diff --git a/packages/core/src/action-approval.test.ts b/packages/core/src/action-approval.test.ts
index 2060257..bc1674d 100644
--- a/packages/core/src/action-approval.test.ts
+++ b/packages/core/src/action-approval.test.ts
@@ -25,6 +25,7 @@ describe("toolRequiresApproval", () => {
     expect(toolRequiresApproval("delete_bot", false)).toBe(true);
     expect(toolRequiresApproval("archive_bot", false)).toBe(true);
     expect(toolRequiresApproval("cloud_agent_launch", false)).toBe(true);
+    expect(toolRequiresApproval("respond_agent_connection", false)).toBe(true);
     expect(toolRequiresApproval("create_space", false)).toBe(true);
     expect(toolRequiresExplicitApproval("create_space")).toBe(true);
     expect(toolRequiresExplicitApproval("archive_bot")).toBe(false);
diff --git a/packages/core/src/action-approval.ts b/packages/core/src/action-approval.ts
index 01f3e5e..5cf147f 100644
--- a/packages/core/src/action-approval.ts
+++ b/packages/core/src/action-approval.ts
@@ -32,6 +32,9 @@ const APPROVAL_REQUIRED_BUILTIN_TOOLS = new Set([
   "cloud_agent_launch",
   "cloud_agent_reply",
   "cloud_agent_cancel",
+  // Owner-gated: approving a pending agent connection must not bypass the
+  // YES/NO DM or authenticated API path via an unattended model call.
+  "respond_agent_connection",
 ]);
 const EXPLICIT_APPROVAL_BUILTIN_TOOLS = new Set(["create_space"]);