Agent operations
Draft for human review
August 2026 · 8 min read
Stop asking agents for permission at every step. Start deciding where approval belongs.
The hard part of using agents is not merely granting autonomy. It is choosing the right moments for a human to exercise judgment—and making those moments easy to understand.
Agent autonomy is increasing in real use, but autonomy does not mean that people disappear from the loop. It changes the shape of the loop.
Anthropic’s February 2026 analysis of millions of human-agent interactions reported that, in the longest Claude Code sessions, the duration of work before stopping rose from under 25 minutes to over 45 minutes in three months. The same analysis found that complex tasks prompted agent-initiated clarification more than twice as often as human interruptions.[1] The implication is not “leave the agent alone.” It is that a team needs an operating model for when to intervene.
01. Why endless prompts fail
Approval prompts are a crude form of control. They force attention onto individual actions, including actions that are low-risk, routine, and difficult to evaluate in isolation. A user can end up approving a long sequence without actually understanding the plan.
Anthropic says Claude Code users approved 93% of permission prompts in its March auto-mode write-up, describing the resulting risk as approval fatigue.[2] That number applies to Claude Code users in Anthropic’s analysis—not every tool or company—but it makes the design problem concrete: a control that is always triggered can become a control nobody meaningfully uses.
The question is not “how do we remove approvals?”
It is “which decisions deserve deliberate attention?”
02. Three approval models
A. Per action
The agent requests permission before each sensitive action.
Best when the task is short or the blast radius is unclear. The weakness is fragmentation: the user sees individual moves, not the strategy.
B. Per plan
The agent proposes an approach; the person reviews and approves the approach before execution.
Useful when the work is legible as a sequence. Anthropic describes this approach in its discussion of Plan Mode: users can review, edit, and approve a whole plan, while retaining the ability to intervene.[3]
C. Per boundary
The agent runs freely within explicit rules and stops at named thresholds.
Useful for a repeatable workflow. The boundary might be a production system, an external message, a financial change, a new credential, or any irreversible action.
These models are not mutually exclusive. A small team may use per-plan review for a research task and per-boundary controls for a familiar local coding workflow. The mistake is treating the most permissive option as the destination.
03. A practical default for a first pilot
For a new workflow, begin with per-plan approval plus hard boundaries. Ask the agent for a short plan. Let it edit and test inside a narrow, version-controlled workspace. Require it to stop before it changes shared infrastructure, touches credentials, sends anything externally, or makes a judgement call that is not encoded in the brief.
This approach does not make the agent “safe.” It makes the work more inspectable. Anthropic’s trustworthy-agents discussion argues that agent behavior depends on more than the model: the harness, the tools, and the environment all create capability and oversight points.[3] That is a useful mental model for any team, even if they are not using Anthropic’s products.
The first-pilot checklist
- Write the outcome and the out-of-scope actions in plain language.
- Require a plan for work that spans multiple systems or has meaningful consequences.
- Keep the first environment narrow, reversible, and reviewable.
- Name the reviewer and the conditions that require a pause.
- Log what the agent did, what it could not do, and what you had to correct.
The point is not to slow everything down. It is to put friction where it produces information: before a consequential plan starts, at an unfamiliar boundary, and when the agent’s confidence is not the same as evidence.
Next move
Build a bounded agent briefUse the brief builder to name the job, boundaries, evidence, and review step.
Sources and review note
Read the material behind the note.
Fact-check status: source links and quotations reviewed against retrieved first-party pages on 22 Aug 2026. This is The Model Note editorial guidance, not security, legal, or operational assurance. Human editorial approval is required before public indexing.