Quality check · lesson 20 of 23 · Error Prevention And Recovery

Ambiguous destructive action copy

Underlying principle: Recovery begins before the error. Clear consequences, suitable constraints, preserved work, and a visible correction path reduce the cost of a mistake.

Treat ambiguous destructive copy as an anti-pattern: rewrite titles, primary actions, secondary actions, and status copy so each control names the outcome it causes, the target it affects, and whether the action destroys, preserves, cancels the operation, or cancels an existing service.

Start with the decision

Does this fit your task?

Auditing destructive dialogs, action sheets, menu items, command palette actions, delete receipts, account cancellation flows, permission revocation, bulk actions, and high-impact execution reviews.

Review the boundary: Compare the task with the alternatives in the decision section.

Review the decision →
Study the interaction

Follow the task before choosing the component

Recovery begins before the error. Clear consequences, suitable constraints, preserved work, and a visible correction path reduce the cost of a mistake.

01 / Recognize the need

What the person is doing

A dialog, sheet, action menu, toast, command palette, mobile action sheet, or review page includes a destructive command.

02 / Design the response

What the interface must communicate

Treat ambiguous destructive copy as an anti-pattern: rewrite titles, primary actions, secondary actions, and status copy so each control names the outcome it causes, the target it affects, and whether the action destroys, preserves, cancels the operation, or cancels an existing service.

Clear destructive title state with verb, target, and consequence.

03 / Judge the outcome

What to look for

Does the label name the destructive verb and affected target?

Every destructive control label must answer what action will happen and what object or scope it affects.

Decision first

Choose this pattern when the problem matches

Use when

  • Auditing destructive dialogs, action sheets, menu items, command palette actions, delete receipts, account cancellation flows, permission revocation, bulk actions, and high-impact execution reviews.
  • A generated or existing UI uses vague final-action copy around permanent loss, access removal, subscription cancellation, external effects, or irreversible side effects.

Avoid when

  • The issue is repeated prompt overuse; use confirmation fatigue.
  • The product must inspect payload, evidence, freshness, and external side effects before execution; use dangerous-action review.

Problem it prevents

A dialog, sheet, action menu, toast, command palette, mobile action sheet, or review page includes a destructive command.

Test the behavior

Try strong and weak versions of the interaction

Open the working example, try its controls, and compare the behavior against the decision guidance.

In the lab you can
  • switch between strong UI, weak UI, strong UX, and weak UX;
  • trigger required, empty, loading, error, and recovery states;
  • inspect keyboard and accessibility expectations beside the demo.
Launch Ambiguous destructive action copy in the lab
Pattern anatomy

What a strong implementation has to make clear

User need

A dialog, sheet, action menu, toast, command palette, mobile action sheet, or review page includes a destructive command.

Pattern promise

Treat ambiguous destructive copy as an anti-pattern: rewrite titles, primary actions, secondary actions, and status copy so each control names the outcome it causes, the target it affects, and whether the action destroys, preserves, cancels the operation, or cancels an existing service.

Required state

Clear destructive title state with verb, target, and consequence.

Failure to inspect

Users keep a subscription when they meant to cancel, or cancel a subscription when they meant to close the dialog.

Access contract

Keep the target and consequence in reading order before compact action labels.

Quality bar

The difference between expert and weak execution

Strong implementation

Specific, visible, recoverable

  • A dialog title says Delete Payments project?, the safe action says Keep project, and the final action says Delete Payments project.
  • A subscription dialog uses Keep Pro plan and Cancel Pro subscription instead of OK and Cancel.
  • A bulk action says Permanently delete 12 files and updates when the selected count changes.
  • A user reads Keep subscription and Cancel subscription and correctly chooses the path that preserves billing.
Weak implementation

Vague, hidden, hard to recover from

  • A destructive prompt says Are you sure? with OK and Cancel.
  • A permission dialog uses Remove for both removing a row from a list and revoking account access.
  • A dangerous action review uses Continue as the button that actually sends the customer email.
  • A user presses OK because it looks like a neutral acknowledgement and accidentally deletes the workspace.
UI guidance
  • Replace vague destructive controls with labels that name the verb, target, count, and outcome, such as Delete workspace, Keep workspace, Revoke Maya's access, or Cancel subscription.
  • Disambiguate overloaded words like Cancel, Remove, Continue, Confirm, Clear, Reset, and Close whenever they sit near irreversible, external, or costly outcomes.
UX guidance
  • Make the copy carry the decision boundary: users should know which choice destroys, which preserves, which closes the surface, and which continues review.
  • Keep destructive copy synchronized across trigger, title, body, final action, safe action, receipt, accessible name, and compact/mobile variants.
Implementation contract

What the implementation must handle

States

  • Clear destructive title state with verb, target, and consequence.
  • Clear final action state with destructive verb plus target or count.
  • Clear safe action state that names the preserved outcome.
  • Ambiguous Cancel state where cancel could mean cancel dialog or cancel service.

Interaction

  • Every destructive control label must answer what action will happen and what object or scope it affects.
  • Every safe action label must answer what will be preserved or where the user returns.
  • Dialog titles, body copy, final buttons, secondary buttons, menu items, and status text must use the same verb and target model.
  • If a word has domain ambiguity, such as Cancel, Remove, Close, Disable, Reset, Revoke, Clear, or Dismiss, the UI adds the object and outcome.

Accessibility

  • Keep the target and consequence in reading order before compact action labels.
  • Avoid two buttons with identical or near-identical accessible names when one preserves and one destroys.
  • Announce post-action status with the same verb and target used in the committing action.
  • Ensure localized labels retain verb, target, and safe-path distinctions.

Review

  • Does the label name the destructive verb and affected target?
  • Could Cancel, Remove, Continue, or Done mean more than one outcome in this context?
  • Does the safe action say what remains unchanged?
  • Does bulk copy update when selected count or object type changes?
Evidence trail

Source-backed claims behind this guidance

Maersk Design System: Dialog

Maersk - checked

Dialog guidance supports deliberate destructive confirmations rather than vague modal decisions.

Full agent/debug reference

Problem Context

  • A dialog, sheet, action menu, toast, command palette, mobile action sheet, or review page includes a destructive command.
  • The interface uses vague labels such as OK, Yes, No, Continue, Confirm, Submit, Remove, Done, or Cancel near a destructive or externally visible action.
  • The same word can mean different outcomes, such as cancel the dialog versus cancel the subscription, remove from view versus delete permanently, or continue review versus execute the dangerous action.
  • Users need to distinguish the destructive commit, the safe preserve path, reversible cleanup, typed target verification, and high-impact action review.

Selection Rules

  • Flag this anti-pattern when the destructive or safe action label does not name what will happen.
  • Use destructive action confirmation when the whole final review needs target, scope, consequence, dependency, acknowledgement, and commit states; this entry focuses on the wording defect inside those surfaces.
  • Use typed confirmation when severe wrong-target risk requires reproducing a visible target phrase; typed confirmation still needs unambiguous final button copy.
  • Use dangerous-action review when the action is high impact because of money, access, production, legal, customer, external recipient, or agent-tool effects; this entry flags vague Run, Continue, or Approve labels that hide execution.
  • Use confirmation fatigue when the problem is repeated low-value prompts and habituation; this entry applies even to one prompt if the destructive labels are unclear.
  • Use warning text when consequence copy belongs before the command; warning text cannot repair a final button labelled OK or Yes.
  • Name the destructive verb and target in the final action, such as Delete workspace, Revoke Maya's access, Cancel Pro subscription, or Permanently delete 12 files.
  • Name the safe path as the preserved outcome, such as Keep workspace, Keep subscription, Keep access, or Cancel deletion.
  • Avoid Cancel when both the dialog and the underlying service can be cancelled; use Back, Keep plan, Close review, or Cancel subscription according to the real outcome.

Required States

  • Clear destructive title state with verb, target, and consequence.
  • Clear final action state with destructive verb plus target or count.
  • Clear safe action state that names the preserved outcome.
  • Ambiguous Cancel state where cancel could mean cancel dialog or cancel service.
  • Reversible cleanup state where Archive, Move to trash, or Hide is not mislabeled as Delete permanently.
  • Bulk scope state where the label includes selected count and object type.
  • Permission or access removal state where Remove distinguishes from delete object.
  • External-effect state where Send, publish, charge, revoke, or run labels reveal the side effect.
  • Mobile compact state where shortened labels still preserve outcome meaning.
  • Bad OK or Yes state that hides destruction.
  • Bad Continue state that hides execution.
  • Bad Remove state that hides whether data is deleted or detached.
  • Bad Cancel state that reverses user intent.
  • Bad same-copy state where every prompt uses the same labels.
  • Bad color-only danger state where red styling carries the only destructive signal.
  • Bad post-commit copy state where the UI clarifies the outcome only after the destructive action runs.

Interaction Contract

  • Every destructive control label must answer what action will happen and what object or scope it affects.
  • Every safe action label must answer what will be preserved or where the user returns.
  • Dialog titles, body copy, final buttons, secondary buttons, menu items, and status text must use the same verb and target model.
  • If a word has domain ambiguity, such as Cancel, Remove, Close, Disable, Reset, Revoke, Clear, or Dismiss, the UI adds the object and outcome.
  • Copy changes must update accessible names, not only visible helper text or color.
  • Short mobile labels may abbreviate object names only when nearby text keeps the full target and consequence in reading order.

Implementation Checklist

  • Inventory every destructive prompt and record the trigger label, title, final action, safe action, status message, object, count, and consequence.
  • Replace OK, Yes, No, Continue, Confirm, Submit, and Done with outcome-specific labels.
  • Replace ambiguous Cancel with Keep plan, Close dialog, Cancel subscription, Stop deletion, or Do not delete according to intent.
  • Disambiguate Remove by naming whether the object is deleted, detached, hidden, unshared, revoked, or moved to trash.
  • Include counts for bulk destructive actions and rerender labels when selection changes.
  • Keep copy synchronized with disabled states, dependency blockers, typed confirmation, and post-action receipts.
  • Test localization, truncation, keyboard focus, screen reader names, compact width, and action-sheet layouts so labels remain specific.

Common Generated-UI Mistakes

  • A delete prompt uses OK and Cancel without naming what OK will delete.
  • A subscription flow has a Cancel button that could mean close the dialog or cancel the subscription.
  • A permission dialog uses Remove without saying whether access is revoked or the person is deleted from the workspace.
  • A dangerous agent tool review uses Continue for both the next review step and actual execution.
  • A mobile action sheet shortens Delete account to Delete when the account name and scope are offscreen.
  • A red button relies on color to signal destruction while its text says Confirm.

Critique Questions

  • Would the final action label still be clear if read without color or icon?
  • Does the label name the destructive verb and affected target?
  • Could Cancel, Remove, Continue, or Done mean more than one outcome in this context?
  • Does the safe action say what remains unchanged?
  • Does bulk copy update when selected count or object type changes?
  • Does assistive technology receive the same outcome-specific label as sighted users?
Accessibility
  • Accessible names for destructive and safe controls must include the outcome, not only visible adjacent text.
  • Do not rely on red color, warning icons, placement, or button order to communicate destruction.
  • Keep the target and consequence in reading order before compact action labels.
  • Avoid two buttons with identical or near-identical accessible names when one preserves and one destroys.
  • Announce post-action status with the same verb and target used in the committing action.
  • Ensure localized labels retain verb, target, and safe-path distinctions.
Keyboard Behavior
  • Keyboard focus lands on labels that are meaningful when read in isolation.
  • Enter must not commit a destructive action whose focused control says OK, Yes, Continue, or Confirm without outcome detail.
  • Escape and safe actions should close the review without changing the target and then return focus to the trigger or preserved object.
  • When selection count changes, keyboard users encounter updated bulk action labels before commit.
  • Typed confirmation or acknowledgement controls do not enable a final button with vague copy.
Variants
  • OK delete prompt
  • Yes or No destructive prompt
  • Ambiguous Cancel subscription copy
  • Ambiguous Remove access copy
  • Continue executes dangerous action
  • Confirm permanently deletes
  • Bulk delete without count
  • Color-only destructive label
  • Mobile truncated destructive label
  • Post-commit clarification

Verification

Source trail checked:

Saved items