Consent, privacy, security, sensitive data, reporting, permissions, and safety exits.
Browse all problem familiesTrust grows when purpose, consequence, status, and control are visible at the point of decision. Sensitive tasks also need a safe route for correction and exit.
Strong: A clinic explains why identity details are needed, shows the recipients of a shared record, and offers a clear correction route.
Weak: A clinic asks for sensitive details under a generic Continue button and reveals the sharing scope after submission.
Try it: Choose a sensitive action and write the purpose, consequence, consent point, confirmation, and correction route.
Begin with the core behavior, apply it in different contexts, then review cases that reveal the quality boundary. Open each entry for its decision rule, states, example, and source trail.
0 of 21 studies complete
Start this family →Learn the shared task and the core interaction choices.
The product needs a user's active agreement for optional data use, marketing, research participation, personalization, partner sharing, AI training, or sensitive-data processing.
Users need ongoing control over personal data collection, saved activity, visibility, app access, device permissions, connected services, data sharing, or personalization.
A feature needs operating-system, browser, or device authorization to access location, camera, microphone, photos, contacts, notifications, Bluetooth, clipboard, motion sensors, storage access, or another powerful feature.
Owners or admins need to manage durable access to spaces, sites, repositories, projects, folders, datasets, boards, environments, or sensitive objects.
Users need to inspect, copy, verify, rotate, transcribe, or compare a sensitive value that should normally stay masked or redacted.
A threat signal indicates phishing, malware, deceptive site, unsafe download, invalid certificate, insecure connection, mixed-content submission, suspicious redirect, file preview risk, or account-security danger.
Choose a specialized form for the context and follow its complete behavior.
The service needs purpose-level runtime enforcement and an evidence record for optional storage choices.
The service is eligible to identify itself as an official government or public-authority website.
The product must support security investigations, compliance review, legal discovery, privileged-action review, or enterprise governance.
Users need to download or transfer a copy of account, workspace, personal, product, activity, or organization data.
An authenticated session has expired or been terminated while the user was on a protected task.
A user must accept terms of service, conditions of sale, policy documents, service agreements, acceptable-use rules, or legal disclosures before access or transaction completion.
A user, agent, automation, or admin tool is about to execute a high-impact action that can affect money, access, production systems, legal/compliance state, customers, external recipients, sensitive data, or safety.
Users can create an account and need a self-serve or direct request path to close it and delete associated data.
Users need to flag content, behavior, an account, conversation, listing, repository, ad, or message for policy, abuse, spam, privacy, legal, or safety review.
Users need to reduce exposure to a person, account, conversation, channel, app, bot, word, topic, or thread.
Age or age band controls whether users may access content, features, commerce, community interaction, personalization, or data collection.
The user may be harmed if someone nearby sees them viewing or using the current sensitive service.
Study failure cases and identify the better recovery route.
A product currently asks for device, browser, or app permissions before the relevant feature context exists.
A UX review, privacy review, legal review, accessibility review, or support report identifies manipulation in a consent, cookie, marketing, sharing, AI training, or data-use choice.
Auditing a product that supports account creation and may be hiding, obstructing, disguising, or underspecifying account deletion.
Try fewer words, clear the filter, or search across all pattern families.
Search all patterns