High-consequence actions should not rely on a single one-shot recognition result

What it is

Payment, delete, unlock a door, an emergency stop: high-consequence commands should not run the instant the recognizer reports a class. One recognition is a single piece of evidence; mid-air false fires have too many sources. A second step is required: a confirm pose, another channel, an undo window, or a split into “select” and “submit.” Tightening the threshold is not a substitute—a stricter one-shot is still one shot.

Why it happens

A single classification is conditioned on those one or two seconds of trajectory, viewpoint, and noise. Even a rare false positive accumulates under always-on listening. High consequence makes that rare event’s cost unacceptable. A second step changes the evidence structure: two independent failures must coincide, or the person gets a window to see a preview and decide. Timed undo (do it, then allow a short regret) postpones evidence until after the user’s gaze, which fits consequences that can still roll back; truly irreversible ones should confirm before execute. A single gesture plus “do it more canonically” only asks for quality on the same evidence, adding no independent source. A non-gesture path is a separate reachability requirement; a confirm step, even if present, does not let you omit the alternative channel.

Studying it

Attack, with injected false positives (similar everyday motion, a bystander’s wave), a flow that executes on one recognition and a flow that is recognition-plus-confirm. Report high-consequence false executes, completion time, and the rate at which the confirm step is treated as friction and skipped. Compare confirm forms: a second mid-air pose, an on-screen button, countdown undo. Keep “higher threshold, still one-shot” as a control, to show that a structural single-evidence problem does not vanish with the cut point.

Where it stops holding

An emergency stop sometimes must complete in one motion; a second confirm slows the stop. Those commands should move to dedicated hardware or a highly unique, held pose, with a separate safety argument, not a payment-style dialog. Fake “delete” in a demo has no real consequence and will not tell you whether people will take the extra step. If the confirm is harder to find than the original gesture, it is still one-shot. On a high-load primary task, a confirm popup can itself become a new error source; put confirm on the channel attention already occupies.

Applying it

• On the high-consequence list, write the second evidence for each item: second pose, button, countdown undo. Forbid “execute on recognition success.”
• Show the consequence that is about to happen (which item, how much money) so confirm is not blind.
• Fire easily confused everyday-motion video at the high-consequence entry: a one-shot flow should be pierced; a confirm flow should hold. If it does not hold, it is still single evidence.

Related

• Same group: C4.27.1 Recognition difficulty and consequence severity should be designed independently, not treated as naturally bound · C4.27.3 Low-consequence, reversible actions can accept looser recognition thresholds · C4.27.4 When expanding the gesture vocabulary, re-check whether similar gestures map to different consequence levels
• Adjacent: C4.24 Recognition confidence and bias direction · C4.28 Necessity of non-gesture paths
• Search: one-shot · confirmation · high-consequence