Approval fatigue is quietly disabling your AI agent's safety net
By Lindsey J
Many teams shipping an AI agent add a simple rule. Before the agent writes, deletes, or sends anything, a person reviews the action first. It sounds like a safe default. It does not stay one on its own.
We have written before about why that first step matters, in agentic products live or die at the approval step. The harder question is what happens to that step once it has been running for months.
What approval fatigue looks like in practice
In a post describing the Auto Mode feature it shipped this spring, Anthropic reported that Claude Code users had been approving 93 percent of permission prompts. That was the baseline problem Auto Mode was built against.
At that rate, review was not filtering much of anything. It was mostly a formality the agent waited through before doing what it was already going to do. Anthropic's own term for this is approval fatigue: people stop paying close attention to what they are approving.
This isn't unique to Claude Code
Anthropic's number is a single snapshot of one coding agent, not a trend line across products. But the dynamic it points to is a familiar one. We would expect it in any review queue once volume rises and most of what comes through turns out fine, though that is our own extrapolation, not something Anthropic measured outside coding agents. Security operations teams have a name for a similar pattern: alert fatigue. When the overwhelming majority of alerts are benign, a reviewer learns that approving quickly costs less than checking carefully.
Anthropic's own evaluation showed a related trade-off. The classifier it built to reduce manual approval missed 17 percent of real overeager actions in that evaluation, a sample of 52 confirmed cases. It blocked only 0.4 percent of legitimate actions out of 10,000 real requests reviewed. Even a well-tuned automated reviewer trades missed problems against false alarms. A person approving 93 percent of prompts is making the same trade, without measuring it.
A decision rule before you trust your own review step
Picture a product team that added a review-before-send step to an agent that drafts and sends customer emails. For the first two weeks, someone reads every draft before it goes out. By week six, the team approves on sight, because the agent has been right almost every time. Nobody changed the rule. The rule stopped doing anything on its own.
Check your own approval step before the next incident does it for you
- What percentage of actions does your team actually approve unchanged?
- When did someone last reject or edit an action at this step?
- If you removed the step for a day, would anyone notice from the output?
- Does an irreversible action, a send, a delete, a payment, get a slower look than a routine one, or does everything get the same five seconds?
Anthropic saw a 93 percent approval rate on Claude Code's own permission prompts, the rate it flagged as a sign of fatigue. If your own rate is in that range, and you also don't know the answer to the third question above, treat that as a signal worth checking, not a verdict.
What to do instead of one flat approval gate
Treat approval like a budget, not a switch. Say a finance operations team reviews every agent-drafted reconciliation entry at the same level of scrutiny. It spends its attention on hundreds of routine entries and has none left for the rare one that moves money incorrectly. Or say a marketing team approves every scheduled post the same way: it misses the one post scheduled to the wrong account.
- Tier the gate by reversibility. A send, a delete, a payment, or anything a customer sees directly earns a real review. An internal draft that a person checks downstream anyway does not need a second gate.
- Sample the rest. Spot-check a random slice of the auto-approved actions every week instead of reviewing all of them shallowly.
- Track the override rate as a metric. If it drifts toward zero, the gate has decayed, and it is time to either retire it or redesign what it reviews.
FAQ
Does this mean human review of AI agents does not work?
No. It means a review step nobody measures decays the same way any unmonitored control does. Anthropic kept people in the loop and built a classifier to catch what fatigue misses, rather than removing review.
What is a reasonable approval rate to aim for?
There is no universal number, because it depends on how risky the tiered actions are. The useful target is not a percentage. It is knowing your own rate and checking it on a schedule against the actions that matter most.
Should every agent action get its own approval step?
No. A flat gate on every action is exactly what produces fatigue. Reserve a real review for actions that are hard to undo, and handle the rest with sampling or lighter checks.
If your team added an approval step and nobody has checked the override rate since launch, that is a half-hour audit worth doing now. Talk to Aero about where agent review is holding and where it has quietly stopped.
