--- title: "Interrupt on drift, not on danger" author: Dan Birman url: https://dbirman.com/drift updated: 2026-11-10 summary: "Most agents ask for approval based on what kind of action it is: sending, paying, deleting." --- # Interrupt on drift, not on danger Agent Trust Patterns · 02 · v1 · Oct 2026 · 4 min Most agents ask for approval based on what kind of action it is: sending, paying, deleting. People approve almost all of those prompts, and over time they stop paying close attention to what they approve. The action worth interrupting for is one the agent didn’t say it would take, whether or not it’s risky. ## The problem Anthropic reported that Claude Code users approve 93% of permission prompts. Over time, people stop paying close attention to what they approve. Meanwhile the dangerous moments hide inside routine steps: a new recipient, a different source, a skipped step. In a study of 48 people supervising web agents, the researchers offer one plausible interpretation: people stepped in when a moment looked like it needed judgment, and risky actions embedded in routine forms or default choices were more often left unchallenged. ## The pattern 1. **Make the approved plan the baseline.** Once you approve a plan, it becomes the reference for everything that follows. 2. **Stay quiet while the agent stays on plan.** Steps that match the plan run without asking, even if they send or spend within what you approved. 3. **Interrupt when it leaves the plan, and say how.** A new recipient, a substituted source, a skipped step. Each interruption names the difference, not just the action. 4. **Compare the agent’s summary with what it did.** An agent’s report can describe the plan instead of the work, more so as the run drifts from it. Show the two side by side. ## Try it An assistant is shortlisting venues for a team offsite. You approved a three-step plan. Run it and see what it stops for. [Interactive demo. Switch to the human view to try it.] Prototype. Made-up venues and steps. With the pattern on, the assistant pauses only at the two steps that leave the plan: a price taken from Yelp, and an email to a venue before Priya saw the shortlist. Without it, both go through unannounced, and the end screen puts its summary next to what it actually did. ## Why I care (Drafted with Claude from my notes. I’m still editing it.) When I joined Vida, strategy didn’t make it intact through each handoff, from leadership to product to design to engineering, and nobody saw the drift until late-stage rework. What helped was making the plan visible to everyone and reviewing the work against it, so drift showed up early. ## The evidence Approval rates and approval fatigue: [Anthropic](https://www.anthropic.com/research/claude-code-auto-mode). In interviews with 17 experienced developers, researchers found some of them relied heavily on the agent’s plan during review, treating it as a faithful representation of the agent’s actual work. That assumes agents adhere to their plans during execution ([Dhanorkar et al.](https://arxiv.org/abs/2606.05391)). Across 355,942 tool calls in real developer sessions, coding agents’ self-reports mentioned about 1 in 11 actions. Reports didn’t generally resemble the plan more than what the agent did, but they did so increasingly as execution diverged from the plan ([Kraishan and Jitkajornwanich](https://arxiv.org/abs/2609.12205)). Plan-based oversight lowered exposure to bad actions but didn’t improve people’s ability to step in ([Chen et al.](https://arxiv.org/abs/2604.04918)). ## Closest prior work Magentic-UI shows each plan step with the agent’s live actions grouped under it ([Mozannar et al.](https://arxiv.org/abs/2507.22358)), and Claude Code’s auto mode hands approvals to a classifier that stands in for the human approver and blocks actions that go past what the user authorized ([Anthropic](https://www.anthropic.com/research/claude-code-auto-mode)). Some proposed tool-approval patterns only let tools run if they match the plan ([Ganglani](https://www.kunalganglani.com/blog/tool-approval-patterns-ai-agents)). What’s new here is showing the user plan, action, and the agent’s own account in one place, and using the gap as the reason to interrupt. To build it, start from a [Model Spec scope of autonomy](https://model-spec.openai.com/2026-10-29.html#scope_of_autonomy); its example record has fields for tools, time and cost but none for the approved plan, so a step can stay inside every limit and still leave the plan ([how all six map to today’s protocols](https://dbirman.com/patterns#build-it)). The demo is plain HTML and JS in this page’s source. A package comes later. ## Watch for A bad plan makes a quiet agent. If the plan was wrong, staying on it isn’t safe, and reviewing the plan isn’t enough on its own. In a study with 248 people, reviewing and editing an agent’s plan didn’t calibrate their trust. The authors suggest plausible plans can mislead people into trusting an agent when it’s wrong ([He et al.](https://doi.org/10.1145/3706598.3713218)). And keep a hard stop for truly irreversible steps, plan or no plan.