# Set how a credential confirms writes

Each API key and gateway user has a confirmation choice: what happens when its client calls an operation marked as requiring confirmation. For how each choice behaves in the client, see [Confirmation](https://docs.faustine.ai/agent-gateway/confirmation/).

## Before you begin

- At least one operation of an API in the gateway is marked as requiring confirmation. See [Mark an operation as requiring confirmation](https://docs.faustine.ai/apis/require-confirmation/).

## Set the choice

To set what a credential does:

1. In the portal, go to [**Agent Gateway**](https://auth.faustine.ai/go?to=%2Fintegrations%2Fagent-gateway) and select your gateway.
2. Select the **Access** tab, then **API keys** or **Users**, and select the credential.
3. In the **Confirmation** section, select one choice.
   - **Refuse**: the operation is refused and hidden from the client.
   - **Ask the person**: the call waits until the person approves it in the client.
   - **Ask the agent**: the call runs, and the model decides whether to ask first.
   - **Run without asking**: the call runs.
4. Select **Save changes**.

The **Confirmation** section shows how many operations in the credential's scope are marked. For a user, the change applies to existing sessions on their next call.

> **Warning:** With **Run without asking**, destructive operations run with nobody asked. Use it only for an automation you supervise.

## Which choice to use

| Credential | Choice | Reason |
| --- | --- | --- |
| A user on Claude Code, claude.ai or ChatGPT | **Ask the person** | These clients can show the confirmation dialog or the confirmation card. |
| A user on a client that cannot ask | **Refuse** | With **Ask the person**, every call to a marked operation is refused anyway, and **Refuse** also hides the operations from the model. |
| A key for an unattended automation | **Refuse** | Nobody is there to approve. |
| A key for an automation you supervise | **Run without asking** | The automation is the one that decides. |

## Check that the client can ask

After the client has connected once, the credential's page shows a **Last client** tile with the client's name and `can ask: dialog`, `can ask: card` or `can ask: no`. If the credential is set to **Ask the person** and the last client cannot ask, the tile says that confirmations are being refused.

## See the choice for every credential

The gateway's **Policies** tab lists every key and user with its choice, under **Writes & Idempotency** > **Operations that require confirmation**. The **API keys** list also shows it next to each key's scopes.

## Next steps

- [Confirmation](https://docs.faustine.ai/agent-gateway/confirmation/): what the person sees in each client.
- [Scope a key or user](https://docs.faustine.ai/agent-gateway/scope-a-credential/): make a credential read-only instead.
- [Logs](https://docs.faustine.ai/agent-gateway/logs/): find the calls that were refused and why.