Standing allow rules buy quiet and pay for it in protection

Ting Yan · 1 authors · Independent Researcher · 2026 · arXiv:2608.27443

Standing allow rules buy quiet and pay for it in protection

Opening

Pre-deciding feels like the mature option: write the rule once and stop being interrupted. This study measures what that maturity buys. People with no software background wrote allow, ask, and never rules for consequence categories, then supervised a simulated day in which some actions reached past what they had asked for.

What the paper does

The mechanism under test maps agent actions to plain-language consequence categories, with user-authored rules deciding what happens next. The authors compared three supervision conditions across 113 participants without professional software backgrounds: per-action human-in-the-loop approval, automated per-action model review, and a user-authored consequence policy set in advance. Everyone judged examples in four consequence categories, then supervised an 18-action simulated day containing seven overreach actions. The comparison asks what is gained and lost when decisions are made once as reusable rules instead of separately for each action.

Findings

  1. Standing rules blocked the least overreach — the policy condition trailed per-action human approval by 20.1 percentage points and automated per-action review by 14.5 points.

POLICY blocked less overreach than HITL (-20.1 percentage points, 95% CI [-32.1, -8.1]) and AUTO (-14.5 points, 95% CI [-25.8, -3.2])

  1. Who wrote the rules — the study analyzed 113 participants without professional software backgrounds across three supervision conditions.

We analyzed 113 participants without professional software backgrounds across three conditions

  1. The time saving did not survive contact with setup — runtime prompts fell from 18.0 to 10.9, yet total intervention time was not reliably lower once rule setup was counted.

POLICY lowered runtime prompts from 18.0 to 10.9, but total intervention time was not reliably lower when rule setup was included.

  1. Most overreach still went through a person — of 148 overreach actions executed under the policy, 133 followed human approval and 15 ran automatically under allow rules.

Of the 148 overreach actions executed in POLICY, 133 followed human approval and 15 ran automatically under “allow” rules.

Caveat

The evidence comes from a simulated 18-action day with participants who have no professional software background, so it does not establish how trained operators with real accounts would write the same rules. The abstract reports no dollar cost and no data beyond a single session.

What this means for 5ac

The gap here is preference against commitment: participants kept choosing ask, which hands every decision back to runtime and quietly defeats the standing policy. That is the same drift we get when a bot’s allow-rule is widened to stop the noise. If an action touches a customer or moves money, it keeps a per-action approval, and our standing rules stay narrow enough that they only pre-approve what we would approve without thinking.

Source