Confirmations work only for irreversible, high-consequence actions

What it is

A confirmation dialog inserts a question that must be answered before an action runs, turning “do it” into “agree, then do it.” It earns that interruption only when two things are true at once: there is no equivalent undo after the fact, and the cost of being wrong is high—deleting the only production database, sending money, publishing a secret. Reversible, low-cost actions (archive, unstar, close a panel) plus a confirmation do not buy safety; they buy an extra click. Confirmation is not a facial expression of caution. It is an attention tax, and the tax belongs where the thing cannot be recovered.

Why it happens

A confirmation works by breaking an automatic action sequence and forcing one extra decision. In fluent use, clicks chain into a skill and consequences stop being evaluated item by item. When the act is irreversible and expensive, the break pulls those consequences from background into foreground. If the act is actually reversible, the break carries no new information: the user already knows what they clicked, and the dialog restates the same intent. The question does not create caution; it spends it. Spread confirmations over everyday actions and “OK” is compiled into the skill, which is how a later dangerous one gets driven through—that is the next leaf. This leaf is prior: without irreversible high cost, confirmation has nothing to protect.

Studying it

Build the same task as reversible delete versus irreversible delete, crossed with confirmation present or absent.

Independent variables: whether undo exists, whether the dialog states consequences, how often the action occurs in the task. Dependent variables: accidental-delete rate, time to finish, whether gaze on the dialog lands on the consequence copy, and whether people can later restate what will happen.

Lab “delete” rarely costs anything, so participants dismiss confirmations faster. A closer setup uses content the person just typed, or counts errors after the undo window has closed. If eye tracking shows the confirm button is looked at before the copy, the dialog is already a speed bump, not a decision.

Where it stops holding

When law or audit demands “click once more,” the dialog may be immovable, but it should still sit on irreversible or high-consequence acts; otherwise it is decoration. Dangerous but reversible acts (move to trash) get charged twice if confirmed; stronger undo is cleaner. If a high-consequence path can be staged (disable, then delete), put the confirmation on the last step, not on every step. For experts repeating the same destructive act in a short session, the first confirmation may be followed by “don’t ask again this session,” provided the consequence can still be recovered elsewhere.

Applying it

• Inventory every confirmed action and drop those that are undoable or cheap; those should run immediately and offer undo.
• Keep confirmation for irreversible deletion, outbound payment, and permission or visibility changes that cannot be rolled back.
• When the work can be two-phased (draft / publish, disable / delete), use the phase instead of a dialog.
• Verify by asking, of every OK, what it is blocking. If the answer is “mis-taps” and undo exists, confirmation is in the wrong place.

Related

• Within the group: E6.05.2 Frequent confirmations are clicked through automatically · E6.05.3 Confirmation copy must name the consequence and the object
• Adjacent: E1.03 Destructive action buttons · E4.10 Modal dialogs · E6.12 When notices dismiss
• Search terms: confirmation dialog · irreversible action · are you sure