Design an AI approval surface users won't click through: block dangerous actions by default
A block-first approval surface lets low-risk agent work run silently, stops destructive actions, and gives users a clear manual escape.
| By | Prompt & Product — Newsroom |
|---|---|
| Filed | 25 October 2026 |
| Read | 3 MIN |
Your agent is about to delete data, spend money, or send a message, and the user has already learned to click approve. In a controlled test with 1,053 paid testers, people caught a dangerous command 13.6% of the time, while auto mode blocked 89% of the same commands.
The block-first redesign has four moves:
- Classify irreversible, destructive, or out-of-environment actions.
- Design the blocked state as the product.
- Keep manual mode a one-tap escape.
- Sequence B2B defaults with admin notice.
Silent action is the default for low-risk work
Classify every action before you design the button. Put low-risk, reversible, in-environment work in a silent lane: drafting, summarizing, searching, saving a local draft, or reordering a list. The finished state is the agent completing the task and showing a compact result, instead of a permission modal.
Reserve the interrupt for irreversible, destructive, or out-of-environment actions: deleting data, spending money, sending messages, writing to production, or calling a tool outside the approved sandbox. Actions the user can undo quickly probably do not need a full stop.
Claude Code’s Pro, Max, and Team plans had used auto mode as the default for new sessions since August 14. Anthropic planned to make auto mode the default for Pro, Max, and Team subscribers across Claude’s web, desktop, and mobile apps in the week after October 22.
Manually approved sessions contained severity-7 or higher unintended harm 6.3% of the time, compared with 2.4% for auto mode sessions. Track how often the interrupt appears, and keep it low.
The blocked state is the product
Design the blocked state before you design the allow state. A block must say what was stopped, why it was stopped, what the safer alternative is, and what the user can do next. A finished block is a card with a short reason, a preview of the blocked action, and clear choices: try the safer route or open manual mode.
When auto mode’s classifier blocks an action, Claude usually finds a safer route or asks the user, and Claude Code falls back to manual approvals after three consecutive blocks or twenty blocks in a session. Use that pattern as a floor, rather than a ceiling.
Teams often design the allow path and treat the block as an error message. Vague blocked states make users panic or click through. Make the block legible enough that a new user can understand the risk without a handbook.
Manual mode is a one-tap escape
Keep manual mode a one-tap escape. Make it a persistent control, instead of a buried setting. The control is a toggle or button labeled with the user’s language, such as approve each action or switch to manual. Users can enter manual mode from any blocked state, any result card, or the main agent view.
Manual mode is the user’s right to take the wheel when the agent’s judgment feels too broad. Hard-to-reach manual mode asks users to trust the system with more than they can verify.
Use the fallback rule as a trust signal. When the system keeps blocking, it should stop guessing and ask for a human decision. Log the fallback events, and review them with the same care you give to errors.
B2B defaults need admin notice first
Sequence B2B defaults with admin notice. Flip a team-wide default only after giving the people who own policy a chance to review it. Send the notice by email or admin console before the change, with the scope of the default, the actions it covers, and the way to opt out or configure exceptions.
Anthropic’s rollout shows the shape of that sequence. Anthropic’s enterprise administrators would receive an email before auto mode became the default for their organizations. Auto mode remained opt-in for Claude Enterprise, the Claude API, Claude Platform on AWS, Amazon Bedrock, Google Cloud’s Agent Platform, and Microsoft Foundry.
For consumer or small-team products, the notice can be shorter, but the principle is the same: the default should be visible, reversible, and explainable. Products that can act on a user’s behalf must let the user see what the agent is allowed to do without opening a settings maze.
Watch completion rate, false blocks, manual-mode switches, and the time from block to recovery.
