How do you deal with approval fatigue? In our experience users start rubber-stamping everything within a week, and then the whole layer is theater.

The intended model is that reusable policy automatically allows routine ones, denies the prohibited ones, and asks for approval only for a small set of higher risk actions maybe(that should hopefully reduce the approval fatigue).