Approval Fatigue: How Human-in-the-Loop Gates Decay Into Rubber Stamps

Put a human in the loop and you have a control. Put a hundred approval requests a day in front of that human and you have a rubber stamp wearing a control's badge. The two look identical on an architecture diagram. They behave nothing alike under load, and the gap between them is where most "responsible AI" deployments quietly fail.

The pattern is familiar to anyone who has watched a security operations center drown. Industry surveys put the share of alerts that go uninvestigated somewhere between a quarter and two-thirds — one frequently cited figure is that 62% of alerts are simply ignored, and 55% of teams admit to regularly missing alerts they would classify as critical. The analysts aren't lazy. They are processing a few thousand alerts a day with a false-positive rate that often exceeds 50%, and the human brain responds to that ratio exactly the way you'd expect: it stops looking. Agentic AI is now recreating this exact failure mode, one confirmation dialog at a time.

The uncomfortable part is that approval fatigue is not a UX annoyance you can polish away. It is a predictable consequence of cognitive economics. When the cost of reading every proposal exceeds the perceived payoff — because 95 of the last 100 were fine — a rational operator optimizes by skimming, then by pattern-matching, then by clicking "approve" as a reflex. Google DeepMind researchers catalogued this as one of the named "AI agent traps" in 2025, and it deserves to be designed against with the same rigor you'd apply to a memory leak.

Why the Human Stops Reading

The mechanism has a name in the human-factors literature: automation bias. It is the tendency to over-trust an automated system and under-engage your own judgment, and it has been measured for decades in aviation and medicine long before agents existed.

A systematic review of automation bias in clinical decision support found that clinicians presented with confident, mostly-correct machine recommendations will accept erroneous advice a meaningful fraction of the time — studies report acceptance rates of bad AI suggestions in the 6–11% range, with one computational-pathology experiment showing a 7% rate at which initially correct human judgments were overturned by wrong AI advice. Critically, time pressure didn't necessarily increase how often the bias struck, but it increased its severity. The aviation world tells the same story under a different label — automation complacency, where pilots trust the autopilot so completely they stop scanning the instruments, and lose the situational awareness needed to take over when it fails.

Three forces compound to produce the decay:

• Volume overwhelms judgment. Past some throughput, every reviewer switches from evaluation to pattern-matching. They are no longer asking "is this correct?" but "does this look like the last forty that were fine?"
• Reliability breeds disengagement. The better your agent gets, the less attention each approval receives — and the more dangerous the rare bad proposal becomes, because no one is calibrated to catch it.
• Rejection is expensive. If saying no means stalling a workflow, filing a justification, or arguing with a teammate whose work the agent automated, the path of least resistance is yes.

Notice that none of these are fixed by telling people to "pay more attention." Attention is the resource being depleted. You cannot exhort your way out of a resource problem.

When the Stamp Becomes a Security Hole

Rubber-stamping isn't only a quality problem. It is a documented attack surface.

Consider what an approval stream actually trains. If every trivial, read-only action — a database lookup, a file read, a status check — demands a confirmation, you are running thousands of reps that teach the reviewer one lesson: approving is safe and approving is fast. You have built a reflex. Now an attacker who can influence the agent's output — through prompt injection, a poisoned document, a compromised tool — only needs to bury one consequential action inside a stream of routine ones. The malicious "delete the backups" or "wire the funds" arrives wearing the same dialog box as the four hundred harmless lookups before it, and it gets the same reflexive click.

This is the clickthrough vulnerability, and it inverts the intuition behind uniform gating. The instinct to "require approval for everything, just to be safe" is precisely what manufactures the inattention that makes the dangerous approval slip through. More gates can mean less safety. An oversight process that fires constantly is indistinguishable, from the attacker's point of view, from no oversight at all — except that it also produces an audit log that falsely certifies a human looked.

Regulators have started to name this. The EU AI Act's Article 14, on human oversight of high-risk systems, explicitly requires that deployers enable operators to "remain aware of the possible tendency of automatically relying or over-relying" on AI output — automation bias, called out by name in the text. The law now expects you to design against rubber-stamping, not just to install a human and call it governed.

The Tells That Your Oversight Is Theater

Loading…