AI agent autonomy: approve first, then monitor

You should not have to approve every file read to keep an AI agent under control. AI agent autonomy should grow for a specific kind of work after you have checked its record. Let routine, reversible work move from approval to monitoring. Keep consequential actions behind a decision you make before they happen.

What to take away

Give more freedom to a tested kind of action, such as preparing drafts, rather than to everything an agent can do.
Fewer approval prompts only help if you can see the work and stop it.
Keep sending, paying, permanent deletion and accepting terms subject to explicit approval.
A failure should reduce autonomy for the affected work until you have checked the cause and the fix.

The short answer: approve first, then monitor

Start with approvals on unfamiliar work. After a clean record on that kind of task, approve the plan and monitor execution within enforced limits. Let proven, reversible routines run and report. Keep irreversible actions gated, and configure a return to approval when the work breaches its agreed limits.

That is our recommended approach to progressive trust. It is a policy you choose and test, not a claim that any particular product already supports it. There is no universal number of successful runs that makes an agent trustworthy.

For example, an agent can earn room to prepare a weekly report from copied files while still needing your approval to send it. Writing a sound report establishes something about drafting. It establishes nothing about choosing recipients or deciding when a message should leave.

Approving everything can turn into rubber stamping

If the answer to every prompt is yes, the prompt has stopped doing useful work. You are interrupting your day without making a decision.

In Trustworthy agents in practice, Anthropic describes how repeated approval requests can lead users to tune them out. Its Plan Mode moves review toward the proposed strategy before execution, while preserving the ability to intervene. AWS's Agentic AI Lens also warns that reviewing every action creates rubber stamps and recommends directing human attention to decisions where it matters.

A useful approval request arrives before the action. It shows exactly what will change, what the consequences are and what remains uncertain. You can approve, reject or change it. A vague request to continue gives you very little to judge.

Removing repetitive prompts should make the remaining decisions easier to notice. If the product merely replaces them with a blanket allowance, you have given up review without gaining a reliable way to supervise.

Experienced users approve less and interrupt more

Anthropic's February 18, 2026 study of agent autonomy found that newer Claude Code users, with fewer than 50 sessions, used full auto-approve in roughly 20% of sessions. By 750 sessions, that rose to over 40%. Interruptions also rose: from about 5% of turns around 10 sessions to around 9% among more experienced users.

These are smoothed observational trends for Claude Code users, not safety scores. The charts use LOWESS smoothing, and Anthropic notes that some of the change may reflect users reconfiguring default manual approvals as they learn the product. The session counts are observations, not promotion thresholds.

Anthropic interprets the pattern as a move toward monitoring and intervening. It does not prove that auto-approve caused better outcomes or that experienced users caught every mistake.

You can stop reviewing every step and still pay attention to the work. Catch a wrong turn while it is happening. Discovering an irreversible action in a completion message is too late.

Use four rungs for each kind of work

Feng, McDonald and Zhang's Levels of Autonomy for AI Agents separates autonomy from capability and describes five user roles: operator, collaborator, consultant, approver and observer. It also identifies rubber stamping as an unresolved problem. The four rungs below are our practical adaptation, loosely related to those roles rather than a reproduction of their scale. Our highest rung retains intervention; their observer level permits only an emergency shutdown.

1. Watch it work on disposable material

Use sample data or copies whose loss would not matter. Stay close enough to see how it interprets the assignment, checks its result and handles an unexpected input. Start here when the task is unfamiliar or the product has changed substantially. A polished explanation at the end does not substitute for checking the output.

2. Approve each meaningful change

Review proposed changes before they happen while you learn its behavior on this work. If the agent prepares edits to a document, compare the proposed changes with your instruction. You should be deciding whether the change is right, without having to direct every file read along the way.

3. Approve the plan, then monitor

For familiar, reversible work, agree on the outcome, the material it will use and where it must stop. Let it carry out the intermediate steps. If the task changes in a way that invalidates the plan, it should pause rather than stretch your approval to cover a different job.

4. Let the routine run and report

A proven routine can start under standing instructions, finish inside its limits and leave a result you can inspect. Keep a working stop control and a way to withdraw that allowance. Automatic execution still needs review of its results, especially after changes to inputs or tools.

Use different rungs for different actions in the same task. A report may be drafted at the fourth rung while sending it stays at the second. Our rule is to keep sending, paying, permanent deletion and accepting terms behind explicit approval, regardless of how well routine preparation has gone. For the separate question of how much access to grant, use the AI agent permissions guide.

Check the support before loosening approval

The limits must hold while you are looking away. Anthropic's October 2025 sandboxing post reports 84% fewer permission prompts in its internal usage, using operating system controls for filesystem and network isolation. That is a vendor-reported result in its own environment, not an independent safety benchmark or a result for ERIKA. It illustrates how enforced boundaries can reduce interruptions. It does not establish that every action within a boundary is correct.

You need a record you can check. Compare the saved output with the inputs and the approved scope. Include failed attempts and corrections in that review. A run that needed you to repair the answer should not quietly count as an unassisted success. The guide to evidence and audit trails explains what a useful record needs to preserve.

The track record must survive the session. Keep the kinds of work tested, the failures found and the reasons you changed supervision. If a restart loses that history, the next run cannot reliably use it to justify more freedom. That dependency is part of why agent memory matters between sessions.

Try withdrawing the allowance. In a disposable test, stop an active routine and check that another action cannot start under the old grant. If you cannot establish whether stopping works, keep that uncertainty in the decision. Our five checks for a real AI agent provide related exercises for enforced limits and continuity.

A clean record should include ordinary variations, such as a missing input or a changed document format. Repeating the same prepared example tells you little about what happens when the work changes. Choose the evidence you need according to the cost of a mistake.

Trust should fall faster than it rises

Decide what triggers a return to approval before granting more freedom. Going outside the agreed scope, concealing a failed action or claiming completion without a check should suspend automatic work in the affected class. A harmless formatting correction may need an edit rather than a suspension. The rule should track the failure's consequence.

Tom Sato's Progressive Trust Internet-Draft, revision 04, requires human approval for increases in authority and allows some reductions to be automatic. Its section 8.3 limits automatic reductions to advisory urgency; recommended or required reductions still need human approval. This is an individual draft with no IETF endorsement, not a standard.

Our recommendation is broader: configure an automatic pause for the affected routine when an agreed failure condition occurs, then let a person decide whether to restore it. Keep that policy separate from the draft's specific mechanism.

A drafting error need not stop unrelated read-only research. An unauthorized send is different: stop sending, establish what happened and require approval before it resumes. Where a failure leaves the wider limits uncertain, pause the wider work too. Let the evidence determine how far the restriction needs to reach.

Restoring autonomy should be a deliberate decision after checking the cause and the correction. The agent should not promote itself because it has produced another confident completion message.

Earned trust needs a home beyond one conversation

An always-allow checkbox can outlive the reason you clicked it. A new conversation can also lose the reason you were cautious. Either way, you end up explaining the same limits again or discovering that an old allowance still applies.

The system carrying the work should preserve the current supervision rule alongside the evidence used to grant it. When the task resumes, that rule should still govern it. When you withdraw it, the next action should use the reduced allowance. These requirements can be evaluated in existing products; an operating system label alone proves none of them.

They also explain our direction at eFreedom. eFreedom is the company building ERIKA, its one product, an operating system where the user is purely AI. We think the record of earned autonomy belongs in the system that carries the agent across sessions. That is a design principle, not a claim that ERIKA has implemented or passed the checks in this article.

Sources

Sources checked October 26, 2026. The four rungs, permanent approval rule and proposed pause policy are our recommendations. The reported usage trends and sandboxing result come from Anthropic; they do not establish a universal safety threshold.

Written by Max Medawar, founder of eFreedom, in Silicon Valley.