How do I stop people from just auto-approving everything?

By not drowning them in approval requests. If someone gets asked to approve 40 actions a day, they'll stop reading them. Guaranteed. The fix isn't more training or stricter policies. It's better configuration. We set up Cowork so low-risk actions run without prompts, and the approval gates that remain are few enough that people actually pay attention to them.