Comment by drejt

The approval-every-call model does train you to say yes, so it stops being a control. What I've found works better is gating on the class of action rather than each call. Reads run freely, writes and shell commands that mutate ask, and the thing that always holds is a new outbound host or a credential the agent hasn't used before. Most turns then run without interruption, and the rare prompt is one you actually read. It also answers SchemaLoad's point below: overnight runs are fine if the only thing they can't do unattended is reach a host nobody approved.