You've Already Stopped Reading Your Permission Prompts

Anthropic put out telemetry on real Claude Code sessions recently, and one number stood out: people approve roughly 93 percent of the permission prompts they’re shown. Anthropic’s own engineering write-up on Claude Code usage (worth reading in full) is where the figure comes from, and it’s worth sitting with for a second. Ninety-three percent isn’t evidence of careful review. It’s what happens once a decision gets asked of you often enough that your brain quietly stops treating it as a decision.

That’s less a discipline problem than an attention one. Attention doesn’t hold steady under repetition — it erodes. After the fortieth prompt that opens with “Bash command: npm test,” your eyes learn to stop reading at the colon. The prompt that actually deserved a second look is sitting somewhere in that same 93 percent, and it doesn’t look any different on screen.

Two questions, decided in advance

Most permission prompts sort cleanly if you ask two things before the prompt ever shows up, rather than while it’s waiting on you: can this be undone, and how far does it reach if it’s wrong.

git status, a SELECT against a read replica, Get-Process — nothing here changes state, so making a person click through it buys zero safety and pure latency. Set the pattern to auto-approve and let it run.

An install, a push to a feature branch, an UPDATE with a WHERE clause scoped to staging — reversible, bounded, and genuinely worth a human glance each time. This is the actual home of judgment in the whole system, not the read-only stuff above it.

Anything irreversible, anything with production in reach, anything you didn’t write and haven’t read yourself — a script copied from a forum thread, a curl | sudo bash — belongs in a deny rule written into the tool’s config. Not in your memory of what you meant to refuse at 3am, because that memory won’t be there at 3am.

The grant outlives the moment you gave it

One thing catches even careful people off guard: approving a pattern approves everything that will ever match it, not just the line sitting in front of you right now.

Say the first request is docker rm test-container-7, tidying up after a run. Allowlist docker rm * instead of that exact call, and you’ve quietly pre-approved every future removal that matches — including the one six weeks from now that you’d have wanted to stop and look at. The scope you write down is a decision made on behalf of a session you can’t see yet.

The fix is narrower rules than feel necessary: npm run test * rather than npm *, the specific thing you actually read rather than the wildcard that happens to cover it too.

Build the reflex somewhere cheap

If you don’t have a fast, confident read on which of these a request belongs to, the better move isn’t to push through prompts hoping the judgment shows up mid-session. It’s to work in plan mode until it does — the official documentation on permission modes describes it plainly: the agent can read and reason but can’t act. That’s a reasonable place to get calibrated before anything is actually on the line.

None of this asks you to read every prompt harder. It asks you to settle the boring 93 percent in advance, so whatever attention you have left is pointed at the fraction that actually needs it. I built a small module on context-overflow.dev that drills this same sorting under a timer, mostly because I wanted somewhere to get it wrong that wasn’t a real system. The queue in it never really ends — which, now that I think about it, might be the most honest part of the whole exercise.