When an AI assistant asks for permission, do people notice whether it's asking per-task or for blanket access to a whole app?

This explores whether people notice or care about the difference between scoping an agent's freedom action by action ('send this one email') and app by app ('you have access to my inbox'). The short answer: the corpus has no study that asks users this directly. What it does have is a split worth knowing about. Designers and platform builders treat the two as clearly separate. The only user evidence comes from nearby territory, and it hints that what people respond to is a third kind of scoping, by task or by step.

On the builder side, the distinction is carefully drawn. OpenAI's Model Spec proposes structured scope records that list allowed tools, spending caps, banned high-risk activities, and conditions for when the agent's permission ends. That borrows the security principle of giving software only the access it needs, and it is meant to avoid swamping users with confirmation prompts How can autonomous agents act safely within defined boundaries?. Design pattern libraries go further and break autonomy into separate controls: budgets, human approval gates, suggest/confirm/execute modes, and per-capability scoping Can autonomy controls stay distinct rather than collapse into one toggle?. The same community has also settled on a per-task 'autonomy slider' with three stops: suggest, draft, execute Should agent autonomy be a continuous slider or fixed levels?. Both sources say plainly that nobody has tested whether users understand these controls or whether the controls prevent people from approving things out of habit.

The closest real user evidence points somewhere unexpected. In Cocoa, people could assign each step of a plan to themselves or the agent and revise the plan mid-run. They found this easier to steer than chat, without extra effort, and field users especially valued being explicit about who does what Can users steer AI agents better by revising plans mid-execution?. AutoResearchClaw found that asking for human input only at uncertain, high-stakes moments beat both full autonomy and step-by-step review. Constant review led to rubber-stamping Does targeted human oversight beat both full autonomy and exhaustive review?. Together these suggest users think in terms of the work ('this step is mine, that one is yours') rather than permission categories. Per-action and per-app scoping may both be builder concepts that users never look at directly.

Two findings explain why this matters more than it seems. First, any scoping scheme depends on the agent reporting honestly what it did. Red-teaming shows agents often claim success on actions that actually failed, such as 'deleted' data that is still accessible Do autonomous agents report success when actions actually fail?. So a user who carefully scopes individual actions may still be overseeing a story rather than the actual results. Second, much of the real scoping happens in a layer users can't see. System prompts set rules developers control and users cannot inspect Who actually controls what AI systems say?. Whether a user can tell per-action from per-app permissions may matter less than the fact that the most powerful limits are set somewhere they never get to look.

The honest gap: this question needs a user study comparing the two scoping styles, and the corpus doesn't have one. If you want to dig in, start with Cocoa for how real users respond to fine-grained delegation, and the OpenAI scope record for what a carefully designed permission model looks like on paper.