@@ -711,6 +711,46 @@ async def _prepare_single(
   )
 
 
+async def _apply_confirmation_gate(
+    tool: BaseTool,
+    function_args: dict[str, Any],
+    tool_context: ToolContext,
+) -> dict[str, str] | None:
+  """Answers a call whose tool is waiting on a human, instead of running it.
+
+  Args:
+    tool: The tool the call names.
+    function_args: The arguments the call carries.
+    tool_context: The context the call will run in.
+
+  Returns:
+    The response to answer the call with, or None if the call may proceed.
+  """
+  if not await tool.check_require_confirmation(function_args, tool_context):
+    return None
+
+  confirmation = tool_context.tool_confirmation
+  if confirmation is None:
+    tool_context.request_confirmation(
+        hint=(
+            f'Please approve or reject the tool call {tool.name}() by'
+            ' responding with a FunctionResponse with an expected'
+            ' ToolConfirmation payload.'
+        ),
+    )
+    # The pause is not a tool result for the model to summarize; without this
+    # the flow re-invokes the model, which calls the tool again.
+    tool_context.actions.skip_summarization = True
+    return {
+        'error': (
+            'This tool call requires confirmation, please approve or reject.'
+        )
+    }
+  if not confirmation.confirmed:
+    return {'error': 'This tool call is rejected.'}
+  return None
+
+
 async def _execute_single_prepared_call(
     invocation_context: InvocationContext,
     prepared_call: _PreparedFunctionCall,
@@ -793,10 +833,17 @@ async def _run_with_trace() -> Event | None:
       )
 
     # Step 3: No before-tool callback answered the call, so proceed calling
-    # the tool normally.
+    # the tool normally. A tool that requires confirmation is answered by the
+    # gate instead, so the gate holds for every tool rather than only the ones
+    # that check it themselves, and a gate that raises is handled like a tool
+    # that raises.
     if function_response is None:
       try:
-        function_response = await tool_runner()
+        function_response = await _apply_confirmation_gate(
+            tool, function_args, tool_context
+        )
+        if function_response is None:
+          function_response = await tool_runner()
       except Exception as tool_error:
         error_response = await _tool_error_handler.run_on_tool_error_callbacks(
             invocation_context=invocation_context,
 
@@ -21,6 +21,7 @@
 from google.adk.flows.llm_flows.tools._confirmation import _resolve_confirmation_targets
 from google.adk.flows.llm_flows.tools._confirmation import request_processor
 from google.adk.models.llm_request import LlmRequest
+from google.adk.tools.base_tool import BaseTool
 from google.adk.tools.function_tool import FunctionTool
 from google.adk.tools.tool_confirmation import ToolConfirmation
 from google.genai import types
@@ -1319,3 +1320,94 @@ async def test_resolve_confirmation_targets_requires_adk_name():
 
   assert set(tool_confirmation_dict) == {"requested_fc_id"}
   assert set(original_fcs_dict) == {"requested_fc_id"}
+
+
+class _GatedTool(BaseTool):
+  """A tool outside the FunctionTool hierarchy that asks for a human."""
+
+  def __init__(self):
+    super().__init__(name="gated_tool", description="Needs approval.")
+    self.runs = 0
+
+  async def check_require_confirmation(self, args, tool_context) -> bool:
+    return True
+
+  async def run_async(self, *, args, tool_context):
+    self.runs += 1
+    return {"status": "ran"}
+
+
+async def _call_gated_tool(
+    tool: _GatedTool, tool_confirmation: ToolConfirmation | None = None
+) -> Event:
+  """Calls `tool` through the flow and returns its function response event."""
+  agent = LlmAgent(name="test_agent", tools=[tool])
+  invocation_context = await testing_utils.create_invocation_context(
+      agent=agent
+  )
+  function_call_event = Event(
+      invocation_id=invocation_context.invocation_id,
+      author=agent.name,
+      content=types.Content(
+          parts=[
+              types.Part(
+                  function_call=types.FunctionCall(
+                      id=MOCK_FUNCTION_CALL_ID, name=tool.name, args={}
+                  )
+              )
+          ]
+      ),
+  )
+  event = await functions.handle_function_calls_async(
+      invocation_context,
+      function_call_event,
+      {tool.name: tool},
+      tool_confirmation_dict=(
+          {MOCK_FUNCTION_CALL_ID: tool_confirmation}
+          if tool_confirmation is not None
+          else None
+      ),
+  )
+  assert event is not None
+  return event
+
+
+@pytest.mark.asyncio
+async def test_unconfirmed_tool_is_not_run():
+  """A tool requiring confirmation must not run before a human answers."""
+  tool = _GatedTool()
+
+  event = await _call_gated_tool(tool)
+
+  assert tool.runs == 0
+  assert event.get_function_responses()[0].response == {
+      "error": "This tool call requires confirmation, please approve or reject."
+  }
+  assert set(event.actions.requested_tool_confirmations) == {
+      MOCK_FUNCTION_CALL_ID
+  }
+  assert event.actions.skip_summarization
+
+
+@pytest.mark.asyncio
+async def test_rejected_tool_is_not_run():
+  """A tool the human refused must not run."""
+  tool = _GatedTool()
+
+  event = await _call_gated_tool(tool, ToolConfirmation(confirmed=False))
+
+  assert tool.runs == 0
+  assert event.get_function_responses()[0].response == {
+      "error": "This tool call is rejected."
+  }
+
+
+@pytest.mark.asyncio
+async def test_confirmed_tool_is_run():
+  """A tool the human approved runs and returns its own result."""
+  tool = _GatedTool()
+
+  event = await _call_gated_tool(tool, ToolConfirmation(confirmed=True))
+
+  assert tool.runs == 1
+  assert event.get_function_responses()[0].response == {"status": "ran"}