Find risky interaction choices before they ship.

Detection cue

The agent can call tools, send external messages, spend money, issue refunds, change access, update customer records, deploy code, delete data, submit forms, publish content, or trigger downstream workflows.

Common signs

• Treating Run agent as permission to execute every hidden side-effect step.
• Sending a customer message or issuing a refund while the UI still says the agent is drafting.

Safer move

• Inventory all agent tools and mark read-only, draft-only, reversible, externally visible, money-moving, access-changing, destructive, deployment, publication, and customer-impact steps.
• Define which steps require approval by policy, risk, confidence, source status, cost, data sensitivity, target environment, recipient scope, or separation-of-duties rule.

Alternatives

Detection cue

The answer may be generated from web search, file search, enterprise knowledge sources, selected documents, uploaded files, chat history, model prior knowledge, tool outputs, or no retrieval at all.

Common signs

• Showing a polished answer with no citations or grounding after the user asked for a policy-backed answer.
• Adding a generic disclaimer while still letting users copy or send the unsourced answer as if it were verified.

Safer move

• Track answer provenance as structured state: source mode, source scope, retrieval status, used evidence, unsupported claims, permissions, freshness, and no-source reason.
• Render no-source and not-searched labels beside the answer summary, not only in hidden metadata or logs.

Alternatives

Detection cue

The UI displays model output, retrieval ranking, classifier score, extractor score, recommendation rank, generated-answer score, or risk estimate as if it were a calibrated probability.

Common signs

• Formatting an uncalibrated model score as 97.42 percent sure.
• Showing 0.873 certainty without saying it is a raw rank, similarity, or heuristic score.

Safer move

• Trace each displayed confidence number to its source: calibrated probability, raw score, rank, similarity, heuristic, model confidence, or stale stored value.
• Define whether the number is valid for the current task, population, model version, input quality, source scope, threshold, and consequence.

Alternatives

Detection cue

A carousel, hero, promotion rail, onboarding slider, or recommendation strip changes visible content on a timer.

Common signs

• Hiding Pause behind carousel dots, hover-only controls, or an overflow menu.
• Starting rotation automatically because marketing wants movement without testing reading time or assistive technology impact.

Safer move

• Decide whether auto-advance is needed at all; default to paused or static content unless the user starts motion.
• Place Pause or Stop rotation first in the carousel DOM and visible control order when rotation can occur.

Alternatives

Detection cue

A side drawer, inspector, side sheet, mobile full-screen drawer, or navigation drawer opens over or beside the current page.

Common signs

• Hiding close in an overflow menu or offscreen toolbar.
• Relying on swipe-only dismissal for mobile drawers.

Safer move

• Inventory every drawer, side sheet, inspector, and mobile drawer that can open temporarily.
• Identify the opener, selected object, route state, filter state, scroll position, and focus target to restore.

Alternatives

Detection cue

A toolbar, table row, card, or compact navigation surface contains icon-only controls.

Common signs

• Using a trash, tray, box, arrow, or exclamation icon for archive, delete, download, export, and warning actions without visible words.
• Providing an accessible name such as icon, more, or button instead of the action and object.

Safer move

• Audit every icon-only button for visible action text, accessible name, affected object, and consequence.
• Prefer text labels for primary and high-risk actions; use icon plus text when space allows.

Alternatives

Detection cue

The layer contains read-only help, status, preview, metadata, release notes, success feedback, onboarding tips, marketing, or supplemental explanation.

Common signs

• Showing success confirmation as a modal when an inline message, toast, or confirmation page would fit better.
• Opening help text in a modal that hides the field or table it explains.

Safer move

• Inventory every modal that contains only information, status, help, preview, release notes, promotion, or success feedback.
• Ask what background interaction must be prevented; if the answer is none, move the content out of a modal.

Alternatives

Detection cue

The hidden content is needed to complete a field, understand eligibility, choose an option, avoid a fee, meet a deadline, satisfy a document rule, or recover from a blocked control.

Common signs

• Putting accepted document types only in a help-icon tooltip.
• Putting password rules only in a field-focus tooltip.

Safer move

• Inventory every tooltip, title attribute, help icon, and aria-describedby bubble in the flow.
• Classify each item as supplemental or required for task success, safe choice, validation, eligibility, legal consequence, or recovery.

Alternatives

Detection cue

A dialog, sheet, action menu, toast, command palette, mobile action sheet, or review page includes a destructive command.

Common signs

• A delete prompt uses OK and Cancel without naming what OK will delete.
• A subscription flow has a Cancel button that could mean close the dialog or cancel the subscription.

Safer move

• Inventory every destructive prompt and record the trigger label, title, final action, safe action, status message, object, count, and consequence.
• Replace OK, Yes, No, Continue, Confirm, Submit, and Done with outcome-specific labels.

Alternatives

Detection cue

A product uses modal confirmations, alert dialogs, browser confirms, action sheets, or extra OK prompts for many commands in the same workflow.

Common signs

• Adding a confirmation after every user mistake without asking whether the mistake was reversible.
• Using one generic confirmation component for every action from closing a panel to deleting a workspace.

Safer move

• Inventory all confirmation prompts in the workflow and tag each by action, frequency, reversibility, external effects, consequence severity, and existing recovery.
• Remove modal confirmation from routine save, close, filter, dismiss, archive, hide, reorder, and delete-to-trash actions when undo or status feedback is sufficient.

Alternatives

Detection cue

The interface gates an action behind form completion, permission, quota, account status, dependency setup, offline state, session expiry, review approval, or safety policy.

Common signs

• A Continue button remains disabled until all fields are valid but no field or checklist names the missing work.
• A disabled Invite teammate action hides that billing setup, owner approval, or admin policy is required.

Safer move

• Inventory each disabled control and record the exact condition, owner, timeout, retry rule, and recovery path.
• Place prerequisite, permission, offline, dependency, or session recovery text before or next to the disabled control.

Alternatives

Detection cue

A product shows Undo in a toast, snackbar, activity row, command bar, keyboard shortcut, history stack, or recovery panel after a completed action.

Common signs

• Showing Undo after an action that has already sent email, money, permissions, or webhooks outside the product.
• Restoring only a visible row while losing comments, labels, sharing, order, or ownership.

Safer move

• Define what exact prior state must be restored for each action: ID, parent, order, labels, ownership, permissions, relationships, counts, draft values, and focus target.
• Capture the restore payload before mutating local, server, and external systems.

Alternatives

Detection cue

A form, editor, checkout, upload, import, authentication, or configuration screen validates user-entered values on blur, submit, save, retry, or server response.

Common signs

• Calling form reset after submit regardless of success or failure.
• Replacing the user's raw value with an empty string when parsing fails.

Safer move

• Keep form state separate from validation state so adding an error cannot reset field values.
• On failed submit, render the previous submitted values back into every safe control before showing errors.

Alternatives

Detection cue

A list, table, dashboard, workspace, inbox, or panel can render with no visible items.

Common signs

• Blank table body with no heading, count, cause, or action.
• Friendly illustration plus vague text such as Nothing here yet with no task path.

Safer move

• Track data status separately from rendered item count: loading, empty, no-results, permission, error, and ready.
• Render the surrounding context such as table title, filter chips, workspace, owner, or object type.

Alternatives

Detection cue

A form, setup flow, permission model, quota, dependency, or safety gate controls whether an action can run.

Common signs

• Greying out Continue until every field is valid without showing the missing or invalid answers.
• Putting the only explanation in a tooltip attached to a disabled button that keyboard and touch users cannot open.

Safer move

• Name the exact condition blocking the action, such as Enter a workspace name, Accept billing terms, or Ask an admin for owner access.
• Place requirement text, checklist, or field errors before the action or directly beside it.

Alternatives

Detection cue

A request can hang, fail silently, be queued for a long time, or lose its completion event.

Common signs

• Animating a full-page spinner forever after a request times out.
• Replacing a failed API response with a loading state because error handling is missing.

Safer move

• Define timeout thresholds per operation type, such as short inline saves, medium data loads, long imports, and background jobs.
• Pair every spinner with text that names what is loading or processing.

Alternatives

Detection cue

A payment, save, permission, destructive action, security, or data-integrity operation fails.

Common signs

• Showing Payment failed as a small toast while the invoice page returns to its normal paid-or-unpaid layout with no retry path.
• Using a disappearing snackbar as the only feedback for failed save, failed delete, failed permission change, failed upload, or failed authentication.

Safer move

• Classify errors by consequence before choosing the feedback surface: low-risk status can be transient, but blocking, financial, destructive, permission, and data-loss failures need persistence.
• Render the persistent error near the affected button, form, record, or page section and include the exact failed action in the heading.

Alternatives

Detection cue

The user has completed or appears to have completed an application, booking, order, payment, account change, survey response, publication, approval, or service request.

Common signs

• Redirecting to a dashboard and showing a five-second Application submitted toast with no receipt page.
• Using a generic Done toast for payment, booking, order, application, and profile-change outcomes.

Safer move

• Identify which actions are completed transactions rather than disposable status events.
• Define the authoritative commit event, reference, receipt, timestamp, object identity, submitted summary, and next-step content before rendering success.

Alternatives

Detection cue

A form has radio, checkbox, select, eligibility, account type, permission, or saved-draft answers that control which later answers are required.

Common signs

• Keeping a visually hidden input required because the backend schema says the field is required in some cases.
• Showing an error summary that links to an element hidden by CSS, collapsed accordion state, or conditional route logic.

Safer move

• Create a requirement map that ties every conditional required field to its owning trigger, active condition, visibility state, payload key, and error target.
• Keep client validation, server validation, saved draft restoration, and review pages using the same condition rules.

Alternatives

Detection cue

The interface splits a table, result list, collection, audit log, inbox, resource list, catalog, or search result into multiple pages.

Common signs

• Showing page numbers as identical chips with no selected state.
• Relying on the browser URL as the only current-page indicator.

Safer move

• Render pagination inside a labelled nav or equivalent region near the controlled results.
• Apply aria-current="page" to exactly one current page link or button when numbered pages are rendered.

Alternatives

Detection cue

The result set combines keyword search, filter criteria, sort, scope, saved search, saved filter, pagination, view density, or layout state.

Common signs

• Implementing Clear filters by reinitializing the whole search page state object.
• Using one Reset button for draft filters, applied filters, query, sort, and saved search.

Safer move

• Model query, filters, sort, scope, saved identity, pagination, and view mode as separate state owners.
• Name reset functions after the state they affect, such as clearFilters, clearQuery, clearSort, or resetAllResultState.

Alternatives

Detection cue

The page uses infinite scroll, auto-load-on-near-bottom, virtualized lists, dynamic feeds, product grids, search results, activity streams, or media streams.

Common signs

• Putting Privacy, Terms, Accessibility, Contact, Cookies, or language links only in a footer that infinite scroll prevents users from reaching.
• Appending items every time the footer comes into view.

Safer move

• Identify all footer-only links and decide whether each must also appear near the stream boundary, header, account menu, or help menu.
• Limit automatic batches before requiring an explicit Load more action.

Alternatives

Detection cue

A team replaces native select styling with divs, popovers, portals, or JavaScript-only menus.

Common signs

• Using divs with click handlers and no role, label, expanded state, or option semantics.
• Updating the visual label but not the form value that submits to the server.

Safer move

• Start with native select and document why custom behavior is necessary before replacing it.
• If custom, choose the correct pattern: listbox for browseable single choice, combobox for typed filtering, or multi-select for multiple values.

Alternatives

Detection cue

The surface asks for optional data use, marketing, research contact, AI training, partner sharing, personalization, sensitive-data use, non-essential cookies, local storage, advertising tags, analytics tags, or similar tracking.

Common signs

• Showing Accept all as the only button and hiding Reject all inside Manage settings.
• Preselecting optional marketing, analytics, personalization, or partner-sharing toggles.

Safer move

• Inventory every consent surface and record accept path, reject path, manage path, withdrawal path, default state, processing start time, and stored evidence.
• Compare the number of steps, visual prominence, wording, keyboard order, and mobile visibility of accept, reject, customize, and withdraw actions.

Alternatives

Detection cue

The product lets users create or authenticate an account that owns personal data, app data, profile data, messages, files, subscriptions, linked apps, child-account data, enterprise memberships, or authentication tokens.

Common signs

• Hiding account deletion in a privacy policy, FAQ, support article, or exact-match help search.
• Offering only deactivation and keeping account data active.

Safer move

• Inventory account creation routes, account settings, app settings, uninstall support paths, public web resources, support queues, data export pages, deactivation controls, and privacy settings.
• Trace whether a user can request deletion from each supported platform and after uninstall without contacting an unrelated support channel.

Alternatives

Detection cue

The prompt requests an operating-system, browser, or app-level permission for a device resource or powerful feature such as location, camera, microphone, photos, contacts, notifications, Bluetooth, clipboard, motion sensors, or storage access.

Common signs

• Requesting permissions on first launch because analytics show users may need the feature later.
• Asking for location, notifications, contacts, and photos as one setup checklist before explaining any task.

Safer move

• Inventory every system permission and map it to the exact feature action that first needs the resource.
• Remove first-run, splash-screen, onboarding, sign-in, page-load, and unrelated-navigation permission triggers unless the feature itself is being started.

Alternatives