The user must approve the model before it runs.
The model never runs (models.deny); ask is then false.
The approval may be remembered: the model has no price, or only an approximate one.
One or two sentences for the user and, on refusal, the caller; they name the price when one is known.
Whether a model runs, needs the user's approval first, or never runs, and why.