A human approval step only reduces risk if the person can understand the action and says no sometimes. Keep approvals rare, specific and informative, put them only before risky actions, and measure the rejection rate and the time to approve. A step that is always approved in two seconds is decoration.
Why approvals decay
Approval prompts fail the way alarms fail. Early on, people read them. After the fiftieth identical prompt, they click through. The EU AI Act names the problem in Article 14(4): people overseeing a high-risk system should be able to remain aware of the tendency to rely too much on its output, which the text calls automation bias, and should be able to disregard, override or reverse the output or stop the system.
Meta's Agents Rule of Two makes a related point: a compliant design can still fail when a user blindly confirms a warning.
Design rules
Ask rarely. Approve by exception. Reads of low risk data and reversible actions should not prompt. If a user sees more than a handful of prompts a day, expect habituation.
Show the action, not the intent. Display the exact command, recipient, amount or diff, not "the agent wants to send an email". Include what changed and what the agent was reading when it decided.
Make the safe choice easy. Deny should be one click, and a denial should not break the whole task.
Vary the stakes. Use different treatment for different risk: log only, notify, approve, or two person approval for the most dangerous actions.
Avoid blanket allow. "Always allow this tool" is convenient and quietly converts a gate into nothing. Scope any standing permission by argument, target and duration.
What to measure
- Approval rate. Near 100 percent over a long time suggests the step is not filtering anything, or the prompts are too trivial.
- Time to approve. Median under a couple of seconds on complex actions suggests no reading.
- Override and reversal count. Do people ever change an agent's proposal?
- Prompts per person per day. Watch for spikes after new agents launch.
These are signals, not proof. Sample some approved actions each month and have a second person review them.
A simple tiering table
| Action type | Treatment |
|---|---|
| Read public or low risk data | No prompt, logged |
| Reversible write in a sandbox | Notify |
| Write to production, external send | Approve with full detail |
| Delete, payment, permission change | Two people or blocked |
Fix the cause when approvals pile up
If approvals are too frequent, the answer is rarely fewer reviews. It is narrower agent permissions, better defaults and automatic checks for the safe cases. Our guide on which agent actions should ask first goes deeper.
Where Safeguard fits
Safeguard's policies, gates and MCP Guardrail can set which agent tool calls need approval and which are blocked, so humans only see the cases that matter.
Quick check
Should every agent action need approval?
No. Too many prompts lead to blind clicking. Reserve approval for risky or irreversible actions.
How do I know approvals still work?
Track rejection rate, time to approve and overrides, and sample approved actions for a second review.
Sources
Last reviewed: 19 October 2026.
