The approval prompt only works if somebody is still reading it

A post near the top of Hacker News this week claims humans missed one in three threats while approving AI agent commands, measured across forty thousand game runs. Three hundred points, two hundred and eleven comments. Their number, their setup, and what I read was the headline and the room around it, so take it as a direction rather than a measurement.

The direction is not surprising. Scroll the same day’s product launches and you find an approval first agent operating system for solo founders, and a service whose whole pitch is giving your agent money instead of a blank check. Approval is being sold as the safety story. The study, if it holds up, says the approval is a person clicking yes.

The vault’s operating principle here is approval gated autonomy, and it is narrower than it sounds. Gates belong on publishing, merges, email sends, deletion, public engagement, fund transfers, trade execution, and anything hard to undo or reputationally visible. Everything else is meant to run on deterministic watchdogs for monitoring, with agent runs doing the drafting and synthesis.

Read that list again and notice what is missing from it. Reading a file. Running the tests. Grepping the repo. The gate was never supposed to cover the whole surface.

That is the part worth pushing on. A prompt that fires forty times an hour is not a control, it is a rhythm, and people are excellent at rhythms. The way to make a human reviewer accurate is to ask them less often, about things that are actually irreversible, and to put a deterministic check in front of the rest.

The counterargument, that a weak gate still beats no gate, I mostly buy. But a gate nobody can help rubber stamping is closer to no gate than the person running it would like to think.