Every major harness is replacing human approval with a model reviewing the model.

Four vendors converged within days (The New Stack): Claude Code makes classifier-screened auto mode default August 14, Codex CLI 0.147.0 shipped --approve-for-me, Zed 1.14.2 sandboxed its agent's terminal and fetch tools, Devin Local added editable command approvals. The shared premise is that per-call human approval is theater at a 97% approval rate, and they're right about that. The consequence for your defense budget: move it from "read the prompt carefully" to blast-radius controls. Disposable VMs, worktree isolation, scoped credentials, hard-deny rules no classifier decision can override.