How are approvals scoped: per tool, or bound to the exact call? A per-tool "always allow" can cover very different targets and arguments. Some mcps even have catch alls. Can approvals be single-use, and how you handle headless agents when nobody approves it.