What a 97% approval rate means for agent payment mandates

Anthropic is removing the per-action approval prompt from Claude Code because users approved 97% of them. Agent purchase confirmations are the same kind of prompt, and the same number applies to them.

By XAgent Team · 2026-08-11

On August 7, Anthropic published the reason it is switching Claude Code to auto mode by default: "Data suggests that manual review can become habitual: users approve 97% of permission prompts in Claude Code." The company is not arguing that review is unnecessary. It is arguing that this particular review had stopped happening. Agent purchase confirmations are the same kind of prompt, sitting in the same position in the same kind of loop, and merchants building agent checkout should read the number as being about them too.

The finding is about where attention goes, not whether humans are useful

Anthropic's post is careful about this, and the carefulness is the interesting part.

The headline number comes with a concession attached: "While most prompts are likely for safe, routine commands, an approval rate that high suggests many users are clicking through reflexively rather than reviewing each command." A 97% approval rate is not proof that every approval was wrong. It is evidence that the step had become automatic.

The shape of the finding is in a second statistic, and it is the one worth carrying into commerce: "when Claude presents a plan for approval, users reject 39% of them. But for individual permissions requests, the rejection rate is only 3%." Same humans, same session, two orders of magnitude apart. People engage with a proposal and wave through an item.

A controlled study makes the same point with sharper edges. Anthropic reports that "In a controlled experiment with 1,053 paid professional testers, human review caught just 13.6% of dangerous commands, while auto mode caught 89%." Head to head, the company says, "auto mode blocked 800 commands that a human approved, while humans blocked only 6 that auto mode allowed."

And attention decays measurably as the session runs: humans "blocked about 17% of dangerous commands early in a session, dropping to about 5% after 50 or more prior prompts, while auto mode's block rate stayed flat regardless of session length."

What Anthropic does not claim

Three limits are stated in the source and are worth keeping, because the number travels better than its caveats.

The study population was not doing real work. Anthropic says the 1,053 testers "worked in a test environment set up specifically for the study, not in their own codebases or on real projects" and "knew they were being evaluated". Whether reflexive approval is worse or better when the money is real is not answered by this design.

The classifier's own error rate is not a clean number either. Anthropic reports a miss rate that "fell from 12% to 7%" on a red-team set built with Apollo Research, and then says plainly: "These attacks are synthetic and adversarial by design... The 7% miss rate is measured against this set and should not be taken as the miss rate on real traffic."

And the company does not present automation as a replacement for judgment: "while we believe auto mode reduces risk for most users, it relies on classification systems and therefore does not eliminate risk. For high-stakes changes to production infrastructure, we still recommend reviewing Claude's actions yourself."

One more thing a careful reader should notice. An earlier Anthropic engineering post, from March, states "Claude Code users approve 93% of permission prompts." Neither figure comes with a measurement window or a population size, and the company does not reconcile them. The direction is not in doubt; the precision is softer than a single quoted percentage makes it look.

Agent checkout has been building the 3% prompt

Most agent-commerce designs shipping today put a human confirmation in front of the purchase. The pattern is familiar from card-network pilots and wallet products: the agent proposes, a notification appears, the principal taps approve.

That is structurally the 3% prompt, not the 39% one. It arrives mid-task, it is one item among many, it is the last thing standing between the user and the outcome they already asked for, and it gets more reflexive the longer the session runs. Designing a payment control that depends on it is designing for the number Anthropic just published.

The alternative is not to remove the human. It is to move what the human decides. A principal who sets a mandate up front — this category, this ceiling, these merchants, this window — is reviewing a plan, which is the thing people demonstrably do engage with. The per-purchase decision then has to be evaluated mechanically against that mandate, at the moment the purchase is proposed, because the click was never doing the work.

That is the authorizable pillar in our framing, and it is the reason we treat mandate checking as an execution-layer job rather than a UI one. A confirmation dialog is not an authorization system. It is a place where an authorization system's absence is made to look like consent.

Singapore put its gate in the same place

Five weeks before Anthropic's post, the Monetary Authority of Singapore published a white paper on the same problem from the regulatory side. "Titled 'Safeguards for Agentic Finance at Runtime (SAFR)', the paper proposes an industry-developed framework that enables AI agents in financial services to carry out financial tasks safely, securely and reliably."

SAFR's summary of itself describes exactly the three jobs a mandate system has to do: "It provides a structured way to define what an agent is authorised to do, assess proposed actions before execution, and produce a consistent record for accountability and review."

And the paper is specific about where that work happens: "SAFR operates after content filtering and before execution."

Two qualifiers matter. SAFR is explicitly not a rulebook — the paper states it "does not constitute regulatory guidance or supervisory expectations, nor does it prescribe or anticipate future directions for such guidance or expectations", and that "Each institution remains responsible for determining how its deployment aligns with applicable supervisory expectations and internal governance requirements."

And a widely-repeated summary of the paper needs correcting. SAFR is often described as identifying the control-and-authorisation layer as the critical governance point for agentic payments. That sentence is real, but it is a footnote in which MAS summarises someone else's work — an IMF note by Davidovic and Tourpe — and not MAS's own position. In its own voice, discussing its own stack, the paper says the opposite about ranking layers: "No layer is a substitute for any other."

The convergence is still real, and it is more interesting for being arrived at independently. A frontier lab measuring its own users concluded the per-action prompt was not filtering. A financial regulator convening its industry concluded that the evaluation has to happen before execution and leave a record. Neither concluded that the answer is a better dialog box.

What's next

Watch whether agent-commerce products follow. The card networks' agent pilots have so far leaned on per-transaction confirmation, and that design now has a published number working against it.

For merchants the practical question does not change with the fashion. An agent will arrive holding some form of authorization, and you will have to decide whether this specific cart is inside it — before you take the money, in a way you can reconstruct afterwards. That check is the same whether the mandate came from a card credential, a signed policy object, or a protocol we have not seen yet. As we argued when comparing agent payment and traditional checkout, the difference is not the payment step; it is everything the payment step used to imply.

If your business should be able to accept an agent's purchase, check it against the principal's actual limits, and produce a record of that check, list your store on XAgent and let the open execution market run the gate.