High-consequence operations need extra confirmation or delay

What it is

When an action affects money, health, legal relations, public publication, large datasets, or hard-to-recover permissions, one tap is not conscious commitment. A high-consequence action needs preview, read-back, confirmation, delayed execution, or an undo window, upgrading the decision from muscle memory to explicit judgment.

Why it happens

Skilled users rely on automated action, so the most hazardous operations are often triggered by rapid habit. Extra friction should be proportional to consequence, not applied uniformly. Effective delay shows scope, object count, irreversibility, and alternatives; confirmation should require understanding key facts rather than repeating “OK.” Time and steps also create opportunities to interrupt mistaps, script errors, and coercive situations.

Where it stops holding

Too much confirmation causes fatigue and mechanical approval, reducing safety. Infrequent urgent operations cannot become long procedures; organizational approval may already exist and need not be duplicated. Automated safety responses sometimes must act immediately, but need audit, notification, and recovery. Delay also cannot substitute for validation the system should perform.

Applying it

• Grade actions by scope, reversibility, legal requirement, and external notification; apply extra friction only at higher levels.
• Show object count, key conditions, consequences, executor, and recovery on the confirmation page; when necessary, require typing an object name or selecting a critical option.
• Provide delayed execution and cancellation windows for bulk deletion, migration, and publication, with notifications to affected people.
• Run mistap and bulk-misconfiguration drills to measure interception, confirmation time, abandonment, and successful recovery.

Related

• Same group: B3.05.1 Eliminating error conditions beats providing error messages · B3.05.2 Distinguish slips from mistakes and apply different prevention
• Nearby: B3.03 User Control and Freedom · Y3 Error Prevention and Recovery
• Search terms: confirmation dialog · cooling-off period · destructive action