AI agent approval fatigue is a control that has already failed
It is the fortieth prompt of the afternoon. The agent wants to run a command. The engineer reads the first line, recognises the shape, and presses enter. The thirty-nine before it were fine. This is AI agent approval fatigue, and it is not a character flaw. It is what happens to any person asked the same question forty times by a system that was right the last thirty-nine. Anthropic's telemetry showed users approved roughly 93 percent of permission prompts. The company reported that approval fatigue showed up within weeks.
Read that figure the way an accident investigator would. The agent is mostly right, so most approvals are correct. The number is not evidence that anyone read the prompts. A reviewer who presses enter every time also approves 93 percent of a good agent, and every action of a bad one. The ratio measures the agent. It does not measure the human. A prompt that is always approved is not a control. It is a light that is always green.
The pattern is older than agents. Hospitals met it at the bedside. Browsers met it in the address bar. In both cases the repair was a change of design, not a lecture to the people. This field note walks through those two cases, then through the agent data, then maps a repair onto the four verbs of the Agentic Pause draft: declare, freeze, inspect, resume. The draft is an open 0.1, written to be argued with, and no vendor has adopted it. The claim here is narrower than any proposed standard. Approval should be rare, heavy, and prepared in advance.
The hospital wrote the accident report in 2013
On 8 April 2013 The Joint Commission, the American hospital accreditor, published Sentinel Event Alert 50 on medical device alarms. The numbers in it describe a control that had decayed into noise. The number of alarm signals per patient per day can reach several hundred. Between 85 and 99 percent of those signals, the alert estimated, do not require clinical intervention. Thresholds are set too tight. Defaults are not adjusted for the patient. An electrode dries out. A sensor slips. The alarm sounds anyway.
The alert then describes what a person does under that load. Clinicians become desensitised. They turn the volume down. They turn the alarm off. They widen the limits past what is safe for the patient. The alert names this alarm fatigue, and it does not treat it as a failure of character. It treats it as the predictable output of a ratio. A nurse who silences a monitor after one more false alarm is behaving the way the design trained them to behave. The design asked them the same question several hundred times a day and was almost never serious.
The cost is in the same document. The Joint Commission's sentinel event database held 98 alarm-related events between January 2009 and June 2012. Eighty of them ended in death. The alert also recounts a case reported by the Boston Globe in the summer of 2010: a man in an intensive care unit whose heart rate rose and whose oxygen fell while alarms sounded, and whose staff responded after one hour, when a critical alarm said he had stopped breathing. The monitor worked. The alarm sounded. The control failed because it had already sounded too often.
The brain stops seeing a warning it has seen before
Browsers ran the same experiment at a larger scale. In 2013 Devdatta Akhawe and Adrienne Porter Felt observed over 25 million warning impressions through Firefox and Chrome telemetry. Users continued through a tenth of Firefox's malware and phishing warnings, a quarter of Chrome's, and a third of Firefox's SSL warnings. For Chrome's SSL warning the figure was 70.2 percent. The authors' point was not that users are careless. It was that presentation changes behaviour. The same category of danger, shown by two products, produced two different rates of attention.
A later study looked inside the head. Vance, Jenkins, Anderson, Bjornn and Kirwan put participants in an fMRI scanner with eye tracking over a five-day workweek and watched the response to a repeated warning fall with each exposure. Attention recovered at least partially between workdays, when the person had not seen the warning. The team then ran a three-week field study of app permission warnings. Warnings whose appearance changed each time, which they call polymorphic, held attention. Adherence to them dropped at a substantially lower rate and remained high after three weeks.
Put the findings together and the mechanism is plain. Repetition of an identical stimulus is processed as noise. This is physiology, not laziness. What slows the decay is change: a warning that looks different, a night without exposure, a question that cannot be answered by its shape. An agent permission prompt is the opposite of that. It is the same box with the same two buttons, dozens of times an hour, and it asks a question the reviewer can answer by shape alone.
Experienced users stop approving and start interrupting
Anthropic's deployment research shows where the curve ends. In February 2026 it reported that newer users, with fewer than 50 sessions, ran with full auto-approve roughly 20 percent of the time. By 750 sessions that rose to over 40 percent of sessions. The same report found that new users interrupted the agent in 5 percent of turns and experienced users in around 9 percent. The two numbers move together. The people who know the tool best turn the prompt off and watch the work instead. When something looks wrong, they stop it.
That is not a failure of the users. It is the users arriving, on their own, at a better control than the one they were given. An interruption is a pause. It is triggered by what the agent is doing, not by a schedule of permission checks that fire whether or not anything is at stake. The experienced engineer behaves like a pilot with the autopilot engaged. The pilot does not approve each movement of the control surfaces. The pilot monitors, and takes the controls at the points briefed before the flight, or when the aircraft does something the briefing did not cover.
The lesson for anyone designing an agent is uncomfortable. The approval prompt, used as the primary control, trains its own removal. It fires too often to be read and matters too rarely to be missed, so the user disables it and goes back to watching. The product then has no control at all, only a watcher who may be looking elsewhere. The human in the loop does not quit; the loop puts the human to sleep, one approved prompt at a time. The repair is not a better prompt. It is a different kind of stop.
Declare the pause points before the run, and keep them few
The first verb in the Agentic Pause draft is declare. Clause 01.2 asks the workflow to name, in advance, the steps where a pause is honoured before the next action. Clause 01.1 asks for [one named human owner](/spec/#declare-owner) who can take control. That ordering is the whole argument. The pause points are chosen while the engineer is awake, reading a design document, with the consequences in view. They are not chosen at the fortieth prompt. And because each one has to be written down with its reason, the list stays short. Nobody declares forty pause points for an afternoon's work.
What belongs on the list is the class of action a nurse would want to be woken for. A delete that bypasses the trash. A payment. A message to a person outside the team. A permission the plan did not include. A force push. These are the actions whose cost cannot be recovered by a second attempt, and they are rare in a healthy run. Everything else runs inside containment: a sandbox, a scoped credential, a budget, an egress rule. Anthropic's containment report presents exactly this complement, boundaries that hold the blast radius so that approvals can be fewer.
A declared pause has a weight that a prompt does not. It costs the reviewer something to clear: a packet to read, a line of reasoning to write, sometimes a second person. That cost is the point. Habituation feeds on cheap, identical stimuli. A heavy stop that arrives a few times a week cannot be cleared by shape, and it never becomes the fifth one this hour. Clause 01.3 adds the other half. The steps that must not be cut midway, such as a payment in flight, are listed too, so that a stop waits for the step to finish instead of leaving it half done.
Freeze before asking, so the reviewer reads a still picture
An approval prompt usually arrives while the agent is still moving. Other tool calls are queued. A subagent is halfway through a file. The question on screen refers to a state that is changing underneath it. This is the bedside with the patient moving, the alarm sounding while the numbers scroll. Nobody can inspect a moving target, and after a few attempts nobody tries. The draft's second verb, freeze, asks for the opposite. Clause 02.1 wants intent, context, permissions and progress to survive the pause. Clause 02.2 wants external side effects identified and contained. Clause 02.3 wants the stop to reach every subagent.
The frozen state is what makes the third verb possible. Inspect, in the draft, is not a yes or no box. Clause 03.2 asks for a readable state: what the agent meant to do, what it has done, and what it would do next, without replaying the session. Clause 03.3 asks that the reviewer can edit the plan or end the run, not only approve it. Together those clauses describe an evidence packet, and the packet is the agent's version of the polymorphic warning. It cannot look the same twice, because the facts in it are never the same twice. The resolved path, the target account, the recipient list, the amount: a reviewer has to read them to answer.
The packet also has to resist the agent's own story. Agents explain themselves well, and an explanation that reads smoothly is one more identical stimulus. The packet should carry facts the harness observed on its own: the command after every variable has been substituted, the rows a query would touch, the credential in use and where it came from. The agent's narrative can sit beside those facts, labelled as narrative. The reviewer approves the facts. When the facts are too long to read in the time available, that is information too. It means the pause point was declared in the wrong place, and the run should be split.
Resume is where a sleeping approval does its damage
The fourth verb is resume, and it is the one approval prompts ignore. A yes given at the prompt is treated as permanent. The agent carries it forward through every later step while the world changes. The file is edited by someone else. The price moves. The credential found in a config file is still valid, and still too broad. Clause 04.2 asks that permissions and credentials be checked again at resume, not carried over from before the pause. Clause 04.1 asks that continuing cannot silently repeat completed actions. An approval that expires at the pause is worth more than one that never does.
This is also where measurement belongs. A declared pause point produces a record: who stopped, what they read, what they decided, when the run continued. Clause 04.3 asks for that trail. From it a team can compute the one number that says whether a gate is awake: the share of stops at that point that were edited or refused. A gate that is approved every time for weeks is either unnecessary, and should be replaced by containment, or asleep, and should be made heavier. Either way the record says so. The prompt count does not.
None of this makes an agent safe, and the draft does not claim it. A list of clauses is not proof. What the four verbs offer is a place to put the human where the human can still function: rarely, at a declared point, in front of a still picture, with the authority to change the plan. That is a control an accident investigator could test. The alternative, a human who pressed enter forty times and was looking elsewhere at the forty-first, is not.
Count yesterday's prompts, then count the ones that mattered
Here is the test to run this week. Take one day of agent sessions from your own logs. Count the permission prompts. Then count the ones a human refused or edited. Group both counts by the kind of action: file writes, shell commands, network calls, deletions, messages, payments. For each class, write the approval share next to it. Where the share is close to total over the window you chose, you have found a gate that is either asleep or unneeded. Decide which. Move the unneeded ones behind containment. Turn the rest into declared pause points with a packet.
Then do the uncomfortable part. Pick the class with the highest consequence and ask whether the prompt a reviewer sees for it contains the resolved target, the reversibility, and the credential. If it does not, the reviewer could not have been reading it, whatever the approval log says. That gap is the one to close first. It will cost a few days of harness work and remove more prompts than it adds. The number of prompts a human sees should go down. The weight of each one should go up.
To score what remains, [Run the 60-second pause test](/#pause-test). It walks the four verbs, declare, freeze, inspect and resume, and returns an illustrative score against draft 0.1. The score proves nothing about the agent's safety, and the draft says so. It shows which of the four places your agent cannot stop, and which of your approvals are ritual rather than control.
