Flag ambiguous destructive action copy when labels hide what will be destroyed, preserved, cancelled, revoked, or executed. Use the related patterns when the issue is the review surface, exact target gate, high-impact payload review, prompt overuse, or before-action warning copy.
Flag ambiguous destructive action copy when labels hide what will be destroyed, preserved, cancelled, revoked, or executed. Use the related patterns when the issue is the review surface, exact target gate, high-impact payload review, prompt overuse, or before-action warning copy.
Practice the judgment: Imagine this situation: A plan cancellation dialog uses Cancel for both closing the dialog and cancelling the subscription. Write the person's goal, choose one of these patterns, and show the state that helps the person continue. Use the decision rules and source trail below to explain your choice.
Review the underlying principle →| Dimension | Ambiguous destructive action copy | Destructive action confirmation | Typed confirmation | Dangerous-action review | Confirmation fatigue | Warning text |
|---|---|---|---|---|---|---|
| UI or UX | UI + UX - Destructive copy anti-pattern | UI + UX - Final destructive commit review | UI + UX - Exact target phrase gate before severe commit | UI + UX - Pre-execution review of high-impact actions that may affect money, access, production systems, legal status, customers, external recipients, or safety | UI + UX - Anti-pattern where repeated low-value confirmations train users to dismiss real risk prompts automatically | UI + UX - Severe-consequence warning copy before an action |
| UI guidance | Replace vague destructive controls with labels that name the verb, target, count, and outcome, such as Delete workspace, Keep workspace, Revoke Maya's access, or Cancel subscription. | Render a destructive confirmation after the user invokes a destructive command, with a title and final action button that repeat the destructive verb and target, such as Delete workspace or Cancel subscription. | Render a visible non-secret text field inside a destructive or high-consequence confirmation, labelled with the exact target phrase the user must type before the final action enables. | Render dangerous-action review as a pre-execution checkpoint that names the armed action, actor, target, scope, affected systems, external effects, risk reason, evidence, freshness, permissions, alternatives, and exact outcome of Run, Cancel, Edit, or Escalate. | Make the UI distinguish routine action feedback from genuine risk: use inline status, undo, warning text, disabled prevention, review, or clearer command placement instead of another generic Are you sure dialog. | Render warning text as a short high-emphasis statement with a warning icon, visible or hidden warning label, and explicit consequence copy placed before the relevant action, declaration, or instruction. |
| UX guidance | Make the copy carry the decision boundary: users should know which choice destroys, which preserves, which closes the surface, and which continues review. | Make the safe path explicit and easy, keep the destructive action unavailable until required review is satisfied, and report whether the object was kept, blocked, or permanently committed. | Use typed confirmation only when reproducing the target phrase meaningfully reduces severe wrong-object or wrong-scope mistakes, such as deleting a repository, project, account, workspace, production dataset, or root credential. | Help users decide whether to run, revise, cancel, defer, or escalate the action by making the action payload inspectable, comparing it with safer alternatives, revalidating stale state, and recording what the reviewer saw before execution. | Help the person reach a clear task outcome. | Use warning text when users must understand a serious consequence before acting or failing to act, such as a fine, loss of access, permanent deletion, eligibility impact, or legal responsibility. |
| Good UI | A dialog title says Delete Payments project?, the safe action says Keep project, and the final action says Delete Payments project. | Delete Payments project? lists 4 dashboards, 12 saved views, 3 webhooks, and 8 shared links, offers Keep project, and labels the danger action Delete Payments project. | Delete repository acme/payments-api? requires typing acme/payments-api, shows a mismatch until the exact path matches, and then enables Delete repository. | A production console shows Restart payment workers, affected region, open incidents, customer impact, rollback owner, evidence links, change window, dry-run result, and Run restart only after the reviewer checks the risk inventory. | Archiving a message completes immediately with Message archived and Undo, while permanently deleting a workspace opens a specific destructive confirmation. | Before Submit declaration, a warning with an exclamation icon says the user may be fined if they provide false information. |
| Bad UI | A destructive prompt says Are you sure? with OK and Cancel. | A soft archive action opens the same severe deletion confirmation used for permanent account closure. | The typed field is masked like a password, making users unable to check the repository name they entered. | A warning says This may be risky but hides the target, policy trigger, evidence, and whether the action can be undone. | Every Save, Dismiss, Filter, Archive, and Close action opens the same Are you sure? modal with OK and Cancel. | A red sentence says Important below the submit button after the user has already acted. |
| Good UX | A user reads Keep subscription and Cancel subscription and correctly chooses the path that preserves billing. | A user opens Delete workspace, reviews the object count and webhooks, cancels, and returns to the same workspace with nothing changed. | A user starts deleting acme/payments-api, mistypes the repository path, sees the mismatch, and cancels before deleting the wrong repository. | A release manager sees that a deploy action affects production EU, has a stale smoke test, cancels execution, refreshes checks, and then runs the action with an audit record. | A user archives ten low-risk notifications quickly, can undo the last archive, and still pauses when the only modal names permanent account deletion. | Users see the fine or eligibility consequence before checking the declaration and can pause to verify their answer. |
| Bad UX | A user presses OK because it looks like a neutral acknowledgement and accidentally deletes the workspace. | A user confirms deletion because OK looks like the primary next step, then discovers shared links and child reports were lost. | A user believes typing the phrase is the only safeguard, but the dialog hides forks, members, billing effects, and recovery limits. | A user approves a notification from email after the underlying payload changed, and the system executes against a different customer. | A user clicks OK through a production delete prompt because the last 30 prompts all looked identical and protected harmless actions. | Users incur a penalty because the warning looked like ordinary hint text. |
| Best fit | Auditing destructive dialogs, action sheets, menu items, command palette actions, delete receipts, account cancellation flows, permission revocation, bulk actions, and high-impact execution reviews. | A user has initiated a destructive command that can permanently remove, revoke, reset, deactivate, or cancel something valuable. | A severe action affects repository, project, workspace, account, production, security, billing, or organization-wide scope. | A user, agent, automation, or admin tool is about to execute a high-impact action that can affect money, access, production systems, legal/compliance state, customers, external recipients, sensitive data, or safety. | Use this anti-pattern entry to audit products that ask for confirmation on many routine actions or use identical prompts for different levels of risk. | A user must understand a serious consequence before taking or skipping an action. |
| Avoid when | The issue is repeated prompt overuse; use confirmation fatigue. | The action is a routine reversible archive, hide, dismiss, move, reorder, or trash move. | The action is routine, reversible, local, or recoverable through undo or trash restore. | The risk is narrowly permanent deletion or loss of a named object; use destructive action confirmation. | Choose another interaction when the task calls for a different route. | The message is a dynamic task status that must be announced when it appears. |
| Required state | Clear destructive title state with verb, target, and consequence. | Review state that names the destructive verb, target object, and affected scope. | Required phrase state showing the exact target phrase to reproduce. | Armed action state with verb, target, payload, actor, source, and exact execution boundary. | Prompt inventory state showing which actions are confirmed, how often they occur, and what consequence each confirmation prevents. | Before-action warning state placed immediately before the related control or declaration. |
| Accessibility burden | Keep the target and consequence in reading order before compact action labels. | Use alertdialog semantics or platform equivalent when the destructive decision requires an immediate response. | Associate the input with a label that includes or references the required phrase. | Use headings and labels that name the action and target before risk details. | Reducing unnecessary dialogs reduces focus disruption, but replacement feedback and undo controls must remain keyboard reachable and programmatically identifiable. | Keep the warning in reading order before the control, declaration, or instruction it qualifies. |
| Common misuse | A subscription flow has a Cancel button that could mean close the dialog or cancel the subscription. | Labelling the destructive commit OK, Yes, Continue, or Confirm. | Requiring users to type yes, confirm, or delete instead of the target name. | Showing a risk warning but hiding the action payload, target, recipients, amount, command, environment, or external effect. | Using one generic confirmation component for every action from closing a panel to deleting a workspace. | Using warning text for routine hints, explanations, or mild reminders. |