Why does a human-in-the-loop control degrade over time?

Because attention is finite and a prompt that is almost always safe teaches the reader that it is always safe. The first hundred approvals are read carefully, the next thousand are skimmed, and after that the click is automatic. This is the same automation bias documented in security operations, where analysts facing thousands of daily alerts miss the real one, and in MFA fatigue attacks, where an attacker sends repeated push prompts until a tired user approves. A control consulted too often stops being consulted at all.

Is asking a human to approve every agent action a good safeguard?

No, and it is a common mistake. Routing every action to a person feels maximally safe and is the opposite. It guarantees the volume that produces fatigue, and it moves the real decision from the design of the system to the reflexes of a tired operator at 4pm. A safeguard that depends on a human reading carefully must be designed so the human is asked rarely enough that they still can.

How do you keep an approval step meaningful?

Ask less often and ask better. An approval prompt earns attention when the actions that reach it are genuinely the consequential ones and the routine ones do not, so the operator learns that a prompt means something. That requires the layer deciding what to escalate to be precise: it has to let ordinary in-scope work through without a prompt, hold only the actions that are outside the declared task or carry real blast radius, and give the approver enough context to decide in seconds rather than re-investigate.

What is the connection between false positives and approval fatigue?

They are the same problem seen from two sides. A false positive is an ordinary action wrongly flagged; an approval prompt is where that flag lands on a person. Every needless prompt is both a false positive and a step toward rubber-stamping, because it teaches the operator that prompts are noise. Reducing false positives and keeping approvals meaningful are one objective: only the actions that warrant a human should ever reach one.

Reference · Updated 2026-09-18

What Is Approval Fatigue?

Approval fatigue is what happens when a person is asked to approve so many actions that approving stops being a decision and becomes a reflex. The control still exists on paper, but the human in the loop now clicks yes without reading, so the prompt that was meant to catch the one dangerous action in a thousand catches nothing. The failure is in the volume, not the person.

Keeping a human in the loop is the most cited safeguard for autonomous agents, and it is a good one. But it has a failure mode that does not announce itself, because the control keeps appearing to work long after it has stopped. This page is about that failure mode, why it is a property of volume rather than of the person clicking, and what it takes for an approval step to keep meaning something.

Why does asking a human eventually stop working?

An approval prompt is a request for attention, and attention does not scale. The first time an operator is asked to approve an agent action they read it carefully. By the hundredth near-identical prompt they are skimming. By the thousandth the click is a reflex, because a thousand prompts that were all fine have taught them, correctly given the evidence, that the prompt is noise. The control has not been removed. It has been trained into a rubber stamp.

This is not a new observation, it is just newly urgent. Security operations centres have fought alert fatigue for years: an analyst facing thousands of daily alerts misses the true one not through carelessness but because the base rate has taught them that alerts are usually nothing. Attackers exploit the same reflex directly in MFA fatigue attacks, sending a stolen password plus a stream of approval prompts until a tired user taps yes. The lesson each time is the same: a human check consulted too often is a human check that is no longer being made.

Why is routing every action to a human the wrong fix?

When teams first feel the risk of an autonomous agent, the instinct is to require approval for everything. It reads as the safe choice, the maximally cautious setting. It is the setting most likely to fail, because it manufactures exactly the volume that produces fatigue. Every routine, harmless action becomes a prompt, the prompts blur together, and the one that mattered arrives to an operator who has been conditioned all day to approve without reading.

It also quietly relocates the decision. A control that fires on everything moves the real judgement out of the system's design and into the reflexes of whoever happens to be watching the queue at the end of a long afternoon. The organisation believes it has a human deciding; what it has is a human present. Preserving genuine human authority over what an agent does means the opposite of a wall of prompts: it means the person is asked rarely, and each time they are asked, it is worth their attention.

What keeps an approval prompt meaningful?

An approval tier is only as good as the precision of whatever decides what reaches it. If the deciding layer cannot tell an ordinary action from a consequential one, it has two choices, both bad: escalate too much and cause fatigue, or escalate too little and miss the dangerous action. The prompt is downstream of that judgement, and no amount of care in how the prompt is worded fixes a layer that flags the wrong things.

So the work of keeping approvals real is mostly the work of deciding well what to escalate. Three things have to be true. Ordinary in-scope work must pass without a prompt, or the operator never learns that a prompt is signal. Only the actions that are outside the agent's declared task, or that carry real blast radius, should be held. And when one is held, the approver needs enough context, what was attempted, why it was flagged, what it would touch, to decide in seconds rather than open an investigation. Rare, correct, and legible: those are the properties that keep a person reading.

How does this relate to false positives?

They are one problem. A false positive is an ordinary action wrongly flagged. An approval prompt is where a flag meets a person. So every false positive that becomes a prompt is a small tax on the operator's attention and a small lesson that prompts are noise, and enough of them produce the fatigue that makes the real prompt useless. Cutting needless flags and keeping approvals meaningful are not two projects. Precision on what to hold is what protects the scarce resource the whole control depends on, which is the operator's willingness to actually read the next one.

The uncomfortable implication is that a governance layer's false-positive rate is not a quality-of-life metric sitting to one side of its security value. It is load-bearing. A layer that cries wolf is not merely annoying; it is dismantling the human control it sits in front of, one dismissed prompt at a time.

What is action governance? The layer that decides what proceeds, what is held, and what is blocked.
What do agent benchmarks measure? Why a false-positive rate is a security number, not a footnote.
When does an AI agent need governance? The point at which manual approval of everything stops scaling.
Four approaches to governing an agent: where each one places the human, and how often.

Sources

Shrike treats holding an action for a person as a distinct verdict, not a failure, and works to make it rare: an operator declares what an agent is for, ordinary in-scope work proceeds without a prompt, and only actions outside that declaration or carrying real blast radius are escalated, each with the reason and context attached. See action governance for the model, or the scope declaration that decides what routine looks like for a given agent.