Approval fatigue is the silent kill shot for governed agents. The failure mode most teams miss is not a missing gate — it is the approver who eventually stops reading.
Tiering by consequence is the right design¶
Hard-gate money, contracts, external outreach, credentials, and permission changes — always a human, no auto-grant, ever. Bounded auto for routine compute inside an explicitly bounded plan — the plan defines the ceiling, the expiry, and the allowed tools, and inside those rails the agent runs free. Draft-only for proposals: the agent can write the plan, the email, the change request, but nothing executes until a human says go. That part teams usually get right, and it is the easy part.
The real failure mode: click-through syndrome¶
Put a human on every agent action and you get click-through syndrome: the 10th identical request looks like the 1st, the 20th feels routine, and the one that should not be approved slips through because a fatigued brain rubber-stamps it. The governance was not bypassed; it was obeyed into irrelevance. Every approval system degrades into this unless the design fights it deliberately: human attention is a scarce resource, and every approval that did not need a human spends it — leaving less attention for the one approval that did.
Make each decision scarce and the exception obvious¶
The fix is not more gates — it is making each decision scarce. Two patterns that work: keep the human's decision surface small, so only the hard-gated tier ever reaches a person and everything else auto-blocks or auto-runs inside its bounds. A human who sees three approvals a day reads them; a human who sees three hundred approves them.
And force explicit ownership on the edge cases: a capability request with no recorded identity cannot auto-grant; it parks as REQUIRES_OWNER_ACTION until a human says "yes, and here's who's responsible." The approver has to confront the who, not just the what — because "approve this tool call" is an abstraction a tired brain can wave through, while "take responsibility for this identity" is a decision that demands a second thought.
The takeaway¶
Humans who approve everything approve nothing. Design the system so they only ever approve the things that matter — and every approval they see is rare enough to actually read. Scarcity is not a compromise on oversight; it is exactly what makes oversight real.