What is Approval Fatigue?
Governance & ControlThe degradation of human oversight as approval volume grows. When every risky action pauses for a person, the reviewer rubber-stamps: catch rates for dangerous actions drop from 13.6% to about 5% across a long session, while escalating everything is measurably less safe than escalating selectively.
Why It Matters
The standard safety pattern for agents is a human approval gate: risky actions pause, a person decides. The pattern assumes the reviewer stays attentive under volume. The data says otherwise. Anthropic’s telemetry showed Claude Code users approving 93% of permission prompts, climbing to 97% by August 2026. In internal evaluations, humans caught 13.6% of dangerous commands at the start of a session and 5% after fifty prompts.
Research published in 2026 formalized the curve as an inverted-U: past a threshold, more human oversight makes the system less safe, because each additional prompt degrades the attention applied to all of them.
How Attackers Use It
Approval fatigue is now an attack surface, not just a usability problem. An open threat-detection ruleset added a pattern in March 2026 for “Human Approval Fatigue Exploitation”: agents instructed to fire rapid repeated permission requests, describe dangerous actions in minimizing language, and bury risky operations inside batches of benign ones so bulk approval carries them through. The pattern maps to OWASP ASI09 and sits squarely inside EU AI Act Article 14’s oversight requirement, which explicitly demands measures against automation bias.
Where It Breaks
Full escalation is the failure mode, and it fails in both directions. Escalate everything and the reviewer becomes a rubber stamp that attackers can farm. Escalate nothing and the gate does not exist. The safety-optimal escalation rate sits below full escalation, which means the interesting engineering problem is deciding which actions deserve a human, not how to add more humans.
The monitoring gap matters too: teams instrument the agent but never the overseer. A reviewer approving 98% of requests is a control that has quietly stopped working.
How Flytebit Handles It
We size escalation so humans see judgment calls, not throughput: policy engines handle the cases that follow from rules, and approval requests arrive as structured decision packages for the consequential ones. Reviewer approval rates get monitored as a control-health signal. The full argument and the numbers behind it are in Governing Agentic AI, and the engagement version is our AI governance and risk work.