Overview
How might we make agent autonomy a visible, selectable policy instead of a hidden autopilot?
When users need to dial independence up or down
- Coding agents, workflow automation, and tools where the same run can draft, edit, or ship.
- Sessions that mix reversible local work with irreversible external actions.
- Products that need a shared vocabulary for “how independently is this agent allowed to act?”
- Any surface where silent autonomy would surprise people after the side effect lands.
When one fixed gate is enough
- Single low-stakes draft tools where confirm always and execute never is enough.
- Fully attended interactive editors where every keystroke is already human-driven.
- Regulated flows that legally require confirm for every side effect, expose confirm only, not execute.
States
Design the mode policy and the step outcomes together, not only a three-way toggle.
Mode set
Suggest, confirm, or execute is chosen before work starts. The active mode is always visible.
Suggesting
The agent proposes a plan or next action. Nothing consequential runs until a human starts it.
Awaiting confirm
A step is staged with inspectable scope. Execution waits for an explicit approve or skip.
Executing
Prior permission covers the run. Steps progress with visible status instead of silent background work.
Paused
Mode change, error, or a riskier step stops the run and re-discloses what would happen next.
Complete
The workflow finished or stopped. Outcome is separate from which mode authorized it.
Key UX elements
The parts that must be present for autonomy modes to feel trustworthy.
Name the three policies in plain language.
Suggest only, ask first, and run through. Labels must map to real behavior, not marketing.
Say what the current mode will do.
One sentence under the control: propose only, pause per step, or continue without stopping.
Show the steps before side effects.
List tools and targets so people can see blast radius before any mode runs them.
Confirm pauses on the active step.
Approve and skip are first-class. The staged step stays inspectable until a decision.
Make execute visible while it runs.
Step status replaces a silent autopilot. People should see what finished and what is next.
Start safer than the maximum.
Default to confirm for new users and irreversible actions. Offer execute after scope is understood.
Anti-patterns to avoid
A global Autopilot that silently includes irreversible execute actions.
Mode labels without showing what will run (tools, targets, blast radius).
Defaulting newcomers to execute on first session.
Switching modes mid-run without pausing or re-disclosing side effects.
How products use it
| Product | Implementation |
|---|---|
| Cursor Agent | Plan and ask before apply vs freer edit modes with reviewable diffs. |
| GitHub Copilot Workspace | Proposal and plan stages before merging agent-authored changes. |
| Claude Code | Permission prompts for tool use vs trusted local edit sessions. |
| Devin | Staged plans and human gates before long autonomous coding runs. |
Implementation
Copy this prompt to generate a production-ready implementation in Cursor, Claude Code, Lovable, or any AI coding agent.
Generate a production-ready implementation of the "Suggest / Confirm / Execute" AI interface design pattern.
Pattern Definition:Frequently asked questions
What is suggest / confirm / execute in agent UX?
It is a three-mode autonomy model: suggest means propose only, confirm means act after approval, and execute means run with prior permission. Users choose the mode to match how much risk they accept.
How does it differ from human-in-the-loop?
Human-in-the-loop is the confirm gate on a specific action. Suggest / confirm / execute is the session-level policy that decides when that gate appears versus when the agent may proceed.
What mode should be the default?
Default to confirm for new users and irreversible or external actions. Offer execute only after users understand scope, or only for narrow reversible toolsets.
Can products mix modes per tool?
Yes, and they should. Suggest for planning, confirm for send/deploy/spend, and limited execute for local reversible edits is a common and safer mix than one blanket setting.