[Automated] Draft docs (kagent): feat(adk): allow disabling ask_user through runtime defaults

docs-site/content/kagent/1.x/agents/human-in-the-loop.md

@@ -43,7 +43,7 @@ An agent pauses either to get permission before it acts or to ask a question. A
 | Request | Raised when | The client answers with |
 | ------- | ----------- | ----------------------- |
 | `tool_approval_request` | The agent wants to call a tool from a binding that sets `requireApproval`. | `tool_approval_response` |
-| `ask_user_request` | The agent calls the built-in `ask_user` tool because it needs information only a person has. | `ask_user_response` |
+| `ask_user_request` | The agent calls the built-in `ask_user` tool because it needs information only a person has. The `config.runtimeDefaults.builtinTools.disableAskUser` Helm value can remove this tool from Go and Python ADK agents. | `ask_user_response` |
 
 Every pause also adds a plain text part to its status message that states why the agent stopped. A client that never activated the extension receives that text and nothing else. It can show a person why the agent stopped, but it has no `id` to answer with, so the task stays at `INPUT_REQUIRED`. Treat the text as a diagnostic rather than as a fallback, and send the turn again from a client that requests the extension. The `hint` field of an activated payload holds the same string.
 
@@ -68,7 +68,7 @@ The Harness that runs an agent decides which pauses the agent can raise, and how
 
 | Harness | Tool approval | `ask_user` question | Splitting one server across two bindings |
 | ------- | ------------- | ------------------- | ---------------------------------------- |
-| `kagent` | Supported | Supported | Supported |
+| `kagent` | Supported | Supported unless `config.runtimeDefaults.builtinTools.disableAskUser` is `true`. | Supported |
 | `codex` | Supported | Supported | Rejected, with `RemoteMCPServer "<name>" is bound more than once`. |
 | `claude` | Supported | Unsupported, because the upstream Claude Code tool that backed it was removed. A `claude` agent pauses for tool approval only. | Rejected, with `RemoteMCPServer "<name>" is bound more than once`. A binding whose tool selection kagent cannot verify against the server's discovered tools exposes the whole server and reports a warning. |
 | `byo` | Decided by your image | Decided by your image | Not applicable |
@@ -109,7 +109,7 @@ Approval belongs to the binding rather than to the tool name, so one server can
 > [!NOTE]
 > kagent 0.x named the tools that needed approval in a `requireApproval` list on the `Agent` resource, which matched tool names across every server. In 1.x, approval is a property of one binding, so the same tool name can pause for one server and run freely for another.
 
-A tool that no binding covers with `requireApproval` runs without a pause. That includes every built-in tool, such as file access, shell, and web search, and every MCP tool on a binding that omits the field. The sandbox contains those calls. For more information, see [Sandboxing]({{< link path="about/substrate-runtime/sandboxing" >}}).
+A tool that no binding covers with `requireApproval` runs without a pause. That includes every enabled built-in tool, such as file access, shell, and web search, and every MCP tool on a binding that omits the field. The sandbox contains those calls. For more information, see [Sandboxing]({{< link path="about/substrate-runtime/sandboxing" >}}).
 
 ## Implement a client that supports human approval
 

docs-site/content/kagent/1.x/examples/a2a-agents.md

@@ -346,7 +346,7 @@ By default, callback URLs must use HTTPS. Callback URLs must not resolve to priv
 
 ## When an agent needs a person
 
-An agent can stop mid-task to ask a question or to request approval for a tool call. The task then reports `TASK_STATE_INPUT_REQUIRED` and waits until a caller answers it. Every kagent agent can raise the question kind, because the runtime gives each one a built-in `ask_user` tool, so a system prompt that tells an agent to ask before it answers is enough to see a pause.
+An agent can stop mid-task to ask a question or to request approval for a tool call. The task then reports `TASK_STATE_INPUT_REQUIRED` and waits until a caller answers it. A kagent agent can raise the question kind when the runtime gives it the built-in `ask_user` tool. A system prompt that tells an agent to ask before it answers is enough to see a pause. If the Helm release sets `config.runtimeDefaults.builtinTools.disableAskUser: true`, Go and Python ADK agents do not get that built-in question tool.
 
 Answering a pause needs the human-in-the-loop extension, which a caller requests per call. The extension is a versioned URI, and a request names it in two places: the `A2A-Extensions` header, and the message's own `extensions` list.
 

docs-site/content/kagent/1.x/examples/skills.md

@@ -46,12 +46,14 @@ config:
     builtinTools:
       disableFileSearch: true
       disableBash: true
+      disableAskUser: true
 ```
 
 | Setting | Description |
 | ------- | ----------- |
 | `disableFileSearch` | Set to `true` to remove `list_files` and `grep_file` from the root agent and from every subagent. Defaults to `false`. This value replaces `skillTools.fileSearchTools` from earlier releases, with the opposite meaning. |
 | `disableBash` | Set to `true` to remove the `bash` tool from the root agent and from every subagent. The agent keeps the file tools, and still loads skills. Defaults to `false`. |
+| `disableAskUser` | Set to `true` to remove the built-in `ask_user` question tool from Go and Python ADK agents, including Shared subagents. Tool approvals and questions from remote A2A agents can still pause a turn. Defaults to `false`. |
 | `bashVenvPath` | The path to a Python virtual environment in the Harness image. The `bash` tool adds the environment's `bin` directory to the start of `PATH`, and sets `VIRTUAL_ENV`. The kagent runtime image does not include Python. To use this setting, build a Harness image that includes the environment. Defaults to empty. |
 
 Attaching a skill also changes what the agent is told. The runtime appends the name and description of every attached skill to the model request, along with an instruction to call `load_skill` before acting on one, so a skill reaches the model even before any tool is called.

docs-site/content/kagent/1.x/setup/model-providers/byo-openai.md

@@ -55,7 +55,7 @@ For the rest of the settings that the `openAI` block accepts, see [OpenAI]({{< l
 
 ### Enable tool calling in vLLM
 
-kagent sends a `tools` array with `tool_choice: "auto"` on every request. kagent's runtime registers a built-in `ask_user` tool on every agent, so that array is sent even when you bind no tools yourself. Launch vLLM with automatic tool choice enabled, or every agent turn fails.
+Requests that carry tools include a `tools` array with `tool_choice: "auto"`. By default, kagent's runtime registers a built-in `ask_user` tool on every agent. In that case, the array is sent even when you bind no tools yourself. Launch vLLM with automatic tool choice enabled. Otherwise, every agent turn that carries tools fails. To remove the built-in question tool from Go and Python ADK agents, set `config.runtimeDefaults.builtinTools.disableAskUser: true`.
 
 ```bash
 vllm serve Qwen/Qwen2.5-7B-Instruct \