What the Signer Can See

Company Hardware and a Y/N Prompt

On Oct. 15, Anthropic published "An update on independent evaluators"; the sentence carrying the most weight in that post concerns desks and logins: "We've onboarded six METR employees with company hardware, office space, and access to internal tools and systems that are roughly on par with what our own risk assessment teams have access to." METR (Model Evaluation & Threat Research, a Berkeley-based nonprofit) is the outside reviewer; Anthropic's answer to the question of how an outsider checks its work was to let the outsider see what the insiders see. TechCrunch, ZDNET, and Ars Technica all covered it.

Now set that next to the prompt on my screen most days. Claude Code runs a good share of the week here, and by the 11th permission prompt in a session the prompt is a line of shell, a y and an n; I'd be kidding myself to claim the 11th line gets the reading the first one did (the finger knows where the y lives, and it gets there before the eyes reach the end of the command).

I've now promised this issue three times: the person who clears the gate, and what a human sign-off has to cost before it means anything on the 11th click. This week the news finally voted for it instead of against it. Last week's thesis was to read the meter, not the report; this week's follows from it, and I'll defend it for the rest of the issue: a sign-off is worth what the signer can see. Anthropic gave its outside reviewer the insiders' tools; most agent approval prompts give the human a one-line summary and a y/n, and the human says yes 97% of the time.

Employee-Like Access

The post lays out three tiers of outside evaluator. In the first, "evaluators conduct narrowly scoped risk investigations"; Anthropic decides what they get to see, and publication needs Anthropic's approval (SecureBio sits here, reviewing the chem/bio chapter of Anthropic's August Risk Report). In the second, evaluators "can publish without our approval" and get access to more information. The third tier is METR, "with employee-like access and publication rights similar to those of the second tier," while Accenture and Faculty are "working toward" partnerships of their own.

The details are what make the access mean something. Anthropic employees are "encouraged to share information with them" the way they'd share it with "a fellow employee working on alignment risk." The exclusions are a small number of named categories, such as customer data, attorney-client privileged material, and model architecture (and even architecture can be shared with explicit internal approval when it's highly relevant). Anthropic also told TechCrunch, "We want to be publicly accountable for the decisions we're making."

Then comes the part a reviewer needs before its no counts for anything: "Anthropic can't veto publication, but we can require them to redact information if it falls into predefined categories such as reproducing confidential IP." Anthropic decides what goes in those categories; METR can say whether it thinks a redaction was justified, though it can't reveal what was cut. METR hasn't published a finding yet. For now the arrangement is a promise with an org chart attached.

Two features carry the whole design; they're also the two most approval prompts lack. The reviewer sees roughly what the risk team sees, so its judgment rests on the record instead of a briefing; and the reviewer's no has a consequence, because Anthropic can't veto the publication. Without either one, the arrangement goes back to being a reviewer who signs what it's shown, which is the job most of us have handed to whoever happens to be at the keyboard.

The 97% Click

On the other side of the gate sits the engineer at the prompt. In March, Anthropic's engineering post on building Claude Code auto mode put a number on manual approval: "Manual prompts sit in the middle, and in practice users accept 93% of them anyway." The same post named the cost: "Over time that leads to approval fatigue, where people stop paying close attention to what they're approving." By the time Anthropic wrote up auto mode becoming the default (published Aug. 7, updated Oct. 22), it was citing a higher figure: "users approve 97% of permission prompts in Claude Code."

Then Anthropic tested it. It hired 1,053 paid testers through a research vendor for a coding study, in a test environment instead of their own codebases; they knew they were being evaluated, but nobody told them which behavior was being measured. Partway through each session, a single permission prompt was swapped for a clearly dangerous command (approving it never ran anything dangerous). The result: "The testers caught the dangerous command just 13.6% of the time (143 of 1,053), while auto mode blocked 89% of the same commands (937 of 1,053)."

That number comes with a caveat the size of the company that produced it. It's Anthropic's own study, with no independent replication, and Anthropic sells auto mode; the same article says the goal was to end "the permission fatigue that was pushing engineers toward bypassing permissions checks." Testers clicking through someone else's sandbox may move faster than an engineer guarding their own repo (or slower, since they knew someone was watching). I'd still bet on the direction, because the older evidence points the same way.

SmartBear, itself a vendor, tells reviewers to look at no more than 200 to 400 lines at a time, because "beyond 400 LOC, the ability to find defects diminishes." Medicine shows the same pattern at higher stakes; a 2020 systematic review in JMIR Medical Informatics, covering 23 studies of clinical decision-support alerts, found "The range of average override alerts was 46.2%-96.2%." Many of those overrides were the right call. That's the trap; an alert that's usually safe to override trains the people reading it to override, so the one that matters gets the same reflexive dismissal.

A Rubber Stamp With Extra Steps

The tempting reading of the study is that the human gate is dead weight: the classifier blocked 89%, the people caught 13.6%, so turn on auto mode and stop pretending the y means anything. Right? Partly. The 13.6% is the catch rate of a person shown a swapped permission prompt partway through a session, in a codebase that wasn't theirs; it measures what a human does with a prompt, which is the one-line shape most approval gates hand their humans. Nobody in that setup was asked to read a diff, a host list, or anything else that would slow them down. Auto mode, for its part, let the other 11% through.

Manual review earns its keep when the reviewer has something to review. A one-line summary and a y/n hand the reviewer a coin with a 97% bias, and then we call the flip oversight.

The METR arrangement draws a fair objection from the opposite direction; the SF Standard made it on Oct. 17. It reported that practically no binding rules govern how labs and their evaluators relate, alongside shared funders and friendships among the labs and the Berkeley safety groups that evaluate them. Jeffrey Ladish of Palisade Research put the talent problem in one line: "Good luck finding AI talent that's not at all connected to Berkeley or the AI companies." That's a real limit on the arrangement, and I don't think Anthropic's post settles it.

Anthropic's criteria do address it on paper. Evaluators "shouldn't hold equity in the company they're evaluating, or be financially or operationally dependent on it," and "Our engagement with METR is limited to a small team operating under enforceable agreements." Those are Anthropic's own terms, though, and with no METR findings published yet, there's nothing to test them against; an outsider holding the insider's tools can still have the insider's friends.

The engineer at the y/n prompt has the mirror-image problem. Nobody doubts their independence from the agent (it holds no equity in them, either); what they lack is the record. An approval prompt that shows a summary and asks for a keystroke is a rubber stamp with extra steps, and making it louder or more frequent only trains the reflex faster.

Let's Call It Countersign Engineering

On a guarded post, the COUNTERSIGN is the word you give back when the sentry challenges you, and you only know it if you were at the briefing. An approval gate can work the same way. Instead of a y, the approver types something only the record produces: the number of files the agent changed, or the name of the off-list host in the proxy log since the run began. A tired reviewer can still get it wrong; getting it right, though, requires having looked at the meter.

Most prompts don't deserve that ceremony, and that's where auto mode earns its keep. Reads, test runs, and edits inside a sandbox with a clean git history can go through without a human at all. A write to the repo gets the file count. A request to a host that isn't on the allowlist, or anything that can't be taken back (a push to main, a migration, a payment), gets the host name typed out and a second person, because a 97% yes rate is cheap when the click is reversible and ruinous when it isn't.

Anthropic's arrangement does the same thing at the scale of a company; the reviewer gets the insiders' tools, and its no costs Anthropic something real, a publication it can't veto. A team running agents can borrow both halves for the price of a short script. I'd rather type a hostname a few times a week than click y all day and catch the bad one by luck.

Make the approver read the meter before the approver gets a vote.

#!/usr/bin/env bash
# countersign: run an agent's proposed command only if the reviewer quotes the record.
# Usage: countersign.sh <allowlist> <squid-access.log> <run-start-epoch> <command> [args...]
set -euo pipefail
[ $# -ge 4 ] || { echo "usage: countersign.sh <allowlist> <access.log> <start-epoch> <cmd...>" >&2; exit 2; }
allow=$1 log=$2 since=$3; shift 3
for f in "$allow" "$log"; do [ -r "$f" ] || { echo "countersign: can't read $f" >&2; exit 2; }; done
audit=${COUNTERSIGN_LOG:-$HOME/.countersign.log}

echo "== Proposed: $*"
git diff --stat HEAD
files=$(git diff --name-only HEAD | wc -l | tr -d ' ')
offlist=$(awk -v t="$since" '$1 >= t { h = $7; sub(/^[a-zA-Z]+:\/\//, "", h); sub(/[\/:].*$/, "", h); print h }' "$log" \
  | sort -u | { grep -vxF -f "$allow" || true; })
if [ -n "$offlist" ]; then
  printf '== Off-allowlist hosts since run start:\n%s\n' "$offlist"
  want=$(printf '%s\n' "$offlist" | head -n 1); prompt="Type the first off-list host to approve: "
else
  want=$files; prompt="Type the number of files changed to approve: "
fi
read -r -p "$prompt" got < /dev/tty
if [ "$got" = "$want" ]; then verdict=APPROVED; else verdict=REFUSED; fi
printf '%s\t%s\t%s\tfiles=%s\toff-list=%s\t%s\n' "$(date -u +%FT%TZ)" "${USER:-unknown}" "$verdict" \
  "$files" "$(printf '%s' "$offlist" | paste -sd, -)" "$*" >> "$audit"
[ "$verdict" = APPROVED ] || { echo "countersign: refused, logged to $audit" >&2; exit 1; }
exec "$@"

Quick Wins

🟢 Easy (~10 min): Run one agent session with permission prompts on and tally how many you approved without reading past the first line; that tally is your own approval rate.

🟡 Medium (~1 hour): Record date +%s when an agent session starts and put countersign in front of its commit and push steps, leaving read-only commands to auto mode or an allowlist.

🔴 Advanced (half day): Tier your gates by blast radius (reversible actions auto-approve, repo writes need the file count, off-list hosts and irreversible actions need the host name plus a second approver) and alert on every REFUSED line in the countersign log.

Next Week

Next week, unless the news votes otherwise, we go to the other end of the gate: the kill switch, and how long it takes your setup to stop an agent that's already past the approval you gave it.

Put the record in front of whoever clears the gate.

A sign-off is worth what the signer saw.

Anthropic's answer for its own outside reviewer was to hand it the tools its risk team uses and let it publish what it finds, and the rest of us running agents every day can take home the small version of that: put the meter in front of whoever clears the gate and make the yes cost a fact drawn from that meter, scaled to what the action can break; otherwise the gate is a y key with a 97% habit, and the 11th click is the one where the dangerous command goes through.

Bobby R. Goldsmith
Ambassador Extraordinary and Plenipotentiary of Bashmatica! by NodeBridge Automation Solutions

P.S. If someone forwarded this, subscribe at bashmatica.com (one field, one email, and no permission prompt to click through).