Oversight decays predictably, because the incentives, the arithmetic and the psychology all push one way. The approval gate designed at deployment ends up governing a version of the system that no longer exists.

The mechanism

Review clusters before deployment and thins out after it. In a survey of 1,221 senior technology leaders at enterprises above $500m revenue (fielded November 2025 to January 2026), 58% review AI at development and 58% pre-deployment, but only 39% after go-live, 31% at initial design, and 12% admit to reviewing governance only when something breaks. That is the governance cliff, and it sits where a probabilistic system needs review most, after the model, the data and the edge cases have moved. Cite NIST’s March 2026 report on monitoring deployed AI systems for the drift itself; the survey is Databricks-sponsored, so take the curve and leave the conclusions.

The review that does happen is thinner than anyone admits. In Noy and Zhang’s controlled writing experiment (Science, 2023, n=453), 33% of treated participants submitted the model’s first output unedited and 53% edited it lightly, averaging 3.3 minutes of activity after pasting. Post-paste time did not correlate with grade, and treated submissions did not out-score raw model output shown to the same evaluators. The review step did not decay over months; it was vestigial on day one, with money riding on quality.

The decay is worse among the staff a firm would trust most. Among roughly 5,000 customer-support agents, the highest-skill tercile showed small but statistically significant declines in resolution rate and satisfaction when given AI recommendations (Brynjolfsson, Li & Raymond, QJE 2025). And adherence ratchets: the bottom tercile followed recommendations under 20% of the time initially and just over half by month five, with senior staff starting lowest and converging fastest. The authors read rising adherence as trust becoming warranted, and their data supports that. The governance reading, that scrutiny declines on a curve a firm could be watching, is this wiki’s inference rather than theirs.

Dell’Acqua and colleagues named the failure shape in 758 BCG consultants: overreliance degraded combined performance precisely where supervision mattered, and correctness fell 19 percentage points on tasks outside the model’s competence. Their explanation matters more than the number: losses emerge because the system performs exceptionally well on adjacent tasks. Trust earned where the tool is strong transfers to where the tool is weak, so spot-checking decays fastest where it looks safest (fieldwork ran in 2023 on GPT-4; date the finding, not the 2026 journal).

Framing does measurable damage on its own. BCG’s Henderson Institute ran an experiment with over 1,200 HR and finance professionals in which the only manipulation was the label on an identical flawed document: human author, generic AI tool, or a named AI “employee.” Under the employee framing, personal accountability fell 9 percentage points and accountability attributed to the AI rose 8, with more escalation and lower review quality (HBR, May 2026). Putting an agent on the org chart costs review rigour before the agent does anything. A separate BCG survey (n=1,488 US workers) found those reporting AI-induced mental fatigue scored 11% and 39% higher on minor and major error frequency: oversight is itself cognitively expensive and fails under load.

Meanwhile the load grows on a curve human attention cannot match. In OpenAI’s Codex telemetry the share of users sending at least one prompt representing eight-plus hours of human work rose from 2.1% in December 2025 to 25.6% by June 2026, and 99th-percentile internal employees run around 71 hours of agent turns per day against a median of 2.5. Explicitly a non-representative frontier preview, but it fixes the unit: review capacity must be sized in agent-hours rather than headcount.

None of which is negligence. Korbak and colleagues state the economics plainly: as autonomy rises, human oversight begins to reduce an agent’s economic value through labour cost and latency, so operators face a standing incentive to remove the check. Kolt adds the legal inversion: under autonomy-based liability, the less a firm supervises, the less likely it is to be held responsible.

Attackers know all of this. OWASP files “human oversight weakens after repeated success; bulk approvals or policy relaxations propagate unchecked configuration drift” under ASI08, Cascading Failures: decay as an attack vector rather than a soft people-problem. Its own control text concedes that over-prompting produces indiscriminate approval, and asks for rate limiting so humans can’t be DoS’d. Why humans miss flags is older and settled: alert fatigue plus automation bias, documented since Parasuraman and Riley in 1997.

The sharpest version is ASI09, Human–Agent Trust Exploitation: an agent influences a human into taking the final, audited action, so the forensic record shows a human decision and hides the agent’s role. The approval gate becomes the laundering step. And the reviewer here is a citizen developer: as Chan and colleagues put it, malfunction may not be apparent to users who lack the requisite expertise.

What to do

Move review from a gate to a schedule. Approve-once is the wrong shape for a system that drifts, so put a recurring re-review on every agent above the lowest tier. See registry review for cadence and risk tiers for what earns one.

Instrument the acceptance rate. Log what fraction of agent proposals each reviewer accepts unchanged, over time. A rate climbing toward 100% is the decay curve made visible, almost nobody measures it, and it is the cheapest thing on this page.

Budget approvals like the scarce resource attention is. Cap how many a reviewer sees per day and route the rest to architecture rather than to a second reviewer. OWASP’s own guidance is that mandatory human-in-the-loop must be short and rare enough to hold attention, so a design asking a human to approve every action has already failed. See runtime guardrails and human approval gates for where each belongs.

Ban the employee framing internally. Agents get registry names, not org-chart personalities. This costs nothing and buys back measurable accountability.

Seed the queue. Inject a known-bad proposal periodically and see whether the reviewer catches it. Catch rate on seeded items is the only direct measurement of gate health that exists.

Don’t let the agent grade its own work. The popular argument that a model can write both the task and its evaluation and iterate until it passes its own tests is circular. See evals for what an independent check requires.

How you’d know it’s working

Rejection rate at the gates is greater than zero and someone can name a recent rejection. A gate that has never rejected anything is not a control.

Time-per-review stays flat as volume grows. If volume triples and review time per item halves, the decay is already present whatever the approval log says.

Reviewers can still perform the underlying task unaided; run it as an exercise annually.

What this doesn’t solve

Passivity is easy to overstate, and one good study says so. In the Cybernetic Teammate field experiment (776 P&G professionals) a substantial share retained more than 75% of AI-generated content, yet the semantic fingerprint of their solutions stayed closer to human-only work than to raw AI output. Retention differs from rubber-stamping. Likewise the quoted “44% of developers use AI code as-is” is agreement with a survey statement; the measured figure is 23.3%.

Better gates cannot fix ASI09. If the agent’s influence is upstream of the human’s decision, a stronger approval process produces a stronger audit trail for a laundered action. That failure mode needs logging and audit of what the agent proposed and why, not more signatures.

Oversight by other agents has yet to become a solution. Governor agents, monitor agents and scalable oversight are where the field is heading, and the same sources proposing them flag the regress: trust in an agent has been replaced with trust in an agent. Treat it as speculative, and note that its frontier-lab framing assumes a misaligned adversary, not a citizen developer with a Copilot licence.

Skill atrophy is real, slow, and outside what any control here touches. Wharton’s 2025 survey found 43% of leaders warning of skill decline even as 89% believed the tools augment work. The reviewers needed in 2029 are the people not reviewing anything in 2026.

Finally, most evidence above measures assistive AI (chat, code completion, support suggestions) rather than autonomous agents acting on systems. The mechanisms transfer; nobody has measured the magnitudes in the agentic case.

See also

• Human approval gates — the control this hollows out, and how to size it so it survives.
• Runtime guardrails and policy enforcement — enforcement that doesn’t get tired.
• The reviewer pool — sizing, rotating and testing the humans in the loop.
• Unreliable output acting on your systems — what reaches production when the check goes hollow.
• Multi-agent cascades — where a single decayed approval propagates instead of stopping.
• Citizen developer roles — the owner/verifier split that keeps accountability attached to a person.
• Dimension 1: Leadership — the hub for the one input this page can’t supply itself: review capacity funded as a named cost rather than volunteered.