The twentieth prompt of the afternoon
It is the twentieth approval prompt since lunch. You read the first four. By the ninth you were reading the first line and the verb. Now your eye lands on the shape of the thing. It does not look like the last one that mattered. Your hand approves it before the rest of you catches up.
The human in the loop is present. The human in the loop is logged and accountable. The human in the loop is also not deciding anything.
That click is the part of the system nobody measures. Everything else in the harness gets watched. The guides limit what the agent may try. The sensors report what it did. The approval prompt sits in the middle of all that, and everyone treats it as the safe part.
It is a sensor, and it is the weakest one you have.
Anthropic published a number for this. It hired 1,053 paid testers and put each one in a test environment built for the study. Each tester met one dangerous command during their session. So there were 1,053 testers and 1,053 chances to catch something bad. The testers caught it 13.6% of the time, 143 times out of 1,053. Auto mode's classifier blocked 89% of the same commands, 937 out of 1,053.
Read that pair twice. It flips the question every page on this topic is answering. The question is not whether a model can hold the gate. A vendor already shipped that, with its own testing attached. The question is what you owe the gate once a model holds it.
Every approval gate you have seen is a binary
Look at the gate in your own system. Underneath the interface there are two outcomes. The action runs, or a person approves it. Risk scoring, confidence thresholds, autonomy level settings: all of that picks which of the two fires. The gate has four verbs, not two.
Allow. The action runs on its own. Ask. The action stops and waits for a person. Deny. The action is refused. Delegate. A second model decides in the person's place.
Delegate is the verb missing from every page ranking on this query, and it stopped being hypothetical this year. Anthropic ships auto mode as the default permission mode in Claude Code on paid plans. A separate classifier reviews actions before they run. That is a named permission mode, on by default, and session-wide. It sits next to allow, ask and deny as a real option.
The underlying idea is not exclusive to one vendor. OpenAI's agent SDK documents a guardrail agent. One model checks another model's request before it runs, and records an approval interruption instead of running the tool. What changed is that this now ships switched on, as a mode, rather than as something a developer wires up.
Naming four verbs is cheap. The next two sections say what each one costs you.
Allow and ask: what runs, and what you write down
A verb is not specified until you say what the organisation must produce when it fires. What the system does is the easy half.
Allow runs on its own. The artefact it owes is the log line. Most agent logs only record that something happened. The line has to be rich enough to rebuild the decision months later. The inputs. The rule that matched. Its version.
Ask stops and waits for a person. It owes two things. First, the evidence pack: what the reviewer needs to decide rather than confirm. Second, the escalation path, for the reviewer who cannot decide alone. The evidence pack decays first when volume rises.
Work it in refunds. A refund approves itself when payment and refundable balance are verified, the request sits inside the policy window, and product and reason arrive as structured codes. It also needs a clean record: no dispute, no chargeback, no duplicate-refund or account-security flag, and an amount under a limit the policy owner set. Put a euro figure on that limit and it is your number, not a sourced one.
The same refund goes to a person in three cases. The denial or partial refund is likely to be contested. The item is high-value or regulated. The account shows a repeat-refund pattern.
Customer email is the same motion. Acknowledge, decide, then write the decision back to the customer and the system of record.
Which side of the line an action falls on is the reversibility question. The six dimensions piece already built those tiers. Use them rather than rebuild them.
Allow and ask you already have. The next two are where accountability changes shape.
Deny and delegate: the two verbs that change who is accountable
Deny and delegate are not two more settings on the same dial. They are the two verbs that move accountability.
Deny refuses the action. The artefact it owes is the alert plus the return path. A refusal with nowhere to go is an outage the business absorbs quietly. The payment does not go out. Nobody is told. The customer notices first. This is the end of the range where deleting backups and wiring funds live. A two-person rule earns its keep here. Low-stakes lookups do not, and they spend attention the real cases need.
Delegate hands the decision to a second model. The artefact it owes is the calibration record: standing proof that the thing holding the gate still agrees with a human. That one is the hard artefact, and most of what follows is about why.
Delegating also means the risk classification has to be one the workflow owns, not one the agent volunteers about itself. The workflows versus agents piece already made that argument, and this one stands on it.
That risk has a public example. A documented GitHub issue on the anthropics/claude-code repository reports a sub-agent running 293 tool calls over roughly 34 minutes with no user approval. The parent session's permission mode was logged as default. The call that spawned the sub-agent asked for auto mode directly. The reporter posted their own session logs. The issue is closed as not planned, with no vendor acknowledgment in the thread. Self-escalation across a boundary, evidenced, by a named third party.
All four verbs assume the thing holding them is steady. Neither holder is.
The human side decays on a curve, and the curve is measured
Approval accuracy drops with repetition, and it drops on a curve you can read.
In the same Anthropic testing, human testers blocked roughly 17% of dangerous commands early in a session. After 50 or more prior prompts, that fell to roughly 5%. The classifier's block rate stayed flat no matter how long the session ran. Anthropic also puts reflexive approval at 97% of permission prompts. That figure is general Claude Code usage, not a result of the tester study.
The twentieth prompt dramatises that curve. The number argues it.
Three forces produce this approval fatigue, and they compound.
- Volume moves a reviewer from judging to pattern-matching, because pattern-matching is what clears the queue.
- Reliability breeds disengagement: the better the agent performs, the less attention each approval gets. A gate decays fastest exactly where the underlying system works best.
- Rejection costs something approval does not. Delay. Justification. Friction with whoever is waiting. Approval is the path of least resistance every time.
The exposure this produces has a name. Bury one bad action inside a stream of routine ones and it rides the reflexive pattern the other forces built. That is the clickthrough vulnerability.
Every false negative in that stream was formally approved by an accountable human. That is what makes rubber-stamping expensive rather than embarrassing.
If that is the human curve, the obvious move is to hand the gate to the machine. The machine has a curve too.
Classifiers rot the way evals rot
A gate classifier rots the same way an evaluation layer does. It keeps returning confident answers long after anyone last checked whether it still agrees with a human. Nothing in the output tells you which one you are looking at.
The evaluation and verification piece names the mechanism, evaluation rot, and its four failure modes: criteria drift, distribution shift, judge miscalibration, coverage gaps. It also names the fix. Run several judges over one set. Gather human annotation as ground truth. Measure how well they line up over time. Calibration is the word for that, and it is maintenance, not setup.
That fix works for one reason. An evaluator's verdicts can be checked against a stored, human-annotated set.
A gate's correct refusals produce no such record to check.
A gate that works and a gate that has stopped working look identical
An evaluator and a gate sit in different positions. The difference is not one of degree.
An evaluator produces a verdict on a stored artefact. The artefact stays. A human can annotate it. The verdict can be scored against that annotation. Ground truth is available, and getting it is work rather than a puzzle.
A gate that correctly refuses something produces nothing. No outcome. No artefact. Nothing to compare against, because the point of the refusal is that the thing did not happen. Its successes are invisible by design. Its failures are the incident.
So the two states you most need to tell apart are the two that look the same from outside. A gate quietly rubber-stamping everything and a gate doing its job show you the same face. No incidents. A queue that clears. A dashboard saying the control is on. They stay that way right up until the day they are not.
"It hasn't failed yet" describes your information, not your gate. A control justified that way is an assumption wearing a control's clothes.
Nobody asks who reviews the AI reviewer. The reason is that the gate hands you nothing to review it with.
Anthropic's own figures show the shape this takes when it is measurable. Auto mode blocked 800 commands a human had approved. Humans blocked only 6 that auto mode allowed. The errors run overwhelmingly one way. That is what a gate held by something that has stopped deciding looks like, on the rare occasion you can see inside it.
Manufacture the outcome the gate will not give you
If the gate will not produce an outcome to check, produce one on a schedule instead.
The rigorous version was built for fraud operations rather than coding agents, which is the right direction of travel here. Jie Deng's framework, published on arXiv this year, re-certifies what the gate may automate on a cadence. It uses randomly-audited labels that have matured: evidence aged past a declared delay, so what it says is settled rather than provisional.
The move that matters is what happens when certification fails. The framework treats non-authorization as an informative output, not as silence. That turns "the gate has not failed yet" from a null into a measurement. It is the property a gate otherwise lacks.
It has been run on real workloads. Across three fraud datasets the framework authorised 84.4%, 67.4% and 81.3% of decisions for automation. Review rates, including diagnostic audits, were 24.1%, 46.0% and 43.1%. Read both rows together. This buys signal with reviewer time, not for free. Any risk scoring or confidence threshold you set is sized against that audit cadence, not against your appetite.
Here is the version you can picture more easily. Run a candidate gate in shadow mode. Real inputs, real verdicts, no real actions, sitting beside the live gate. Compare the two over enough volume to mean something, then trust it.
Both do the same thing. They manufacture an outcome you can observe, rather than waiting for the one outcome a gate produces on its own, which is a failure.
In the EU this stops being good practice and starts being an obligation.
What the law already expects of the person holding the gate
For an Irish reader this is not only an engineering problem. The law points the same way.
Start with the text. Where an automated decision falls under GDPR Article 22, the controller must provide the right to obtain human intervention, to express a point of view, and to contest the decision. The word is intervention. Not review. Not approval. Intervention is a substantive act.
The Court has ruled on what a formal sign-off does not do. In OQ v. Land Hessen (C-634/21, 7 December 2023) the CJEU held that a credit-scoring agency itself does automated decision-making when its score plays a determining role in a lender's outcome. That held even though a human at the bank made the final call. The holding is narrow. It puts the upstream automated part inside Article 22, not outside it.
By the same logic, though the CJEU did not rule on this directly, a rubber stamp that has decayed to 5% is a poor candidate for the intervention Article 22 asks for. That is an inference, not a holding, and worth keeping apart.
The AI Act is a separate layer. Its human-oversight duties for high-risk systems are not in force yet. On the European Commission's own regulatory framework page, as it stands on 7 September 2026, two dates apply. Standalone high-risk systems fall due on 2 December 2027. AI built into a regulated product follows on 2 August 2028. The AI Omnibus has already moved that timetable once.
That makes the audit log a liability firebreak, not paperwork. Audit log requirements read like a formality until the log is the only thing separating an intervention from a click.
What this does not fix
The four verbs specify the gate. They do not make it safe. A piece that ends on the framework has oversold it.
A verb is only as strong as the boundary that enforces it. The documented sub-agent escalation is a failure of that boundary, not of the taxonomy above it. The mode was named and the mode was crossed. A circuit breaker outside the agent is a different control from a permission setting inside it, and the four verbs do not give you one.
Buying signal out of a gate costs reviewer time. Review rates of 24.1% to 46.0% in the worked datasets are the price of knowing. That is attention moved, not attention saved.
The decay mechanisms are properties of repetition and of the system working well. They come back after every fix. No verb assignment survives without the recurring calibration the last section describes. This is a standing cost on the roadmap, not a project with an end date.
A control you are assuming
The approval prompt was never the safe baseline. It was the least examined part of the harness. It sat in the middle of a system where everything else gets watched, collecting the confidence that belongs to a control somebody has actually measured.
A gate nobody audits is not a control you have. It is a control you are assuming.
The question was never whether a model may hold the gate. A vendor settled that in public, with its own numbers, and the direction of those numbers is not the uncomfortable part. The uncomfortable part is that handing the gate to something more accurate does not hand off the duty to check it. Checking it is the work nobody has specified.
Somewhere in your system a gate is holding. Nobody has asked it anything in months.
Take three actions your agents already perform. Assign each one a verb. Write down the artefact that verb owes. If you cannot name the artefact, you have not specified the gate.