--- title: "Interrupt on drift, not on danger" author: Dan Birman url: https://dbirman.com/drift updated: 2026-11-09 summary: "Most agents ask for approval based on what kind of action it is: sending, paying, deleting." --- # Interrupt on drift, not on danger Agent Trust Patterns · 02 · v1 · Oct 2026 · 4 min Most agents ask for approval based on what kind of action it is: sending, paying, deleting. People approve almost all of those prompts without reading them. The action worth interrupting for is one the agent didn’t say it would take, whether or not it’s risky. ## The problem Anthropic reported that people approve 93% of permission prompts in Claude Code. After a couple of weeks, “approved” stops meaning “reviewed.” Meanwhile the dangerous moments hide inside routine steps: a new recipient, a different source, a skipped step. In a study of 48 people supervising web agents, intervention depended on whether a risky moment looked like it needed judgment, and risks embedded in routine forms went unchallenged. ## The pattern 1. **Make the approved plan the baseline.** Once you approve a plan, it becomes the reference for everything that follows. 2. **Stay quiet while the agent stays on plan.** Steps that match the plan run without asking, even if they send or spend within what you approved. 3. **Interrupt when it leaves the plan, and say how.** A new recipient, a substituted source, a skipped step. Each interruption names the difference, not just the action. 4. **Compare the agent’s summary with what it did.** Agents’ own reports drift toward describing the plan, not the work. Show the two side by side. ## Try it An assistant is shortlisting venues for a team offsite. You approved a three-step plan. Run it and see what it stops for. [Interactive demo. Switch to the human view to try it.] Made-up venues and steps. ## Why I care When I joined Vida, strategy didn’t make it intact through each handoff from leadership to product to design to engineering, and nobody saw the drift until late-stage rework. What helped was making the plan visible to everyone and reviewing the work against it, so drift showed up early instead of at launch. ## The evidence Approval rates: [Anthropic](https://anthropic.com/engineering/claude-code-auto-mode). In interviews, developers said they treat the plan as a faithful stand-in for the work, a habit nobody has tested ([Dhanorkar et al.](https://arxiv.org/abs/2606.05391)). Across 356,000 tool calls, agent self-reports mentioned about 1 in 11 actions, and drifted toward describing the plan as execution diverged from it ([Kraishan and Jitkajornwanich](https://arxiv.org/abs/2609.12205)). Plan-based oversight lowered exposure to bad actions but didn’t improve people’s ability to step in ([Chen et al.](https://arxiv.org/abs/2604.04918)). ## Closest prior work Magentic-UI shows a plan next to live actions ([Mozannar et al.](https://arxiv.org/abs/2507.22358)), and Claude Code’s auto mode blocks actions that go beyond what the user asked for, but inside a classifier the user never sees ([Anthropic](https://anthropic.com/engineering/claude-code-auto-mode)). Some tool-approval designs only let tools run if they match the plan ([Ganglani](https://www.kunalganglani.com/blog/tool-approval-patterns-ai-agents)). What’s new here is showing the user plan, action, and the agent’s own account in one place, and using the gap as the reason to interrupt. ## Watch for A bad plan makes a quiet agent. If the plan was wrong, staying on it isn’t safe, so check the plan before approving it. Research shows plausible-looking plans fool people ([He et al.](https://arxiv.org/abs/2502.01390)). And keep a hard stop for truly irreversible steps, plan or no plan.