Approval fatigue is the pattern in which the people supervising an AI agent come to approve its permission prompts habitually rather than deliberately, so that interactive confirmation stops functioning as the safety check it was designed to be. Dive into Claude Code: The Design Space of Today’s and Future AI Agent Systems treats it as a documented behavioral pattern rather than a hypothesis, relaying Anthropic’s own analysis that users approve approximately 93% of permission prompts in Claude Code and reading that figure as indicating that approval fatigue renders interactive confirmation behaviorally unreliable as a sole safety mechanism.
Usage
The term is used to argue for a particular architectural conclusion: that a system must maintain safety independently of human vigilance, because users approve without careful review. In the analysis of Claude Code it is given as the motivation for deny-first evaluation, blanket-deny pre-filtering and Sandboxing as layers that operate regardless of user attentiveness, and for the choice to restructure the problem rather than add more warnings — defining boundaries within which the agent can work freely instead of asking for per-action approvals that users stop reviewing once habituated.
The same source relays two further measurements from other publications it cites. Longitudinal usage data shows auto-approve rates rising from roughly 20% at fewer than 50 sessions to over 40% by 750 sessions, alongside substantial increases in session duration; the paper quotes that study’s description of the result as autonomy that is “co-constructed by the model, the user, and the product”, and adds its own reading that the gradient is navigated not by deliberate mode selection but by gradual habituation. Separately it reports that sandboxing reduced the frequency of permission prompts by an estimated 84%, which it characterizes as reframing the problem as a human-factors concern: the architectural response to unreliable human approval is to reduce the number of decisions humans must make.
2026年のAI Coding Agent活用 ── スピードと安全性を両立させる states the same mechanism from practice rather than from measurement, and turns it into a configuration rule. Its formulation is that once the number of approvals gets too high, people start approving without looking at what they are approving, so security falls rather than rises. What it takes from that is a configuration recommendation that runs the opposite way to the obvious one: curate both the allow and the deny list first, then work in the mode that auto-approves edits, adding unobjectionable operations to the auto-approval list deliberately so that the prompts which remain are ones worth reading — rather than prompting more. It pairs the same reasoning with Sandboxing, recommending the setting that auto-allows shell commands on the grounds that they are sandboxed, and relays from the vendor’s own engineering write-up that sandboxing cut the number of permission prompts substantially.
Related Terms
Deny-First Permission Evaluation, Human-in-the-loop, Sandboxing, Guardrails, Dive into Claude Code: The Design Space of Today’s and Future AI Agent Systems