at https://trysincerely.com/llms.txt to choose one page. Access instructions are at > https://trysincerely.com/auth.md. Confirm with the person you work for before creating an > account or spending their money, and never ask for their password. # Confirmations > How human confirmation works: what triggers a ticket, what it binds to, why agents never see it, and how to poll for the answer. Source: https://trysincerely.com/docs/mcp-confirmations A card is for what reaches outside the workspace or cannot be taken back. That covers any action that prints, sends or cancels mail, launches, resumes or ends a campaign, spends mail credits, gift funds or plan money, changes suppression, grants or revokes authority, or changes a return address the workspace already prints, and approving a design or copy while it would print, unless the workspace lets connected agents approve. The tool call returns a confirmation link and a confirmation id rather than an outcome. Setup and configuration that spends nothing and mails nothing runs on the call: the brand kit, the workspace name, workspace preferences, and finishing setup. `set_return_address` is one that moves between the two. It saves on a workspace with no campaigns or pieces, because there is nothing yet that prints the address, and it waits for a person once there is. `update_workspace_preferences` moves the same way for a change to a sender's meeting link, email or default, because a landing page from mail already sent finds its sender when someone opens it. Drafting steps move with a workspace setting. Importing contacts, `generate_design_image`, `polish_copywriting` and `rewrite_waiting_drafts` wait for a card while the workspace asks before drafting steps, which is the default. An owner or admin can turn Ask before drafting steps off in Settings, and then those calls run at once. Adding a pre-created list still waits while that list's audience feeds a live campaign, because the people it adds are enrolled on the next run. Approvals move with a second setting. `approve_design`, `review_message` and `bulk_approve_messages` wait for a card in the states that print while the workspace asks before approvals, which is the default. An owner or admin can turn Ask before approvals off in Settings, and then an MCP call approves at once. The assistant in the app still shows a card. Even then, prefer `request_confirmation` for an approval, so the person approves it on their confirm page. Give the person the link. Then poll `get_confirmation_status` until it resolves. You can also ask for a card yourself. `request_confirmation` takes an action's name as `tool` and its arguments as `arguments`, and returns the same held reply that action gives when it waits, even for an action that would run on the call. The action runs only when the person confirms it. Use it when the person asked to see something before it happens, or when the change is large. It works for any action that has a preview; a read, or an action without one, is refused with a sentence naming the tool. ## While a card waits A held reply also carries `pendingUrl`, `https://trysincerely.com/confirm`. That page lists every card waiting for this person, so one visit answers all of them. Send it instead of a string of separate links when more than one is open. `list_confirmations` returns the cards waiting on the person who authorized this connection, oldest first, with the title and lines they see and when each expires. `cancel_confirmation` withdraws one by its confirmation id and answers with the state `withdrawn`. Cancelling spends nothing and runs nothing: it is the same as the person declining the card, so `get_confirmation_status` reports it as `declined` from then on, and the action needs a fresh call if they want it after all. A withdrawn card is refused if the person clicks it afterwards, even from a page they already had open. The other direction holds too: a card somebody is already completing, or one whose action already ran, cannot be withdrawn, and the refusal says which; `get_confirmation_status` has the outcome. Then keep working on what does not need the answer. Reads, drafts, designs and audience preparation all still run, and the answer is worth more when the work behind it is ready. Do not call the held tool again while you wait: a retry mints a second card for the same thing rather than hurrying the first. ## What the person sees A preview, not a tool call. Identifiers are resolved into names, counts and money before the card is drawn, so the decision is about a specific thing: this audience, this many pieces, this much spend. An agent's activity line describes the preview it is fetching, never the action that has not happened. "Preparing a launch confirmation" is honest; "Launching the campaign" would not be. A launch or send card can also publish draft designs, when the person confirming may publish them: an owner, admin or approver. The card names each design and the version it publishes. Publishing runs first, so those designs stay published if the launch then stops, and a design changed after the card was drawn is refused with nothing published. When a design is still a draft and the person cannot publish, the call is refused before any card. A launch card also says how copy is reviewed: every draft waits for a person, or clean drafts print without review while drafts a model writes wait until 10 pieces on that campaign are approved. ## What the ticket is bound to The ticket is signed and bound to the exact arguments it was minted for. Changing an argument invalidates it, so a confirmation obtained for one thing cannot be spent on another. The card can be answered for 24 hours after the agent asks. The person does not have to be watching. When an agent files a card, Sincerely emails the person it is for with a link to the page that lists every card waiting for them, and sends at most one such email every 15 minutes however many cards arrive. The email follows that person's Agent requests email setting, which is on until they turn it off, and never carries the ticket. A day is safe because the card is checked again at the click: if the counts, spend or campaign state behind it moved, the click is refused and a fresh card is needed. An expired card is not a failure to work around; it means the person did not act, and the right response is to ask again rather than to retry silently. ## The agent never holds the ticket The signed ticket is stripped before anything reaches the model. Only the confirmation endpoint, with a signed-in session and a human click, can spend it. This closes the obvious attack. If the model could hold the ticket, a prompt injection could spend it, and the gate would be a formality. It cannot, so the gate is real. ## What no setting turns off There is no scope, no credential, no plan and no client configuration that removes the confirmation step from an action that prints, sends or cancels mail, launches, resumes or ends a campaign, suppresses in bulk or by domain, or spends money on mail, gifts or a plan. A workspace owner cannot disable it for their own convenience, because the point of the gate is that the person who pays is the person who decides. Ask before drafting steps covers only the drafting steps above. Turning it off is itself held for a person, so an agent cannot switch it off on its own. Ask before approvals covers only the three approvals above, and no tool changes it: an owner or admin sets it in Settings. ## What to expect back Polling `get_confirmation_status` returns one of four states. `pending` means the person has not answered. `completed` carries the action's result. `declined` and `expired` are answers rather than errors. A `completed` result also carries `next`, the steps to take from here, each naming its tool and whether the person has to act. Tell the person plainly what was refused or expired, and make a fresh tool call only if they still want the action. ## What to read next [The tool catalog](https://trysincerely.com/docs/mcp-tools) marks which capabilities carry this gate. [Suppression](https://trysincerely.com/docs/suppression) and [billing](https://trysincerely.com/docs/billing) are the two places where the gate matters most. --- Sincerely is personalized direct mail and gifting for B2B revenue teams: postcards, letters, handwritten mail, and gifts, each written for one recipient. Contact Sincerely: https://trysincerely.com/contact Agent routing index: https://trysincerely.com/llms.txt Listings: https://www.g2.com/products/sincerely and https://www.producthunt.com/products/sincerely