Your Agent Asks Permission Nine Times an Hour, So Nobody Reads the Prompts Any More. Spend a Fixed Approval Budget.

An inbox-and-calendar assistant ships with human approval on every write. Day one, the user reads each prompt carefully. Day three, they have approved forty of them and every single one was fine, so they start clicking through on reflex. Day nine the agent proposes declining a recurring meeting series — all 43 future instances, invites withdrawn from six external attendees — and that prompt gets the same half-second reflex click as the forty-three harmless ones before it.

The guardrail was present, correctly wired, and logged. It still failed, because the thing it depended on was a human paying attention, and attention is a consumable.

🛡️ Confirmation is a budget you are already overspending

Adding a confirmation prompt feels free to the person building the agent. The cost is paid entirely by someone else, later, in attention — and it is not paid per prompt, it is paid across all of them. Each low-stakes approval you add slightly lowers the odds that the high-stakes one gets read.

So stop treating approvals as a safety net you can make denser and start treating them as a fixed budget. Decide up front roughly how many decisions a session can ask a human to genuinely make — say five — then design backwards from that number. Anything beyond it is not extra safety; it is noise that degrades the five that matter.

Classify every write action on two axes

Not risk. Risk is a vibe and everyone scores it differently. Use two things you can actually determine from the tool definition:

Reversibility — can the effect be undone, and how expensively?

• Free: one API call restores the prior state (rename a file, move a card, set a label).
• Costly: undoable, but with cleanup or someone noticing (delete a record with a 30-day bin, cancel a booking that charges a fee).
• Irreversible: nothing restores it (money moved, email sent, message posted, invite withdrawn, webhook delivered).

Reach — who sees the effect?

• Private: only the principal's own data.
• Team: colleagues inside the trust boundary.
• External: people outside the org, or systems you do not control.

That produces a grid, and the grid tells you which lane each tool belongs in:

Three lanes, and only one of them spends budget.

Lane 1 — auto-allow, with a scope instead of a prompt

The reversible-and-private corner should never interrupt anyone. Pre-authorize it once, at the scope level: this agent may label, move, archive and draft within your own mailbox. That is a single decision the user makes knowingly at setup, rather than two hundred they make on autopilot.

The trap here is treating the scope as permanent. Pair it with a ceiling, because "reversible" stops being true at volume — relabelling one thread is free, relabelling nine thousand is a mess nobody will untangle by hand.

allow: mail.label, mail.archive, mail.draft
  scope:   principal's own mailbox
  ceiling: 50 objects per run
  on_breach: escalate to approve, once, for the whole batch

A ceiling that escalates on breach is worth more than a prompt per call, and it costs one approval instead of fifty.

Lane 2 — the undo lane

Most of the middle of the grid does not need a question beforehand. It needs a reversal window afterwards.

Execute immediately, log the action in a form the agent can invert, and hold the visible effect for a short delay: outbound messages sit in a send queue for 60 seconds, destructive edits keep a one-click revert for the rest of the session. The user is notified, not interrogated.

This lane is where the biggest win usually is, because it converts a decision the human has to make while they are busy doing something else into a decision they only make if something looks wrong. ✅ Notify-and-revert beats ask-and-wait whenever an inverse operation genuinely exists.

⚠️ It only works if the inverse is real. "We log enough to reconstruct it" is not an undo. If you cannot write the reversal function today, the action belongs in lane 3.

Lane 3 — spend the budget, and make the prompt carry the diff

The approvals you keep get one job: give the human the specific thing they need in order to say no. Which means showing the effect, not the intention.

❌ What most agents show:

The assistant wants to update your calendar. Approve?

✅ What makes a reflex click impossible:

DECLINE  "Weekly design sync"
  43 future instances (Oct 2 - Sep 24)
  withdraws invites from 6 people, 4 external
  NOT REVERSIBLE — declined invites cannot be re-sent by this agent

Counts, names, the boundary crossed, and the reversibility verdict stated in the prompt. The user does not have to reconstruct the blast radius from a verb; they read it.

One more rule for this lane: never batch unlike actions behind a single approval. "Approve 12 changes" is how an irreversible external action rides along inside eleven harmless ones.

🔍 The diagnostic: measure time-to-approve

You can tell whether your gates are real with one number. Log the milliseconds between showing an approval and receiving the answer, and look at the distribution.

• Median under ~2 seconds → nobody is reading. Your gate is a UI habit, not a control. Move actions into lanes 1 and 2 until the median rises.
• Approval rate at or near 100% over dozens of prompts → you are gating things that did not need gating. The denials are what make the gate load-bearing.
• More than a handful of prompts per session → the task is mis-scoped. Ask once, over a plan, before the run, rather than repeatedly during it.

A near-perfect approval rate is usually read as evidence that the agent behaves well. It is at least as likely to be evidence that the human stopped evaluating, and you cannot distinguish those two readings from the rate alone — only from the latency and the denials.

The takeaway

A guardrail that fires on almost everything protects almost nothing, because its effectiveness depends on a human resource that depletes. Count your approvals per session as a cost you are imposing. Then cut it until every remaining prompt is one a careful person would actually stop and think about — and make sure each of those tells them exactly what cannot be taken back.