When prevention is impossible, shrink the blast radius
Aliases: error tolerance · safe default · consequence reduction · limited scope
What it is
Some acts cannot be designed out of error: free text, an external service, two people editing the same record. The flow’s job then is not a nicer failure sentence. It is to shrink the blast radius of one wrong act—default to the reversible side, touch one row at a time, stop locally instead of voiding the whole order. This entry is about the cost structure after prevention runs out. It is not about where the undo control sits, how trash is found, or how a draft returns after a crash.
Why it happens
Prevention assumes the designer can enumerate illegal states; open input and distributed systems break that assumption. People will still slip and still misjudge; what the system can still govern is what remains afterward. A safe default lands the common click on the reversible side: archive rather than pulverize, disable rather than close the account, save as draft rather than publish to customers. Scope limits let one slip hit the current row, not four hundred selected items. Time splits “takes effect” from “was clicked,” giving consequences an interval in which they can be noticed. Shrinking consequences is not forgiving the error. It is admitting the error will occur and refusing to let one slip become an unrepairable terminal state.
Studying it
Take the same high-risk task and build three failure policies: full rollback, rollback of only the failing items, keep the successful items. Compare loss and intelligibility.
Independent variables: whether the default is reversible, how many records one act touches, whether failure is whole-order or per-item, whether effect is delayed. Dependent variables: count of irreversible losses, time until the person notices, collateral range, later recovery success, whether partial success is misread as total failure.
Labs rarely create real money or data loss; freshly typed text being deleted, or points, are common proxies. Participants become unusually careful in studies. Real blast radius is measured in incident reviews, not in a survey item that says “I would be careful.”
Where it stops holding
Where regulation requires an act to take effect on click and leave an audit trail, a reversible default cannot dilute legal duty; shrink scope and make the pre-effect summary unmistakable instead. Security responses (revoking a stolen session, freezing a suspect payment) must widen scope immediately; shrinking consequences here means leaving the attack running. Some “partial success” states are books that no longer match reality—fail the whole order rather than leave a half-record. Shrinking consequences also does not replace eliminating illegal states that can still be designed out.
Applying it
- For each destructive act, write down: does the default land reversible or irreversible, how many rows one click may touch, and whether already-successful items are kept on failure.
- Make “delete” leave the current view rather than destroy; make “publish” visible only to the author until they explicitly choose an audience.
- Submit batch APIs per item; do not let one failure code erase items that already succeeded, unless a half-finished record is more dangerous than a full failure.
- Verify by walking the main path with one deliberate wrong act: count how many objects actually changed and whether they can be restored within five minutes. If the blast is larger than what was on screen, the consequence was not contained.