In MCP's security model, who must approve a tool call before it is executed?