Approval fatigue

Approval fatigue is the erosion of human-in-the-loop oversight that sets in when an agent requests approval so often that the reviewer stops genuinely evaluating each request and starts approving by reflex, leaving a control that still fires on paper but no longer discriminates.

How it works

Human attention is finite and it habituates, so when the overwhelming majority of an agent's requests are benign, every approval teaches the reviewer that approving is safe, and the rare consequential request arrives looking identical to the hundreds of routine ones before it. The decay is gradual and invisible in a plain approve/deny log, which records the same click whether the reviewer read the request or not. Anthropic's engineering accounts of its agent permission systems name the pattern directly: people approve the bulk of permission prompts, and the more prompts they see, the less attention each one gets, which is the observation that motivated moving routine actions out of the prompt stream entirely. The mechanism underneath is automation complacency from human-factors research, where operators supervising mostly-reliable automation reduce active monitoring, and it predates AI agents by decades. Recent academic work models it directly for agents: oversight is a capacity that degrades with escalation volume, not a fixed gate, so adding approvals past the capacity can reduce safety, not add it.

Why it matters

The human approval layer is usually positioned as the last line for exactly the actions that matter most, the irreversible and high-impact ones, so this is a failure of the layer the whole stack leans on hardest. A control that no longer discriminates is in one sense worse than no control: it keeps minting audit evidence ("a human approved this") that no longer means what the audit assumes it means. The design implication inverts the intuitive response to risk: the way to strengthen human oversight is usually to ask for less of it, reserving prompts for the few decisions where judgment is genuinely load-bearing and widening the autonomous lane with structural layers that do not tire. Reducing prompts is not free, though: every action moved out of the approval stream shifts trust onto sandboxes, validators, and policy gates, and the prompt it removes was the one check that could notice a novel combination no rule anticipated, so the trade has to be proven against the risk it absorbs rather than discovered after an incident. Oversight design, like any budget problem, starts from the constraint: attention is the scarce input, and the prompts have to be priced against it.

In practice

A team configures a coding agent to ask before every file write and every shell command, reasoning that more checkpoints mean more safety. By the end of the first week a developer is clicking through hundreds of prompts a day and has stopped reading them, and the one request that mattered, a command that touched stored credentials, is approved in the same reflex as the rest. The fix is structural rather than motivational: routine writes move behind an allowlist and a sandbox, validators take over the checks a rule can express, and the prompts that remain are reserved for risk-tiered actions, so the next consequential request arrives as one of a few prompts that day instead of one of hundreds. The reviewer didn't get more disciplined; the design stopped spending their attention on requests that did not need it.

Practical considerations

Tier actions by risk and reserve explicit approval for the irreversible and high-impact classes, which is the tiering OWASP's agent-security guidance recommends. Watch the approval rate as a health metric: a rate near total is a signal the prompts have stopped discriminating, and it is cheap to alert on. Widen the autonomous lane structurally, with sandboxes, allowlists, validators, and budget ceilings absorbing the routine cases, and widen it only as fast as those layers prove out, so the prompt stream shrinks without the trust simply evaporating. Sample and audit approved actions on a schedule, because a reviewer who knows approvals get re-read behaves differently from one who knows they vanish. Treat any new recurring prompt as a spend against reviewer attention and budget it like one, and when a workflow change adds approvals, expect to remove others to pay for them.

Defined by Ready Solutions AI