---
title: "Approval prompts are a confession"
author: Dan Birman
url: https://dbirman.com/approval-prompts
updated: 2026-11-12
summary: "An agent should ask when a step leaves the plan you approved, and say what changed."
---

# Approval prompts are a confession

[Writing](https://dbirman.com/writing) · November 2026 · 3 min

Drafted with Claude from my notes. I’m still editing it.

**Summary.** An agent should ask when a step leaves the plan you approved, and say what changed. In my ChatGPT Work tests, every send card said only “ChatGPT will call Gmail’s Send Email tool.”

The recipients sat behind “See details.” In one test, a vendor document asked AI assistants to send a copy to an outside address. Work rightly emailed only me ([the test](https://dbirman.com/review-chatgpt-work#rv-whose)). The card would have looked the same either way.

[Image: Now: the card names the tool.]

[Image: Mockup: the card shows the email, and flags the address the document added. In my tests that address never reached the card; this is what the card should say if it does.]

An approval prompt confesses that the agent doesn’t know what you’d want next. Prompts like Work’s ask about the kind of action, after the agent has drafted the email. You need to know whether this is the step you agreed to.

## People approve routine prompts by habit

[Image: 93% of permission prompts approved by Claude Code users. 29 of 138 problematic actions blocked once they reached execution, in a study of 48 people supervising web agents. People say yes to nearly every routine prompt and block few of the problematic actions. Sources: [Anthropic](https://www.anthropic.com/research/claude-code-auto-mode); [Chen et al.](https://arxiv.org/abs/2604.04918), a preprint.]

At that rate a quick yes is a reasonable habit. The prompts that matter look like the ones that don’t.

Chen et al. suggest people stepped in when a moment visibly needed judgment, and less often on routine forms. A card that looks the same for every email is about as routine as a form gets.

## Asking less can still miss the plan

Claude Code’s auto mode hands approvals to a classifier, a second model that blocks anything beyond the request ([Claude Code docs](https://code.claude.com/docs/en/permission-modes)). Anthropic is open about the cost: the classifier still let through 17% of 52 real overeager actions. In most misses Anthropic examined, the classifier saw the danger but misjudged what the person had consented to ([Anthropic](https://www.anthropic.com/research/claude-code-auto-mode)).

OpenAI’s Model Spec moves approval to the start: the model asks before acting outside an agreed scope ([Model Spec](https://model-spec.openai.com/2026-10-29.html#scope_of_autonomy)). Its example scope sets limits on tools, time and cost. A step can stay inside every limit and still leave the plan.

## Ask when a step leaves the plan

The clearest record of consent is usually the plan you approved. I’d build on auto mode and the Model Spec: agree on a plan up front, then check each step against it.

In my pattern [Interrupt on drift](https://dbirman.com/drift), the agent works quietly while it follows the plan, even when it sends or spends. When a step leaves the plan, it stops mid-task and names the difference: a new recipient, a substituted source, a skipped step. In another study, 81 percent of participants preferred the authors’ mid-task confirmations to one at the end ([Zhou et al.](https://arxiv.org/abs/2510.05307)).

[Image: The same eight-step run under three rules. On drift, the agent asks twice: for the plan, and when a step leaves it.]

If the plan is bad, the agent follows it without asking. In a 248-person study, reviewing and editing an agent’s plan didn’t help people trust good plans and distrust the rest ([He et al.](https://doi.org/10.1145/3706598.3713218)). Some steps need a hard stop whatever the plan says.

My mockup of Work’s send card, at the top, is still an approval prompt ([the review](https://dbirman.com/review-chatgpt-work)). Now it confesses something worth stopping for: a recipient you didn’t choose.

I tested Work on October 16, 2026, with Claude running the steps. OpenAI documents a Plan mode, but I couldn’t find it in Work on the web, so I couldn’t test it against an approved plan.