Threat dossier · P2
Automation bias and approval fatigue
Agentic workflows push dozens of approval decisions per hour, and reflexive approval turns the human checkpoint into ceremony that removes no actual risk.
Direct answer
What is automation bias and approval fatigue?
Automation bias is the documented human tendency to approve what an automated system requests; when developers face frequent agent approval prompts, they rubber-stamp the risky request along with the routine ones.
Coverage statements below are limited to the current HOL Guard support contract and do not imply universal model or harness protection.
Representative attack path
Defensive model only. This sequence omits weaponized payloads and is not attributed to a specific incident unless a source explicitly says so.
Step 1
An agent requests approvals frequently, most of them routine.
Step 2
The reviewer learns to approve quickly without full reading.
Step 3
A malicious or mistaken request rides the same pattern.
Step 4
The consequential action executes with unexamined approval.
Coverage boundary
What this control can cover
- Policy can require stronger justification for sensitive action classes instead of relying on human vigilance alone.
- Decision evidence makes each approval auditable after the fact.
What it does not prove or prevent
- Forcing a human to read or understand any request.
- Controlling the approval UI of harnesses outside the supported integration.
Policy pattern
Policy pattern for automation bias and approval fatigue
Keep untrusted context or overbroad autonomy from becoming unconditional execution authority on supported action surfaces.
Use when: Agentic workflows push dozens of approval decisions per hour, and reflexive approval turns the human checkpoint into ceremony that removes no actual risk.
Decision pattern
- Identify the trust boundary and consequential action class.
- Apply least privilege and the narrowest supported policy.
- Require review for sensitive or ambiguous actions.
- Preserve only redacted, versioned evidence needed to reproduce the decision.
Limitations
- Forcing a human to read or understand any request.
- Controlling the approval UI of harnesses outside the supported integration.
If you suspect prompt injection
Step 1
Response 1
Pause and audit recent approvals for pattern-approval behavior.
Step 2
Response 2
Re-scope policy so sensitive classes require explicit evidence review.
Step 3
Response 3
Reduce approval volume by pre-deciding routine classes.
Step 4
Response 4
Retrain reviewers on the updated boundary.
Sources and mappings
Related dossiers
Neighboring threat classes that share attack paths or trust boundaries with this dossier.