Hold for review

With hold for review on, the gateway treats a capability no rule names and nobody has reviewed as undecided, and holds it:

• A tool or an MCP server is removed from the request, which goes on without it. The agent sees one capability fewer, not an error.
• A skill or a client is refused with code held_for_review, because a skill is part of another tool’s schema and a client is the caller itself; neither can be removed.

A family you already run as an allowlist (an mcp_allow, tool_allow, skill_allow or client_allow rule exists) is left to that allowlist. A *_deny rule refuses as it always has.

Reviewing

Each held capability becomes a review ticket in the Software Factory with what is known about it: its registry listing, publisher, declared tools and what each can reach. On the ticket, Approve records your approval and lets it through, without turning the family into an allowlist, so approving one MCP server never refuses the others. Deny writes a *_deny rule. Either closes the ticket.

Timeout

Set what happens when nobody reviews a hold in time:

The gateway checks for timed-out holds once a minute. A decision taken by the timeout is written to the Software Factory ticket the same way as one a person takes.

What it costs a request

Nothing new on the request path. Approvals and the hold setting load in the same query as your guardrails, on the same cache, and a hold is recorded after the response, like the capability inventory.