A tool can issue refunds. Its schema validates, but the user has not approved the amount or recipient. Which controls are needed before executing the proposed call?

1. Execute because MCP automatically approves every model-generated action.
2. Treat a favorable sentiment score as user approval.
3. Approve any refund below the model's output-token budget.
4. Check authorization, business constraints, and the required explicit approval.