Part I — Directing uncertain behavior
The interface is a control contract
A conventional function call suggests a compact contract: supply arguments, receive a result, and handle an error. An AI product usually contains more boundaries. The person expresses an intended outcome; the application assembles inputs; a model interprets them; the system may propose an artifact or action; some actor authorizes an effect; and a separate check may establish what happened. The interface must preserve these distinctions because success at one boundary does not establish success at the next.
Feedback is information returned in response to an action. Useful feedback tells the person what the system received, inferred, changed, or could not establish. User control is the practical ability to direct, inspect, interrupt, correct, or limit that work. Neither is satisfied by a polished completion message. A coding agent can say it is finished while an independent check still fails; similarly, a generated email is only a draft until an authorized send occurs, and a send response is not necessarily proof of delivery.
Five questions every task surface should answer
- Intent — What outcome does the person want, and which constraints matter?
- Interpretation — What did the system understand from the request and available context?
- Proposal — What artifact, decision, or action is being suggested?
- Authority — Who may commit which effects, against which exact proposal?
- Outcome — What authoritative evidence shows that the useful work was completed?
From intent to verified outcome
A proposal, an authorized effect, and evidence of completion are different objects.
Read the diagram as text
- Expressed intent. Goal, constraints, source material, output form, and requested authority.
- System interpretation. The application’s current understanding of the request.
- Proposal. A draft artifact or description of a prospective action.
- Authorization. A control decision bound to the inspected proposal.
- External effect. A state change outside the generated proposal.
- Outcome evidence. Authoritative state used to establish the result.
- Expressed intent → System interpretation: input data.
- System interpretation → Proposal: generated proposal.
- Proposal → Authorization: review data.
- Authorization → External effect: permission to attempt.
- External effect → Outcome evidence: authoritative observation.
The relevant unit of quality is therefore the complete human-and-software system, including its effects and recovery path—not the model response alone. What an evaluation establishes develops that evidence boundary.
Expose the intent the task requires
Intent is rarely one undivided sentence. It includes a goal, constraints, source material, desired output form, and authority to act. An interface should make the consequential parts explicit while leaving language available for nuance. A travel assistant might accept an open-ended goal in conversation, constrain dates and budget with fields, let the person select an itinerary directly, and require separate authorization before purchase.
An affordance is an action possible for a particular actor; a signifier is a perceivable cue that helps the actor discover or interpret that possibility. A visible “Apply changes” button is a signifier. Whether the current user actually has permission to apply them is part of the affordance. Good AI interfaces do not let a cue imply authority or reversibility that the underlying system lacks.
What interaction forms expose
| Form | Makes explicit | Often leaves implicit | Best use |
|---|---|---|---|
| Blank conversation | Goal in the user’s own language | Valid values, selected objects, action authority | Exploration and underspecified work |
| Structured form | Fields, ranges, required choices | Nuance outside the schema | Repeated operations with known parameters |
| Inline editor | Target object and local change | Broader downstream consequences | Bounded rewriting or code modification |
| Direct manipulation | Selected objects and visible effects | Unseen dependencies and permissions | Spatial or precisely editable state |
The Excalidraw integration described by Christopher Chedeau illustrates the difference between output and editable product state. A model generated a constrained diagram description, deterministic software translated it into native Excalidraw objects, and users could then move, recolor, and revise those objects. The structured intermediate representation reduced rendering ambiguity; native editability let the person correct the result without restating the whole request.
Match the interaction pattern to the work
Choose an interaction pattern from the work, not from the presence of a model. Conversation is strong when the goal is exploratory and the next useful question depends on the answer. It is weak as the only interface for repeated structured operations, spatial editing, comparison, monitoring, or bulk review. Those tasks benefit from persistent objects, stable controls, and state that does not scroll out of view.
Pattern selection
| Task property | Useful pattern | Material tradeoff |
|---|---|---|
| High ambiguity | Conversation with targeted clarification | Flexible, but important constraints can remain hidden |
| Frequent, structured operation | Command or form | Fast and predictable, but limited to anticipated parameters |
| Local optional assistance | Inline suggestion | Low context switching, but rejected suggestions still impose verification cost |
| Evolving document, code, or design | Persistent workspace beside conversation | Keeps the artifact inspectable, but requires conflict and version handling |
| Spatial or precisely editable state | Direct manipulation | Visible incremental correction, but representations can imply unavailable actions |
| Bounded recurring work | Background automation with review and exception routes | Reduces routine interaction, but makes status and intervention design essential |
Patterns can be combined across stages. A research assistant may begin in conversation, maintain sources and a draft in a persistent workspace, use direct selection for bounded edits, and run document preparation in the background. The design question is not “chat or no chat?” It is which surface best supports each decision, object, and commitment.
Part II — Shared-control traditions
How initiative became shared
Generative interfaces recombine older approaches to human-computer interaction. Their history is useful because each tradition addressed a different coordination problem; none universally replaced the others.
Must-know developments
| Date | Development | Contribution |
|---|---|---|
| 1983 | Direct manipulation | Ben Shneiderman described continuously visible objects and rapid, incremental, reversible operations with visible effects. He also warned that graphical representations can mislead or consume excessive space. |
| 1985 | Percent-done indicators | Brad Myers distinguished measurable completion against an estimated whole from activity displays that only show continued processing. |
| 1986 | Execution and evaluation gulfs | Don Norman separated the difficulty of translating goals into available actions from the difficulty of interpreting system state against those goals. |
| 1999 | Mixed-initiative interfaces | Eric Horvitz combined automated assistance with direct invocation, termination, clarification, and manual completion under uncertainty and interruption cost. |
| 2010s | Interactive machine learning | Researchers emphasized incremental cycles in which people supply input, inspect changed behavior, and direct corrections. |
| 2024 | Side-by-side artifacts | Anthropic described a workspace beside conversation for inspecting generated documents, code, graphics, and previews as persistent work products. |
The allocation of initiative changed, but the old requirements remained. A model may suggest a next action, yet visible objects still help people inspect its target. Background work may choose steps dynamically, yet progress still needs meaningful state. Conversation may express intent flexibly, yet reversible local controls remain cheaper than repeatedly regenerating an almost-correct artifact.
Part III — Making behavior legible
Separate receipt, progress, and outcome
After a person initiates work, the interface can truthfully make several different claims: the request was received; the system interpreted it in a stated way; work was accepted; a stage is running; a provisional artifact exists; validation passed; an external effect occurred; or the resulting resource is usable. Collapsing these into “Done” creates false confidence and weak recovery.
Determinate progress reports completed work relative to a meaningful total. If the total is unknown or changes as an agent explores, a percentage is not justified. Show honest indeterminate activity, named stages, completed artifacts, pending dependencies, or a range estimate instead. Alma’s nutrition workflow, for example, exposed a recognized food item before later database matching completed. That partial result made waiting more useful, provided the interface did not mislabel it as finalized nutrition data.
Progressive disclosure initially presents the important, frequently needed information and makes specialized detail available on request. It differs from staged disclosure, where every user proceeds through successive task steps. In an AI interface, the primary status might say “Waiting for approval,” while an expandable view contains tool logs and timing. Internal diagnostic telemetry belongs in Observability; user-facing progress should answer what the person can understand or do next.
Terminal states need equal precision. Verified completion differs from partial completion, blocked work, cancellation, failure, and an unknown external outcome. Decide whether to continue develops the corresponding execution dispositions.
Communicate uncertainty for the decision
Uncertainty communication should name the uncertain claim and the decision it affects. “I may have misunderstood which account you meant” calls for clarification. “Two sources disagree about the amount” calls for comparison. “This prediction is uncertain” may justify a calibrated probability or range. “The external system did not confirm the write” calls for an unknown-outcome state, not a confident retry.
Cause and interface response
| Source of uncertainty | Useful response | Do not substitute |
|---|---|---|
| Ambiguous intent | Ask a targeted question or show candidate interpretations | Generic warning text |
| Missing information | Name the gap and request or retrieve the needed input | Invented completion |
| Conflicting sources | Show the conflicting claims and provenance | Citation count |
| Predictive uncertainty | Show a calibrated probability, range, or task-relevant review cue when validated | Raw generation probability |
| Unacceptable residual risk | Defer, abstain, or require qualified review | Cautious tone alone |
| Unverified effect | Keep the outcome unknown and inspect authoritative state | Automatic retry that may duplicate the effect |
Presentation changes reliance but does not guarantee good judgment. In one medical-information experiment, first-person uncertainty wording reduced agreement with deliberately fallible answers and improved participant accuracy, but also reduced willingness to use the system. Another experiment found that calibrated-frequency displays changed confidence adjustments in some cases yet did not prevent incorrect reliance. The design must therefore evaluate the decision people make, not merely whether uncertainty is visible. Interpret probability forecasts covers calibration; Evaluate deferral as a policy covers abstention, coverage, and selective risk.
Layer explanation, evidence, and diagnostics
Four supporting objects serve different purposes. An explanation describes general system behavior or a particular output. Evidence supports a claim. Provenance records origins and transformations. Diagnostics expose execution details useful for investigation. A generated rationale can help a reviewer find a bad criterion, but it is not independent proof that a score is correct or that the rationale faithfully reveals hidden computation.
Three disclosure depths
- Decision — Show the affected values, material qualification, and action choices needed now.
- Verification — Reveal sources, assumptions, alternatives, and derivation history needed to inspect the claim.
- Diagnosis — Reveal model, tool, timing, trace, and error detail needed to investigate execution.
More disclosure is not automatically better. Research on AI-assisted decisions found that tested explanations did not significantly outperform a simpler confidence-only condition, and explanations could increase agreement when the AI was wrong. Citations can likewise raise reported trust even when they are irrelevant. The primary surface should therefore expose what the current decision requires, while deeper material remains reachable and inspectable.
Part IV — Control while work continues
Define interruption and cancellation honestly
Interruption changes the current interaction. Steering supplies new direction. Pause retains state intended for later resumption. Cancellation requests that remaining work stop. A cancellation acknowledgment confirms that the runtime handled the request; quiescence means no covered work remains active. None of these terms implies that completed effects were reversed.
Cancellation is asynchronous. A client may immediately display “Canceling,” but a tool can complete or emit another update before the runtime returns a canceled outcome. Agent Client Protocol guidance explicitly permits updates during that interval. Cloud Speech-to-Text similarly documents cancellation as best-effort and requires clients to inspect the eventual operation state. A provisional label is useful feedback; it is not execution proof.
Cancellation is a protocol
A cancellation request can race with late updates and already completed effects.
Read the diagram as text
- User.
- Client UI. Shows a provisional canceling state.
- Agent runtime. Coordinates model and tool work.
- In-flight tool. May not stop synchronously.
- External system. May already contain a committed effect.
- Runtime resolves the race. Accounts for the tool result, late updates, and any effect already committed.
- Client shows canceled outcome. Acknowledged terminal disposition for covered work.
- User → Client UI: control: cancel.
- Client UI → Agent runtime: cancel request.
- Agent runtime → In-flight tool: abort request.
- In-flight tool → External system: possible prior effect.
- In-flight tool → Runtime resolves the race: abort result or late update.
- External system → Runtime resolves the race: effect evidence.
- Runtime resolves the race → Client shows canceled outcome: canceled acknowledgment.
Late data must also be attached to the right request and version. If a person corrects an artifact while an older generation remains in flight, the old response must not overwrite the correction. Ignoring stale presentation data is distinct from aborting server work, just as cancellation is distinct from undo. Preserve useful partial artifacts according to an explicit policy, and describe stronger checkpoint or resume guarantees as properties of the chosen runtime rather than universal interface semantics.
Keep persistent delegation inspectable
Persistent assistance changes a one-turn request into an ongoing relationship. The interface should keep visible the represented subject, accountable owner, delegated capabilities, current tasks, notification policy, checkpoints, expiry or renewal rule, and revocation path. A ticket or prompt can describe the delegation context, but it should not replace the identity of the person or service on whose behalf the agent acts.
Persistent-control responsibilities
| Moment | Person needs to see | System responsibility |
|---|---|---|
| Grant | Scope, subject, resources, duration, confirmation rules | Bind authority outside model-controlled text |
| Operation | Active tasks, status, pending decisions | Surface artifacts and consolidate attention requests |
| Checkpoint | Completed effects and proposed next scope | Renew consent when risk or scope materially changes |
| Revocation | What will stop and what already happened | Stop remaining authorized work and preserve an inspectable record |
Notifications should re-enter the person only when attention is useful, not require continuous monitoring. Proactive suggestions should remain optional and reversible where possible. Because no universal interruption frequency or delegation duration fits every task, products must state these policies explicitly and test them in use. Personal Agents develops memory, preferences, privacy, and long-term usefulness.
Part V — Review, correction, and recovery
Review before consequential commitment
A review boundary belongs before an action whose consequences, irreversibility, uncertainty, or delegated authority justify the interruption. Human intervention can supply missing intent, permission to act, or responsibility for work the system cannot complete; these are different requests and should be presented differently. Request the right human decision develops that distinction.
Authorization must be bound to the proposal the person inspected. Show the affected object, concrete values, relevant evidence, and expected effect. If the proposal changes, invalidate the approval or restart review. n8n’s demonstrated email and calendar gates follow the important structural pattern: the agent invokes the ordinary tool, while an execution-layer interceptor blocks it until review. The calendar example also shows why raw parameters need readable presentation; an opaque timestamp weakens the decision even when technically complete.
Version-bound review before execution
ExampleApproval must authorize the exact proposal inspected, not a moving summary.
Read the diagram as text
- Proposal v3. Affected object, concrete values, evidence, and expected effect.
- Human review. The reviewer inspects the proposed action.
- Clarify or edit. Intent or values require change.
- Denied. Execution is not authorized.
- Escalated. Responsibility moves to a qualified decision-maker.
- Final version check. Confirms that execution still targets proposal v3.
- Execute action. The authorized external effect is attempted.
- Re-review required. Proposal data changed after inspection.
- Proposal v3 → Human review: review data.
- Human review → Clarify or edit: missing or wrong intent.
- Human review → Denied: permission denied.
- Human review → Escalated: responsibility transfer.
- Human review → Final version check: approved v3.
- Final version check → Execute action: if version matches.
- Final version check → Re-review required: if version changed.
A dialog alone does not guarantee attention. Repeated confirmations can produce habituation, and a human gate can amplify automation bias. In the When Machines Mislead studies, fabricated copy-typing alerts were inserted into legitimate historical exam sessions. Proctors initially rejected only half of those fabricated alerts. Revised instructions required independent video evidence before upholding a flag; model-estimated rejection rose to 71%, though the studies used different sessions and periods rather than simultaneous randomized assignment.
Choose review granularity
- Per item — Appropriate when each effect can differ materially; expensive for frequent routine work.
- Batch — Efficient when comparable items can be inspected together; risks hiding local differences.
- Exception only — Reduces burden when the exception detector is validated and ordinary effects remain bounded.
- Explicit confirmation — Fits rare commitments whose exact parameters must be acknowledged; repetition can weaken inspection.
Repair the smallest affected boundary
Correction mechanisms should match where the error entered. Edit a proposal when its content is wrong but no effect occurred. Correct a source fact when the proposal faithfully reflects bad input. Regenerate a bounded region when only one portion needs another attempt. Reject a candidate when an alternative is better. Undo an applied change only when the application retains a supported prior state. Compensation is different: it performs a new domain-specific action to address an effect that already happened.
A compensation may fail, conflict with concurrent work, or leave residual consequences. Canceling a booked flight may incur a fee; retracting a sent message cannot guarantee that nobody read it. The recovery record should preserve the source version, AI proposal, user correction, committed effect, compensation attempt, and current disposition rather than rewriting history to imply the error never occurred.
Correction preserves history
ExampleUndo and compensation change state in different ways; neither should erase provenance.
The source and derived proposal remain separately addressable.
Read the diagram as text
- Source S1. Versioned source material.
- Proposal P1. Derived from source S1.
- Correction C1. A user-authored bounded change.
- External effect E1. Committed downstream state.
- Disputed. The committed effect is later challenged.
- Compensation K1. A new action addressing E1; it may not restore the original state.
- Resolved with residue. Current disposition records remaining consequences.
- Source S1 → Proposal P1: supports.
- Proposal P1 → Correction C1: is corrected by.
- Correction C1 → External effect E1: authorizes committed value.
- External effect E1 → Disputed: has status.
- External effect E1 → Compensation K1: addressed by.
- Compensation K1 → Resolved with residue: produces disposition.
- Proposal created. The source and derived proposal remain separately addressable. Active: Source S1, Proposal P1. New: Source S1, Proposal P1.
- Bounded correction. The correction is added without replacing source or proposal history. Active: Source S1, Proposal P1, Correction C1. New: Correction C1.
- Effect committed and disputed. The external effect persists as a stable record with a disputed status. Active: Source S1, Proposal P1, Correction C1, External effect E1, Disputed. New: External effect E1, Disputed.
- Compensating recovery. A new corrective action and honest residual disposition are recorded. Active: Source S1, Proposal P1, Correction C1, External effect E1, Compensation K1, Resolved with residue. New: Compensation K1, Resolved with residue.
Source-linked review makes the disputed boundary concrete. In Recover incomplete and disputed results, a useful record includes the source version, page and region, surrounding context, candidate values, and referral reason. An editable field linked to its source location lets the reviewer correct the extraction without reconstructing the whole document. Conditional version checks can then prevent an accepted correction from silently overwriting newer work.
Part VI — From design claim to working interface
Prototype the uncertain interaction
Prototype the riskiest interaction claim, not the most photogenic screen. Role concerns whether the product is useful in the workflow; look and feel concerns the experience of interacting; implementation concerns how it works. Model behavior, integration, latency, consequences, and accessibility add independent fidelity dimensions. A prototype can be realistic on one dimension and entirely simulated on another.
What prototypes can establish
| Prototype | Useful for | Cannot establish alone |
|---|---|---|
| Static mockup | Hierarchy, copy, layout, task framing | Timing, model variability, cancellation, real effects |
| Scripted interaction | Known state changes, errors, review, recovery | Unscripted model behavior |
| Wizard of Oz | Interaction with a human simulating missing automation | Deployed accuracy, latency, reliability, or scale |
| Model-backed prototype | Real output variability and prompt behavior | Production integrations or operational safety |
| Production-shaped working slice | One narrow task through real boundaries and observable outcome | Coverage of the broader workload |
Include delayed responses, malformed output, interruption, denial, correction, stale updates, and accessible operation. A controlled delayed-error fixture can keep transient states visible for inspection. A working slice should be narrow but complete through integration, operator interaction, and observable result; Testing a complete working slice develops that method.
Implement explicit task states
A state model turns asynchronous behavior into enforceable rules. A state records the current condition relevant to permitted behavior. An event reports something that happened. A transition moves to another state when an event matches and any guard condition holds. These ideas do not make the model deterministic; they make the application’s response to model and tool events explicit.
Give each task, attempt, proposal, artifact, and external effect a stable identity. Keep durable task state separate from ephemeral streamed presentation. An incoming event should carry the request or version it concerns; otherwise, an old response can overwrite a newer correction. Repeated cancel, approve, or retry actions also need defined semantics. Idempotency can make repetition safe for a specific operation, but it is a contract, not a property inferred from the button label.
Guarded transitions for one task attempt
ExampleIdentity and version guards keep obsolete events from becoming current state, while verified completion requires authoritative outcome evidence.
Read the diagram as text
- Identity guards. Task T-42, attempt A-3, proposal P-9, and effect E-1 identify the state and events they concern.
- Accepted. Attempt A-3 is registered for task T-42.
- Running. Work is active for this attempt.
- Provisional artifact P-9. An inspectable artifact exists but no external effect is verified.
- Awaiting review of P-9. Authorization must remain bound to this proposal version.
- Executing effect E-1. The authorized external operation is in flight.
- Verified complete. Authoritative evidence establishes the required postcondition.
- Event rejected. An unrelated task ID or older version cannot mutate the current attempt.
- Canceling. A cancellation request is pending while covered work settles.
- Canceled. The runtime acknowledged that remaining covered work stopped.
- Re-review required. Proposal data changed after inspection, invalidating prior authorization.
- New attempt A-4. A retry receives a new attempt identity instead of silently looping A-3.
- External outcome unknown. The response cannot establish whether effect E-1 occurred.
- Identity guards → Accepted: matching task and attempt.
- Accepted → Running: start event.
- Running → Provisional artifact P-9: artifact P-9 emitted.
- Provisional artifact P-9 → Awaiting review of P-9: review required.
- Awaiting review of P-9 → Executing effect E-1: P-9 approved and unchanged.
- Executing effect E-1 → Verified complete: postcondition verified.
- Identity guards → Event rejected: unrelated or stale event.
- Running → Canceling: cancel requested.
- Canceling → Canceled: cancellation acknowledged.
- Awaiting review of P-9 → Re-review required: proposal version changed.
- Re-review required → New attempt A-4: new attempt created.
- Executing effect E-1 → External outcome unknown: outcome evidence unavailable.
A reducer rejects stale state before rendering it
Illustrative pseudocode
Python-like pseudocodeThe user-facing projection should remain concise: “Waiting for approval” is usually more useful than a stream of internal span names. Keep traces and metrics available for diagnosis through Observability, while the task surface presents state, evidence, and permitted next actions.
Part VII — Testing the human workflow
Evaluate use, reliance, and recovery
Evaluate representative people performing representative tasks against a credible prior or non-AI workflow. The outcome is useful completed work, including review, correction, waiting, exceptions, and downstream repair. Component accuracy and model quality remain inputs, but they do not measure whether the interface improved the job.
Claims and evidence
| Design claim | Observe | Measure | Comparison |
|---|---|---|---|
| People complete the task | Attempts through the entire workflow | Correct completed outcomes and unresolved cases | Prior or non-AI workflow |
| Status is understood | Interpretations and next actions at key states | Comprehension errors and recovery choices | Alternative status presentation |
| Review improves decisions | Acceptance and rejection of correct and seeded erroneous advice | Appropriate reliance, review time, downstream correction | Immediate advice or independent-first judgment |
| Correction is usable | Attempts to repair realistic errors | Time, interactions, residual error, abandoned repairs | Restart or manual workflow |
| Interruptions are proportionate | Task activity around suggestions and approvals | Verification cost, delay, dismissal, missed interventions | Different trigger or review policy |
Use moderated task testing to observe what participants understand and expect; use heuristic inspection as a separate method for expert analysis against established principles. Neither substitutes for the other. Seeded-error studies are especially useful for oversight because counting approvals alone cannot show whether reviewers resist wrong assistance.
Production signals are selectively observed. An accepted suggestion may later be corrected; silence may mean success, unnoticed failure, or abandonment; only escalated cases may receive expert labels. Account for incomplete feedback explains this measurement problem, while Making everyday use workable covers checking time, exception routes, confidence, and responsibility in sustained use.
Accessibility is interaction behavior
Accessibility means designing and developing technologies so people with disabilities can perceive, understand, navigate, interact, and contribute. For AI products, that obligation covers the complete process: entering intent, reading generated content, tracking progress, handling interruptions, reviewing proposals, correcting errors, and recognizing completion.
The same task across access modes
| Requirement | Visual and pointer | Keyboard or switch | Screen reader | Reduced motion and reflow |
|---|---|---|---|---|
| Intent | Labeled controls and selected objects | Logical focus order and non-drag alternatives | Names, roles, states, instructions | Controls remain visible and usable when enlarged |
| Streaming status | Visible contextual update | Focus stays on the current control | Grouped polite live-region announcement | No motion-only cue; layout does not jump |
| Progress | Text plus visual indicator | Operable details disclosure | Context such as “3 of 5 files processed” | Non-color meaning and stable reflow |
| Review and correction | Visible source and changed values | Every action reachable without precise pointing | Source, proposal, and error relationships announced | No two-dimensional scrolling unless meaning requires it |
| Cancellation and completion | Distinct canceling and canceled states | Cancel remains reachable and focus is restored logically | Completion or failure announced without stealing focus | Reduced animation and adjustable timing |
Generated content also needs semantic headings, lists, tables, labels, reading order, accessible code and math, text alternatives for meaningful images, and operable embedded controls. Token-by-token announcements can overwhelm assistive technology; ARIA live regions and aria-busy support batching changes into meaningful updates rather than treating every fragment as urgent.
Automated tools assist accessibility evaluation but cannot establish conformance or usability alone. Combine standards inspection with task testing involving disabled participants, while stating participant characteristics and limits of generalization. A few users can reveal severe barriers without representing every disability or assistive-technology configuration.
Part VIII — Choosing controls
Choose controls for the actual task
The final design is a set of connected decisions, not a generic checklist score. Begin with useful completed work and permitted authority. Choose interaction patterns from task structure. Expose interpretation, state, and decision-relevant uncertainty. Define interruption and terminal semantics. Place version-bound review before consequential commitment. Preserve bounded correction and honest recovery. Implement explicit states, then test the complete accessible workflow.
A practical design review
- Work — What observable result makes the task useful, including checking and correction?
- Intent — Which goals, constraints, sources, output form, and authority must be explicit?
- Pattern — Which stages need conversation, structure, persistent artifacts, direct manipulation, or automation?
- Legibility — What interpretation, progress, uncertainty, and evidence does the next decision require?
- Control — What do pause, cancel, deny, retry, and revoke mean operationally?
- Commitment — Which effects require version-bound review or independent verification?
- Recovery — What can be edited, undone, compensated, or only escalated?
- Access — Can every important action and state be perceived and operated through supported access modes?
- Evidence — Which task outcomes, burdens, failures, and unresolved cases will establish whether the design helps?
One task, conflicting constraints
Consider a frequent background workflow that prepares outbound notices. Frequency favors automation and low interruption; ambiguous recipients favor targeted clarification; ordinary drafts favor direct editing; irreversible sending favors readable, version-bound authorization; delayed delivery confirmation requires a distinct pending outcome; screen-reader users need grouped contextual announcements; and a failed send may permit retry while an already delivered mistake requires a corrective follow-up. Convenience in one stage can therefore require stronger boundaries elsewhere.
The governing principle is simple: give people enough structure to express intent, enough visibility to understand state, and enough authority to intervene before uncertainty becomes an irreversible effect. The exact controls remain task-specific because ambiguity, latency, review cost, accessibility, consequence, and reversibility interact.
Open questions
How can interfaces communicate calibrated uncertainty without increasing inappropriate reliance, especially when task-relevant uncertainty differs from model probability? Progress would include replicated studies on real workflows that measure comprehension, correct acceptance and rejection, review time, and downstream outcomes across expertise levels.
What portable pause-and-resume contract can preserve partial artifacts while invalidating stale assumptions, in-flight effects, and obsolete checkpoints? Progress would look like explicit cross-runtime semantics for safe points, version compatibility, retained state, cancellation races, and user-visible recovery.
How should persistent delegation expire, renew, and request fresh consent as tasks and applications change? The hard part is balancing useful continuity against silent authority expansion. Progress would include enforceable scope records, understandable renewal interfaces, tested notification policies, and clear revocation outcomes.
How can teams measure correction burden and irreversible-effect rates consistently enough to guide interface choices? Progress would require task-specific denominators, longitudinal links between proposals and later repairs, and comparisons with credible prior workflows rather than universal benchmark numbers.
How should streamed AI interaction behave across screen readers, switch access, keyboard-only use, reduced motion, zoom, and narrow reflow? Progress would combine standards-conformant implementations with controlled task studies involving disabled participants, including interruption, review, correction, and error recovery rather than final-answer reading alone.





















































