aeat.entrypoints.mcp._hitl module

Human-in-the-loop confirmation policy for MCP tool calls.

Projects each tool’s mutability annotations onto a confirmation tier the server’s PreToolUse gate enforces: auto-approve safe reads and non-destructive local mutations, confirm irreversible or filing-handoff actions, and block any AEAT live-write surface outright. This is the operator-facing gate; the CLI’s own --yes / write-policy / LiveSubmitForbiddenError rails remain the deterministic backstop beneath it.

class ConfirmationPolicy(*values)

Bases: StrEnum

The PreToolUse decision for a tool call.

auto_approve runs without asking; confirm requires explicit human approval; block refuses the call outright (a forbidden AEAT live-write).

AUTO_APPROVE

CONFIRM

BLOCK

requires_user_interaction(policy)

Whether a tool at policy must advertise requiresUserInteraction.

True exactly for the CONFIRM tier: the interaction flag is the client-facing projection of the server’s own confirmation gate, derived from the same confirmation_for_tool() classification, so the client-side prompt and the server-side PreToolUse gate cannot drift.

Return type:

bool

Parameters:

policy (ConfirmationPolicy)

confirmation_for_tool(*, command_key)

Return the confirmation tier for one tool.

Reads the declared classification (command_classification()) - the same authority the annotation projection reads - so the client hint and the server gate cannot drift. Order matters: a forbidden live-write blocks before any approval; a destructive or filing-handoff verb requires confirmation; everything else (reads and non-destructive local mutations) auto-approves.

Return type:

ConfirmationPolicy

Returns:

ConfirmationPolicy selected for the command.

Parameters:

command_key (str)

is_handoff_command(command_key)

True when the command produces the irreversible filing-handoff artefact.

Return type:

bool

Parameters:

command_key (str)