Tool modes
What Automated, Approval Required, and Disabled mean for an Agent Tool.
Every Agent Tool has a Mode. It decides how much the AI can do with that tool without a human in the loop, and it's set per tool, from the Agent Tools page, not per Skill or per technician.
Automated
The AI can call the tool on its own. No human needs to approve the call before it runs. Reserve this for tools where a wrong call is cheap to notice and cheap to undo: looking up an asset, pulling a customer's license count, checking a ticket's status.
Approval Required
The AI can prepare the call, but a human has to approve it before it runs. Use this for anything that changes something for a customer or costs money: resetting a password, provisioning a license, closing a ticket. This is enforced at the tool level, not the Skill, so the tool still stops and waits even if the Skill's instructions never mention approval.
Disabled
The tool can't be called at all, by anyone, regardless of role. A non-admin with full Agent Tools access and an Admin see the same thing: the tool isn't there to use. Disable a tool you're not ready to trust yet, or one tied to an integration you're in the middle of migrating off.
Mode overrides role
Role access controls who's allowed to use a tool. Mode controls how the tool behaves and whether it can be used at all. A Disabled tool stays off for every role, Admin included, until you change the Mode back.
Choosing a mode
Default new tools to Approval Required. Once you've watched a tool get used correctly on real tickets for a while and you trust the pattern, move it to Automated. That order is the safer one: loosening a tool after you've seen it behave is a judgment call, tightening one after it's already caused a problem is a cleanup job.