Once you start delegating tasks to an AI agent—from sorting email to making payments—you'll run into a "Should I execute this action?" confirmation prompt several times a day. More often than not, instead of reading it carefully each time, you probably just click approve out of habit so you don't break your workflow.
So many people reach for permission rules as the fix. Block payments, require confirmation for sending email, allow file organization—set AI agent permissions like this in advance, the thinking goes, and risky actions get filtered out without you having to fight confirmation fatigue every time. But a new study put that intuition to the test, and the results pointed the opposite way. The group that wrote their own rules blocked risky actions the least.
About the Study
The paper starts from a search for an agent-control method that people with no development background can understand and reuse. The mechanism the researchers examined works like this: a language model sorts the agent's actions into plain-language "outcome categories," and the user writes allow, confirm, or deny rules for each category in advance. The question was simple: if you settle decisions ahead of time as rules, instead of judging each action in the moment, what do you gain—and what do you lose?
The researchers split 113 participants with no professional software background into three conditions: HITL, where they approved each action individually; AUTO, where the model reviewed each action automatically; and POLICY, where users wrote their own rules by category. Everyone supervised a simulated day's worth of agent work—18 actions—seven of which were "overreach": actions that exceeded the scope of the original request.
What the Study Found
The POLICY group, who wrote rules in advance, blocked overreach actions at a rate 20.1 percentage points lower than HITL (95% CI [-32.1, -8.1]) and 14.5 points lower than AUTO. Confirmation prompts during execution did drop, from 18.0 to 10.9, but total intervention time—including the time spent writing rules—didn't clearly decrease.
Why did this happen? Of the 140 rules participants wrote, 114 were set to "confirm." The whole point of the mechanism was to settle decisions in advance, yet most decisions simply bounced back to a confirmation prompt at execution time. Looking at how the 148 overreach actions that actually executed under POLICY got through makes the pattern clear.
The leak, in other words, wasn't in the rules—it was in users' own approval clicks. Across all seven types of overreach action, the POLICY group had the highest approval rate of the three conditions. The researchers frame this as a gap between preference and commitment: choosing "confirm" preserves your case-by-case discretion, but it also cancels out the very thing a rule is supposed to do—lock in a decision ahead of time.
What This Means in Practice
For solo founders and planners, this study offers three takeaways. First, having written down permission rules for your agent doesn't, by itself, guarantee safety. A rule table filled mostly with "confirm" is less a policy than a list of deferred decisions. Second, the actual protection comes from decisions you lock in ahead of time. For hard-to-reverse actions—payments, outbound communications to third parties—setting the rule to deny rather than confirm is what this study's findings actually support. Third, decide your criteria for the confirmation prompt before it ever appears. Most of the risky actions that got through in this experiment didn't slip past a rule—they got a user's approval. The habit of asking "is this within the scope of what I originally asked for?" has to come before any rule table.
Caveats
This study is a simulated-environment experiment covering one day's worth of work—18 actions. The design can't tell us what happens over months of using an agent and refining rules as you go. Nor does it conclude that rules are useless: they clearly did cut confirmation prompts, it's just that this wasn't shown to translate into less total intervention time or stronger protection. If you're thinking through AI agent permission settings, start not by writing a longer rule table, but by finding one item where you can change "confirm" to "deny."
