Approval Fatigue: Why Agent Oversight Became the 2026 Automation Bottleneck

The mitigation everyone reached for

The survey data from this year is unusually consistent about two things: agent incidents are common, and human review is the standard response to them. AvePoint's State of AI 2026 report, based on responses from roughly 750 global IT leaders, found that 88.4 percent of organisations experienced at least one security breach tied to an AI agent in the preceding twelve months. Of those, 95.5 percent took at least one mitigating action afterwards, and the single most common action, by a wide margin, was adding a human-in-the-loop control.

That reflex is understandable. It converts an unbounded risk into a bounded one, it satisfies an auditor asking who authorised a given action, and it requires no change to the agent itself. The problem is what happens when the reflex meets the adoption curve. Deloitte's State of AI in the Enterprise 2026 report, drawing on 3,235 enterprises, found that 74 percent of respondents expect their organisation to be using AI agents at least moderately by 2027, while only about 21 percent report having a mature governance model for autonomous agents. Gartner separately forecasts that 40 percent of enterprise applications will embed task-specific AI agents by the end of 2026, up from under 5 percent in 2025. Multiply a growing fleet of agents by a per-agent flow of approval checkpoints, and the arithmetic stops working long before the governance model matures. The oversight workforce that a uniformly gated agent estate would require does not exist and is not being hired.

What a saturated queue actually looks like

Approval fatigue does not announce itself with an outage. It shows up as a slow drift in reviewer behaviour, and the metrics that would reveal it are usually not being collected. The sequence is predictable enough that it is worth naming.

1. Volume outruns attention. A reviewer who could genuinely evaluate twenty requests a day is handed two hundred. Nothing in the system tells them that the standard has changed, so the standard changes silently.
2. Approval becomes the default. Rejection rates fall towards zero, not because the agent improved, but because reading each request in full stopped being possible. Median time-to-decision collapses into a few seconds.
3. The queue is routed around. Somebody enables an auto-approve rule for a category that felt low risk, or grants a standing exception to keep a launch on schedule. The control now exists only in the configuration, not in anyone's behaviour.
4. The audit trail keeps looking perfect. Every action still carries an approver, a timestamp and a record. A rubber-stamped approval is indistinguishable in the log from a considered one, so the evidence that would trigger a review is exactly the evidence that suppresses it.

Fatigue is now an attack surface, not just a workload problem

The security research community reclassified this during 2026, and the reclassification matters because it changes who owns the problem. An open threat-detection ruleset for agentic systems added an entry in March 2026 for human approval fatigue exploitation: an attacker instructs or manipulates an agent into generating rapid, repeated permission requests, on the reasonable assumption that a reviewer facing a burst of near-identical prompts will start clicking through them. The genuinely harmful request rides in among the noise. Rippling's agentic AI security guidance catalogues the same idea as a distinct threat class, listed as overwhelming the human in the loop.

This is confirmation fatigue used deliberately, and it connects directly to the injection problem covered in our piece on prompt injection and automation security. If an attacker can influence what an agent decides to do, they can also influence how often it asks permission — and the second capability quietly undermines the control you installed to contain the first.

The defence is structural rather than motivational. Telling reviewers to be more careful does not survive contact with volume. Rate limiting the number of approval requests a single agent run may generate, alerting on unusual request patterns rather than only on unusual actions, and treating a burst of permission prompts as an anomaly in its own right are all things the platform can do and the human cannot.

Four oversight models, honestly compared

Most teams have implemented exactly one of these, usually the first, without considering the alternatives. They are not mutually exclusive, and the useful design question is which mix fits the actions your agents actually take.

The shift most organisations need is from the first row to a combination of the middle two, with the fourth carrying the long tail. That is not a loosening of control. It is a redistribution of it towards mechanisms that do not degrade under load, which is the property a human queue conspicuously lacks.

Building an approval budget

Treat reviewer attention the way you would treat any other finite resource with a cost attached. If you had a fixed budget of, say, thirty considered human decisions per day across your whole agent estate, which actions would you spend it on? That question forces the tiering work that a blanket gate lets you avoid.

Three design decisions consistently reduce approval volume without reducing real oversight. The first is precise trigger logic: gate on the specific property that makes an action dangerous, such as amount, recipient domain or record count, rather than on the action type as a whole. The second is routing by expertise, so requests reach the person who can actually evaluate them instead of a shared inbox where everyone assumes someone else is looking. The third is a decision window with a defined default: state explicitly whether a timeout means proceed or abort, and make that choice per tier, or work will silently stall in the queue.

What the regulation actually asks for

A lot of blanket-approval architecture has been justified by compliance, and the justification is looser than it looks. Article 14 of the EU AI Act requires that high-risk AI systems be designed and developed so that they can be effectively overseen by natural persons while in use, with appropriate human-machine interface tools. The obligation on the deployer is to assign that oversight to people with the competence, training and authority to understand the system's capabilities, correctly interpret its outputs, decide not to use it, override it, and stop it entirely if needed.

Read carefully, that is a requirement for effective oversight capability, not for a synchronous approval click on every action. A monitored override, a working stop control, meaningful logging and a competent named owner can satisfy it. A saturated approval queue where nobody reads anything arguably does not, whatever the audit log says — the word doing the work in the text is "effectively".

The timeline also moved. Enforcement of the high-risk obligations was deferred from 2 August 2026 to 2 December 2027 by the Digital Omnibus package, so teams that were racing a summer deadline have more room than they planned for. That is an argument for designing oversight properly rather than for postponing it, particularly since the liability questions we covered in who pays when your AI agent fails do not wait for a regulatory commencement date. For the broader compliance picture, see our guide to the EU AI Act and business automation.

What to ask a platform or a builder

Approval steps themselves are now commodity features. Power Automate has the most mature native approvals for organisations already inside the Microsoft estate. n8n and Make give you the finest control over exactly what condition triggers a gate, which matters a great deal once you start tiering. Zapier remains the simplest to set up and the quickest to hit its limits once branching gets involved. Durable workflow engines such as Camunda are built for long-running processes that must survive restarts, hold state and produce a defensible audit trail. On the agent-framework side, OpenAI's Agents SDK supports pausing a tool call for approval and resuming from the same state afterwards, which is the primitive the ecosystem is converging on.

Because the step is commodity, the questions worth asking are about everything around it:

• Can a gate be conditioned on a computed property such as an amount, a recipient domain or a record count, rather than only on the action type?
• Does a paused run hold its state durably, so a decision taken tomorrow resumes exactly where it stopped rather than replaying from the start?
• Can you rate limit how many approval requests a single run may generate, and alert when that limit is approached?
• Does the approval request carry the context a reviewer needs to decide, or just an action name and two buttons?
• Are rejection rate, time-to-decision and per-reviewer volume exposed as metrics you can chart, or buried in an event log?
• What happens on timeout, and is that behaviour configurable per action tier rather than globally?

The last three are the ones that separate an oversight system from a notification system, and they are rarely demonstrated in a sales call unless you ask. They also belong in the same conversation as observability more broadly, which we covered in our piece on the rise of AgentOps.

Why this shows up in the cancellation statistics

Gartner's much-quoted forecast that more than 40 percent of agentic AI projects will be cancelled by the end of 2027 attributes the failures to escalating costs, unclear business value and inadequate risk controls. Approval fatigue sits at the intersection of all three. A workflow that requires a human decision on every run has not removed the labour, it has relocated it from doing the work to reviewing the work, and often to a more expensive person. The projected saving does not appear, the business case weakens, and the pilot quietly ends — while the control that caused it is recorded as diligence.

The gap between demonstration and production compounds this. Evaluation work published this year points to roughly a 37 percent gap between benchmark scores and real-world deployment performance for enterprise agentic systems, alongside cost variation of up to fifty times for comparable accuracy. Research groups including METR have moved towards measuring a model's fifty percent success horizon — the task duration at which reliability falls to a coin flip — precisely because single-shot accuracy hides how quickly things degrade over long, multi-step work. An agent that looks strong in a demo and needs constant supervision in production is the normal case, so the supervision cost belongs in the business case from the start.

None of this argues for removing humans from consequential decisions. It argues for spending them deliberately. Oversight that is applied everywhere is oversight that exists nowhere, and the organisations getting value from agents in 2026 are largely the ones that decided, explicitly and in writing, which small set of actions is worth a person's genuine attention — and then built deterministic checks, reversibility and honest telemetry around everything else.

FAQ

What is approval fatigue in an automation context?

It is the point at which a human reviewer stops meaningfully evaluating agent actions and starts approving them reflexively, because the volume of requests exceeds the attention available. The control still exists on paper and in the audit log, but it no longer changes any outcome. Security researchers now treat it as a failure mode rather than a user experience complaint, because a rubber-stamped approval leaves exactly the same evidence trail as a considered one.

Is human-in-the-loop still worth adding?

Yes, but as a scarce resource rather than a default setting. AvePoint's State of AI 2026 survey of roughly 750 global IT leaders found that human-in-the-loop was the single most common mitigation organisations added after an agent-related security incident, and it works well when it is reserved for a small number of genuinely consequential decisions. It stops working when it is applied uniformly to every action an agent takes.

How many approvals per reviewer per day is too many?

There is no published threshold, and any number quoted as one deserves suspicion. The useful test is behavioural rather than numerical: measure your rejection rate and your median time-to-decision. If reviewers are rejecting almost nothing and deciding in a few seconds, the queue has become a formality regardless of its size. A queue that still produces meaningful rejections at a considered pace is within budget.

What should always require a human approval?

The common list across published guidance is money moving above a threshold, external communication sent under your brand, data deletion, permission and privilege changes, and anything that ships code, configuration or content to production. These share two properties: they are hard to reverse and they are visible outside the company. Actions that are cheap to undo rarely justify a synchronous approval step.

Does the EU AI Act require an approval step?

Not literally. Article 14 requires that high-risk AI systems be designed so that natural persons can effectively oversee them, and that deployers assign oversight to people with the competence, training and authority to interpret outputs, override the system and stop it. An approval queue is one way to satisfy that; a well-designed override, a monitored stop control and a complete audit trail can also satisfy it. Enforcement of the high-risk obligations was deferred from 2 August 2026 to 2 December 2027 under the Digital Omnibus, which buys time but does not change the design target.

Can approval fatigue be exploited deliberately?

Yes, and it is now catalogued as an attack pattern. An open threat-detection ruleset for agentic systems added an entry in March 2026 for human approval fatigue exploitation, describing an attacker who induces an agent to generate rapid repeated permission requests so that a genuinely harmful one is waved through among them. Rippling's agentic AI security guidance lists overwhelming the human in the loop as a distinct threat class. The defence is rate limiting on approval requests and anomaly detection on the request pattern itself, not more diligent reviewers.

Which automation platforms handle this well?

Approval steps are now standard across the major platforms, so the differentiator is state and evidence rather than the step itself. Power Automate has the most mature native approvals for Microsoft estates, n8n and Make give you the most control over what triggers a gate, Zapier is the simplest and the most limited once branching gets complex, and workflow engines such as Camunda are built for long-running processes that must survive restarts, retain state and produce an audit trail. OpenAI's Agents SDK supports pausing a tool call for approval and resuming from the same state, which is the primitive most agent frameworks are converging on.

What should I measure to know whether oversight is working?

Four numbers: approval volume per reviewer per day, rejection rate, median time-to-decision, and the incident rate on actions that were approved. The last one closes the loop. If approved actions cause incidents at the same rate as unapproved ones, the gate is decorative, and the honest response is to remove it and invest the effort in deterministic checks and reversibility instead.