Approval fatigue is agent governance's next attack surface

Every rollout of agentic AI inside a company eventually arrives at the same design decision: let the agent act, but make it ask first. It is the most common safety mechanism in agentic systems right now, and it is the right instinct. An agent that can touch a production database, send an external email, or close a support ticket should not do it unsupervised.

The problem shows up once the asking starts happening at volume. The first request, a person reads carefully. The tenth, they skim. Somewhere past that, they are clicking approve before finishing the sentence, because the last twenty requests were all fine and there is other work to do. The control is still there on paper. It has just stopped doing anything.

This is approval fatigue, and it is not a new phenomenon wearing a new name. It is worth being precise about what the research actually supports here, what it doesn't, and why attackers are now building this failure mode into their prompts on purpose.

The pattern security teams already know

Approval fatigue is a direct descendant of alert fatigue, which security operations centers have been fighting for years. A 2025 survey in ACM Computing Surveys found that almost 90 percent of SOCs report being overwhelmed by backlogs and false positives, and 80 percent of analysts say they feel consistently behind. When the volume of alerts outpaces the capacity to evaluate them, teams don't slow down and miss deadlines. They speed up and miss alerts.

The same mechanism shows up outside security. A widely cited CHI 2020 study of cookie consent banners found that only 11.8 percent met basic legal requirements for informed consent, and that the overwhelming majority relied on the same reflex: presented often enough, "accept all" stops being a decision and becomes a muscle memory click. Researchers now call this consent fatigue, and it is the same shape as alert fatigue: a safeguard that fires so often it trains the person to defeat it.

Agent approval prompts are the same mechanism with a new delivery vehicle. When an agent asks permission for everything, from a harmless read to a destructive delete, the requests blur together and the brain does the sensible thing under repetitive load: it stops treating each one as a fresh decision.

Where the shorthand overreaches

It is tempting to explain all of this with "decision fatigue," the idea that willpower is a depletable resource and judgment degrades the more decisions a person makes in a row. It's a satisfying explanation, and it is also less settled than the popular version suggests. A 2025 large-scale field study in Communications Psychology tested decision fatigue directly, using high-resolution data from healthcare professionals making real medical judgments over time, in a setting built specifically to isolate fatigue from confounds. The result was a clean null: no credible evidence that decision quality degraded with the number of decisions made. The authors note this doesn't rule out weaker or more context-specific versions of the effect, but it does undercut the idea that people simply run out of a fixed reserve of judgment.

What the SOC and consent-fatigue research supports is narrower and more useful than a fuel-tank theory of willpower: under high-frequency, low-variance, repetitive load, people build heuristics and defaults, and the fastest available heuristic is "approve." That's a calibration problem, not a depletion problem, and the distinction matters for how you fix it. If approval fatigue were about a draining resource, the fix would be fewer prompts and more breaks. If it's about heuristic formation under repetitive load, the fix is about what varies in the request stream, not just how many requests there are.

Attackers noticed first

Here is the part that has changed the shape of this problem recently: approval fatigue is no longer only something your own agents accidentally induce in your own staff. It is now a documented, named technique that adversaries deliberately engineer for.

An open threat-detection ruleset for agentic systems added an entry in March 2026 for exactly this: "Human Approval Fatigue Exploitation," describing patterns where an attacker instructs an agent to generate rapid repeated permission requests, uses minimizing language to make dangerous actions read as routine, or embeds a risky operation inside a batch of benign ones so it slips through under bulk approval. The rule maps directly onto the OWASP Agentic AI Top 10's category for human trust exploitation and onto EU AI Act Article 14's human oversight requirement, and its detection logic is built entirely around language: phrases like "just click approve for all," "nothing to worry about, batch execute these," or "don't bother reviewing each one" are treated as adversarial signals in their own right, independent of what the underlying action actually does.

That is a meaningful shift. It means the language surrounding a request, not just its tool call and parameters, is now something a governance layer has to evaluate. A request that says "routine cleanup, approve all" and a functionally identical request with no framing at all are not the same event anymore. One of them is trying to manufacture the exact cognitive shortcut the research above describes.

Why uniform approval gates make this worse

Gartner's May 2026 guidance on agent governance names a related root cause: applying the same approval process to every agent regardless of its autonomy level. Their framework splits agents into four tiers, from read-only "observe" agents up to fully autonomous ones, and it calls out the "act with approval" tier specifically as the one where the model breaks down under its own weight: without strong workflow design, "approvals can degrade under time pressure or approval fatigue, creating a false sense of safety while expanding the attack surface." Gartner's related prediction is blunt: by 2027, 40 percent of enterprises will demote or decommission autonomous agents because governance gaps only surfaced after something already went wrong in production.

The common failure in both the Gartner framework and the threat-rule catalog is the same one: a single, undifferentiated approval queue, applied uniformly regardless of what's actually being asked, is not a control. It's a rate limiter on human attention, and rate limiters get exhausted.

What actually holds up

None of this argues for fewer approvals in general, and it doesn't argue for smarter models that decide for themselves when to ask, either. A policy that lives only in a model's instructions can be talked out of it by a confusing request, an edge case, or a prompt built for exactly that purpose. The gate has to sit somewhere the request can't argue its way past.

A few things follow directly from the research and the threat data above, independent of any specific tool:

• Gate on consequence and reversibility, not on a fixed category like "write access." A ticket update and a production delete are both writes, but they are not the same risk, and treating them identically is what produces volume that trains people to stop reading.
• Treat framing as a signal, not noise. A request that arrives with language designed to sound routine, urgent, or harmless deserves more scrutiny, not less. If the pattern above is right, that language is often doing exactly what it looks like it's doing.
• Route by exception, not by everything. The tiers Gartner describes only work if most volume never reaches a human at all, and what does reach them is genuinely worth their attention. An approval queue that a person can meaningfully read is a control. One they've learned to clear without reading is a formality.
• Measure the fatigue itself. Approval volume, time-to-approve, and override rates are governance signals, not just usage metrics. A shrinking time-to-approve across a growing volume of requests is the numeric fingerprint of a control quietly turning into theater.
• Approval fatigue used to be something a security team caused itself and had to manage internally. It's now something an adversary can try to manufacture on purpose, with prompts built and tested for exactly that outcome. Any organization rolling out agent approval workflows this year should design for both.

Sources

• Alert Fatigue in Security Operations Centres: Research Challenges and Opportunities, ACM Computing Surveys, 2025
• Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence, CHI 2020
• No evidence for decision fatigue using large-scale field data from healthcare, Communications Psychology, 2025
• ATR-2026-00118: Human Approval Fatigue Exploitation, Agent Threat Rules community catalog
• Gartner Says Applying Uniform Governance Across AI Agents Will Lead to Enterprise AI Agent Failure, Gartner, May 2026