Agent UX & Human Interaction

Designing for Trust & Calibration

Trust is a calibration target, not a maximization goal: matching user-perceived reliability to measured reliability per task, displaying confidence only where it changes a decision, and spending friction where it actually calibrates.

Approval & Confirmation UX

Consequence-tiered gates, payload-hash pinning so you confirm the action that actually runs, batching and defaults to fight confirmation fatigue, and stronger modalities for genuinely irreversible actions.

Progressive-disclosure UX for agents

Show the user only the next decision they need to make — when to surface the chain of thought, the tool call, the diff; and when to keep it folded.

Transparency & Explainability

Faithful versus plausible explanations, why a raw chain-of-thought is a persuasive narrative rather than verified causality, choosing the right altitude of explanation, and provenance as the highest-leverage transparency.

Interruption, Steering & Handoff

Responsive non-destructive interruption, distinguishing pause/steer/abort, symmetric handover and handback, shared inspectable state, and reconciling on resume so an agent never silently reverts a human fix.

Progressive Autonomy

The autonomy ladder (operator/collaborator/consultant/approver/observer) as a product surface: autonomy scoped to (capability, scope), promotion gated on a visible track record, and automatic reversible demotion.

Designing for Failure & Recovery

Graceful failure that stops before compounding, undo as the safety net that makes lower friction affordable, actionable error messages, failing closed on consequence and open on capability, and the explicit work of trust repair.

Async & Away: UX for Unwatched Runs

Past ninety seconds nobody is watching, so the expensive problem is re-entry rather than the wait: an inbox over runs, a notification budget spent only on decisions, status pushed into the artifact, a diff instead of a transcript, and pre-authorisation because a gate with nobody behind it is a deadlock.

Shared & Multi-User Agents

A second pair of eyes breaks three assumptions at once — one intent, one permission set, one accountable person — and the one that ends pilots is attribution collapse, not leakage: bind every run to one human principal, take permissions as the intersection, and print the name in the room.

Undo & Reversibility

Every confirmation dialog is a bill for the undo you did not build: sort actions by cost of reversal rather than by scariness, buy time with a hold window, and make each tool return a revert handle — because confirmation asks a person to predict a bad outcome while undo only asks them to recognise one.

First Run & Onboarding

The first session sets a durable prior about what the agent can do, and the capability tour calibrates it to the ceiling: demonstrate a refusal early, pick a first task you can guarantee on the user's real data, and stop bundling permissions the user has no basis to evaluate.

Memory & Personalization UX

Memory is the only agent feature whose worst outcome is a privacy incident rather than a wrong answer, and it gets there through one default: writing silently — a user cannot correct, consent to or forget a fact they never saw being stored.

Waiting & Latency UX

Abandonment tracks legibility rather than duration, so shaving seconds off an agent run buys almost nothing — publish the plan before the work starts, reorder it so something checkable happens first, and hand off to async at a threshold you decided rather than one your users discover.

Citations & Source-Attribution UX

An audit of four generative search engines found only 51.5% of sentences fully supported by their citations, so a footnote nobody opens raises confidence without raising correctness — attach spans during generation, drive the cost of checking one claim to three seconds, and measure detection of planted errors rather than click-through.

Cost & Quota UX

Nobody budgets in tokens and a live dollar counter with no control attached is anxiety with a number on it — denominate the meter in the unit the user asked for, ship the receipt before the live meter, give a band rather than a point on a heavy-tailed distribution, and measure calibration rather than spend, because a cost surface optimised to reduce spend throttles the workflow returning 55× alongside the one that loses money.

Generative UI & Agent-Rendered Surfaces

The moment an agent renders a screen instead of describing one your test matrix stops being finite — so exhaust selection before composition, make every component total over its prop space, never let a generated surface decide anything, snapshot the payload rather than the pixels, and keep a flag that drops the whole thing back to prose.

Embedding an Agent in an Existing App

The chat panel is the cheapest surface and the one users abandon, because it knows nothing about the screen in front of them — anchor the agent to the object instead, pass the view as structured context rather than a screenshot, write through the code path the UI already uses, and put state on the server on day one, because that is the only decision here you cannot retrofit.