Overview
How might we preserve useful autonomy while keeping consequential actions inspectable, editable, and attributable?
When to use
- Essential for email clients, code generation tools, and applications where human oversight of AI actions prevents errors and builds trust.
When to skip
- Low-stakes, easily reversible suggestions where approval friction slows the user more than it protects them.
- Fully autonomous monitoring or batch jobs where the product already has hard budgets, rollback, and clear failure alerts.
- Every micro-edit in a creative canvas; prefer selective gates on publish, send, or spend instead.
States
Design the whole control model, not only the confirmation dialog.
- 01
Proposed
The AI has staged an action. Nothing consequential has run yet. The proposal is waiting for a human decision.
- 02
Under review
The full payload is visible and inspectable: action, target, content, and impact before any side effect.
- 03
Editing
The person changes the proposal in place. Consent will apply to the edited payload, not the original draft.
- 04
Approved
Explicit confirm authorizes execution. Only after this step may the product send, apply, spend, or deploy.
- 05
Rejected
Deny or discard stops the action. No side effect runs, and control stays with the human.
- 06
Executed
The approved action has completed (or failed after approval). Outcome is separate from the decision itself.
Key UX elements
The parts that must be present for this pattern to work.
Action
Say exactly what will happen.
Use an active verb and a specific object so people know exactly what they are authorizing.
Scope
Expose the target, quantity, and boundaries.
Summarize what is included and give a path to inspect or edit the underlying items before approval.
Impact
Describe who and what will change.
Use plain language for cost, visibility, permanence, and affected people or systems. Do not rely on a risk color alone.
Reason
Explain why approval is required now.
Connect the interruption to a rule, threshold, or risk class so the pause feels predictable rather than arbitrary.
Alternatives
Keep edit and deny paths first-class.
Approval is meaningful only when someone can change the scope or stop the action without pressure or penalty.
Recovery
Set expectations before execution.
State whether the action can be cancelled, undone, or only remediated after it begins.
Rules
Silent auto-send or auto-apply with only a buried undo.
Approval UI that does not show the exact payload (email body, diff, amount) being approved.
One global “always allow” that never re-prompts for higher-risk actions.
Approval after the side effect already happened.
Evidence
| Product | Implementation |
|---|---|
| GitHub Copilot | Suggests code in-editor; human accepts, rejects, or edits before commit. |
| Gmail Smart Compose | Inline completions stay draft until the user sends the message. |
| ChatGPT | Agent and connector flows ask before sending email or taking external actions. |
| Gemini | Approval cards and send gates for actions that leave the chat surface. |
