Somewhere in the settings of my AI assistant there's a weekly task that writes up my health data. Under "Always allowed" it still has permission to update a dashboard I deleted weeks ago. Nothing calls it. It isn't dangerous. It's just there, a standing permission for a thing that no longer exists, and I only know about it because a note in my own files flagged it as stale.
I didn't set out to leave it there. I clicked "always allow" one morning because the task asks me the same thing every week, and my answer was always yes. That was the right call. So was every other one.
Every click makes sense, on its own
The trade, as it lands on you a hundred times a day, goes like this. Approve this once and you'll be asked again next time, which costs a little attention. Approve it always and you'll never be asked again, which costs nothing now and something unknown later. Put that choice in front of anyone often enough and they end up granting more than they meant to. They aren't careless. Each individual decision is correct.
And permissions only travel one way. Granting is a click in the middle of doing something else. Taking access back is a chore with no trigger, no moment in the week when anyone sits down to review what their tools can do. So the list grows. Nobody decides to hand over control; it's the sum of small reasonable choices, plus the fact that nothing ever asks you to undo one.
Every decision feels the same
The reason the clicks add up is that the prompt doesn't distinguish between them. Reading a file, listing a folder, sending a message on your behalf: same box, same two buttons. When every ask feels the same, the trivial ones train you as to how to answer the serious ones.
There's evidence for how fast that happens. Bonnie Anderson, Anthony Vance and colleagues at Brigham Young University put people in a brain scanner and showed them security warnings over and over. Attention to the warning fell with repetition, which is the finding you'd expect, and the paper's title says it plainly: "From Warning to Wallpaper". The one thing that held attention was a warning that changed its appearance each time. A box that looks different when the stakes are different is, it turns out, a box people keep reading.
You've already lived through the other version of this. Cookie banners were meant to be a consent decision, and within a couple of years everyone had learnt to clear the box without reading it. Nobody designed that outcome. It's what uniform friction does. See also: desire paths.
I've argued before that friction should be judged on whether it's in the right place, not on how much of it there is: a link to the terms is not a control, and a slow checkout lane can be a kindness. Permission prompts fail that test in both directions at once. There's too much friction where nothing is at stake, and by the time something is, there's no attention left to spend on it.
What you actually lose
At no single moment do you lose control. What goes is the ability to say, out loud, what the system is now allowed to do. Try it. Which of your tools can read your email? Which can send one? Which can reach the web and bring things back? I couldn't answer that from memory, and I built the setup myself.
That matters because the risk doesn't live in any one permission. Simon Willison calls the dangerous combination the lethal trifecta: an AI agent that has access to your private data, is exposed to content from outside (a web page, a document, an email someone else wrote), and can send things out. Any two are fine. All three together and a stranger can hide instructions in a web page and the agent will follow them as if they came from you, because, in his words, these models "are unable to reliably distinguish the importance of instructions based on where they came from".
No single "always allow" hands over all three. Permissions drifting over time leads to that. You allow file access in March for a tidy-up, web access in May for research, email in July to save pasting replies, and by August you've built the trifecta by default. McKinsey's survey of around 500 organisations early this year found 80 per cent had already seen an agent do something it shouldn't, from exposing data to reaching systems it wasn't meant to touch. I'd guess most of those were assembled the same way.
Control can move, it doesn't have to go
More prompts is how we got here. The answer is to move control out of the per-click moment, where it's weakest, into standing rules that somebody designed.
I've ended up doing this in my own setup, mostly after things went wrong. Deleting is off by default; the tool has to ask, every time, and it can't grant itself that one. Anything that can't be undone, which means sending, publishing, deleting or paying, is asked for each time regardless of how often I've said yes before. And one rule I wrote after being burnt twice in two days: an approval is for the thing proposed, not for a better version of it. If the approved route turns out to be wrong, stop and say so.
None of this is clever. It's the same friction argument, the right place rather than the right amount, applied to the thing acting for me. Sort by what can't be reversed and how far it reaches, rather than by what kind of action it is. Ask every time for the irreversible things. Let everything else run, but keep a record I'd actually read. And give standing permissions a shelf life, so "always" means "until the review", rather than forever.
The dashboard permission is still sitting there, by the way. I'll take it out this afternoon. It's the only one I know about, which is rather the point.
Open the settings of the AI tool you use most and read what you've already allowed. It won't take long, and you might surprise yourself.