How should security leaders preserve human oversight as AI agents take on more work? Permissions establish which actions agents can take, but a permitted action can still warrant a person’s judgment. Requiring approval for every step might seem like the safest approach, yet multi-step tasks can produce repeated prompts, even for routine actions. Research on security warnings shows that attention and adherence can decline with repetition. The challenge isn’t to require more approvals, but to preserve attention for decisions that need human review.

Smart Approvals in Amazon Quick addresses this challenge by reviewing eligible actions within your existing controls. It evaluates each proposed action against the user’s request and either approves it automatically or returns it to the user for review. It does this without granting additional permissions or removing required human approvals. Security leaders retain control over which actions must always go to a person, while Smart Approvals is designed to reduce unnecessary interruptions in routine work.

Figure 1: Policy determines eligibility. Smart Approvals approves eligible actions or returns them to the user for review. Policy denials remain blocked

Quick evaluates each proposed action against Custom Permissions, Quick Guardrails, connector action permissions, and the user’s settings before automated review. Denied actions remain denied, and mandatory human approvals still apply. With Smart Approvals enabled, an action is eligible only when the user’s setting is “Ask each time” and no other control requires human approval. Connector action permissions, configured when a connector is created, can require human approval for specific actions.

Source link