You are the approval screen

What happened

A study circulated this week (Scalex, via Hacker News) reporting that across 40,000 simulated runs, people approving AI-agent commands missed one in three planted threats. One caveat up front: the methods haven't been independently audited, so treat the number as a prompt, not a law. But the shape of the finding matches what anyone who has clicked "Approve" fifty times in an afternoon already knows: approval fatigue is real, and it arrives fast.

Why it matters to you

More of your tools are becoming agents — they draft, file, send, and book things, and they ask you before acting. That yes/no moment is now a real part of your job. The study's uncomfortable message is that the moment is failing quietly: not because people are careless, but because approval screens ask for a decision without giving the information a decision needs. You can't fix the vendor's screen. You can fix what you check before you click.

How to do it (today)

Run the checklist below on your next ten agent approvals — email drafts, calendar actions, file operations, anything. It takes about fifteen seconds once it's habit.

ARTIFACT — The 5-check approval habit

Before clicking Approve, answer:

1. WHAT, exactly? Can I state the specific action in one sentence — recipient, file, amount, destination? If the screen doesn't tell me, that's a no.
2. BLAST RADIUS. If this is wrong, what's the worst version? (Sent email = unrecallable. Draft = free.) Approve irreversible things at a different speed than reversible ones.
3. LEAST PRIVILEGE. Is it asking for more than this task needs ("access all files" for a one-file job)? Scope creep in the request is the tell.
4. ROLLBACK. Do I know how to undo this, concretely? If the answer is "probably somewhere," find it before, not after.
5. NOT-MY-CALL LINE. Does this touch money, clients, or someone else's data? Then the approval isn't mine alone — route it, even when that feels slow.

Print it, stick it next to the screen, and count your own "wait, actually" catches for a week. One catch pays for the habit.

The lesson

Agents didn't remove human judgment from the loop — they compressed it into a two-second click. Guard that click like it's the whole job, because increasingly, it is.