Interaction Engineering · 3 / 10

Error Prevention & Reversibility: So Users Aren't Afraid to Click

Last lesson was how to word errors. This one steps earlier: stop errors from happening at all—and if they do, let users undo in one click. AI-built apps love confirm dialogs as insurance, but that's the weakest line of defense. Delete two contacts yourself and you'll see why.

Three prevention movesUndo toastCry-wolf experimentFix drills
Users are exploring—don't treat exploration as mistakes

In About Face 4, chapter 15, Cooper takes a clear stance: from the user's mental model, there is no such thing as an "error action." People explore software—tap this, try that, hit a dead end, back out. That's how you learn a tool. Software that labels exploration as error and pops dialogs at every turn makes users more timid with every use.

His metaphor for undo is vivid: explorers entering a cave feel braver when a rope ladder hangs at the mouth, ready to climb back out. Undo is that ladder. It may rarely save you—but because it's there, users dare go deeper.

"Do, don't ask."
Alan Cooper, About Face 4: instead of asking for confirmation, act confidently—then keep undo ready.

The psychology behind daring to click (defensive mindset, sense of control) has a full lesson in the Psychology Part—here's a jump card; we won't re-teach it.

Cross-Part · Defensive mindset: users aren't unable—they're afraid to use itHow reversibility gives users a sense of control, and why one mis-tap can scare them off forever—Psychology Part, lesson 6 covers it. Tap to jump.
Three prevention moves: the best error message is no error to report

Chapter 15 ranks it clearly: the best-written error message still loses to stopping the error. When you review AI output, check whether these three moves are in place—they're cheap, AI can do all three, if you ask.

Disable what's unavailable
Gray out buttons whose conditions aren't met, and say what's missing nearby. Letting users click first then fail is setting a trap.
Keep dangerous actions at a distance
"Clear all" shouldn't sit next to "Save." Cooper's line: putting a harmless control next to the ejection-seat lever is like sitting beside an open barbecue grill.
Safe defaults as a backstop
The default should always be the safest option. Mass email defaulting to everyone maxes out the cost of a fat-finger slip.

The three moves catch most of it; reversibility covers the rest. So here's the question: for delete, AI's favorite fix is a confirm dialog—does it actually hold? Let's experiment.

Try it · Delete one row, two ways to recover

Two contact lists, same data. Left uses AI's favorite confirm dialog; right uses instant delete + undo toast. Delete one on each side, then try to save what you deleted—your gut will write the conclusion.

Confirm dialog vs undo toast Try deleting on both sides
Tap "Delete" at the end of a row. On side B you can undo within 5 seconds—when the countdown bar finishes, it's gone for real
contacts.example.com
ContactsA · Confirm dialog
WXiaohu Wang
Product · 138****2201Delete
LWanqing Lin
Design · 139****8842Delete
CDajiang Chen
Ops · 137****0917Delete
Delete this contact?
This can't be undone.
contacts.example.com
ContactsB · Undo toast
WXiaohu Wang
Product · 138****2201Delete
LWanqing Lin
Design · 139****8842Delete
CDajiang Chen
Ops · 137****0917Delete
Deleted Undo
Side A interrupted you with 0 dialog(s). Can you save what you deleted? No. The dialog only blocks beforehand—after that, it shrugs.
Side B recovered 0 contact(s), zero dialogs. Delete takes effect immediately without interrupting; the regret window stays open for 5 seconds.
Cry wolf · Why confirm dialogs can't stop you

You might push back: the dialog at least blocked once—how is that weakest? Cooper's answer is habituation: confirm boxes that keep showing in the usual spot get dismissed unread. When real danger arrives, the finger beats the brain. This experiment takes 20 seconds—prove it yourself.

Click through eight dialogs—see which one you actually stop Experiment
Rules: clear eight dialogs as fast as you can—any click counts. Results at the end
oa.example.com/daily-report
You're rushing a daily report; dialogs will pop one after another
Handle them like you normally would—faster is better. The system times you.
Drill · Fix three dangerous buttons

You've got the three moves plus reversibility—time to fix. All three scenes are common AI-output bugs. For each, pick the prevention that fits best. Wrong answers come with explanations; keep going until you're right.

Scene 1: "Clear canvas" sits next to "Save" on the toolbar—users have already fat-fingered it Single choice
AShow a confirm dialog when they tap "Clear canvas"
BMove "Clear canvas" deeper into a menu, keep it away from "Save", and add undo
CMake the "Clear canvas" button red as a warning
DAuto-export a local backup before clearing
Scene 2: In a broadcast dialog, recipients default to "All members (2,841 people)" Single choice
AConfirm before send, showing the recipient count
BRemove the "All members" option
CDefault to "Only people I selected"; when they pick "All members", show the count in place
DAllow recall after send—a backstop is enough
Scene 3: Incomplete forms still let you tap "Submit", then pop "Information incomplete" Single choice
ARewrite the error copy with the three elements, friendlier
BDisable "Submit" until complete, and list what's still missing beside the button
CAuto-fill empty fields with defaults on submit
DPop a dialog listing empty fields; let users continue or go back
Quiz · Rank the four lines of defense
Of the four defenses, which is weakest? Single choice
Wrong answers come with explanations; keep going until you're right
ADisable unavailable items, with an explanation
BKeep dangerous actions away from everyday ones
CConfirm dialog before delete
DDo it immediately, with undo
Key Takeaways
✓

Users are exploring—don't treat it as error: undo is the rope ladder at the cave mouth; because it's there, users dare go deeper (Cooper, About Face 4, ch. 15).

✓

Three prevention moves: disable what's unavailable and explain, keep dangerous actions at a distance, pick the safest default. The best error message is no error to report.

✓

Confirm dialogs are the weakest defense: cry-wolf effect—routine dialogs get dismissed unread, so they're already dead when real danger arrives. Do, don't ask—then keep undo ready.

✓

How to brief AI: "Delete takes effect immediately; show an undo toast for 5 seconds" beats "require confirmation on delete" by a full tier. How to cut extra steps in a flow—next lesson.

Source: Original to Xiaoshan Academy's Interaction Engineering series; some principles adapted from About Face 4: The Essentials of Interaction Design.