Where they come from
Pulled from shipped work, each written as a method rather than a screen. Where a pattern happened only once, it is not here.
How an entry reads
Problem, mechanism, when to use it, and evidence. A cost is mandatory in every entry. A pattern without a cost is a slogan.
Pattern(s)
Question
Who reaches the verdictWhat the model may do aloneWhat cannot be assembledHow it behaves when it breaks
Category
DecidingAuthorizingBoundingFailing
Shown in
ModelOpsInterlock
[01] DecidingShown in ModelOps
Fig. 01
Evidence Before Verdict
The system assembles the evidence and withholds its own answer until the reviewer has formed one.
9%→3%
Late audits with incomplete reasoning
Problem
When the model’s proposal comes first, a person agrees within seconds, then looks for confirmation instead of checking.
Mechanism
The verdict leaves the first screen. Evidence comes first, grouped by criterion.
Cost
Simple cases take longer to review. It reads as an extra step, until the first error it catches.
Use when
A person makes the decision and a person answers for it. The cost of an error is high and surfaces late.
Evidence
A prototype test with 12 analysts: most stopped at the model’s proposal within seconds. After the proposal moved behind the evidence, incomplete written reasoning fell from 9% to 3%.
Seen elsewhere
Google PAIR frames the goal as trust calibration: knowing when to trust the system and when to apply your own judgment. Microsoft Research shows the reverse effect — cited sources raised perceived credibility regardless of whether the output was right.
[02] DecidingShown in ModelOps
Fig. 02
Completeness Over Confidence
Replace the model’s confidence with a per-criterion measure of whether the evidence is actually there.
34%vs11%
Sources opened: all vs high-confidence
Problem
A confidence percentage does not say what is missing, and it reads as permission not to check.
Mechanism
The confidence signal comes off the screen. In its place goes evidence completeness per criterion.
Cost
You lose fast triage. The industry default works against it: most confirmation queues show a 0–100% score on every row.
Use when
The decision has checkable grounds. Not applicable where the conclusion cannot be broken into criteria.
Evidence
Analysts opened the sources on 34% of cases, and on only 11% when confidence was high. Measurement: source-open events from the platform log.
Seen elsewhere
The Microsoft Research line of work on appropriate reliance and overreliance. Separately: a bare percentage does not say what is missing, and produces paralysis and unwarranted trust in equal measure.
[03] AuthorizingShown in Interlock
Fig. 03
Autonomy Ledger
A written, versioned statement of what the model does alone, what a person confirms, and what is never automated.
Problem
The boundaries of autonomy live in people’s heads and in the code, but not in a document. Every new team reinvents them from scratch.
Mechanism
Three lists, explicitly maintained and versioned. The third — what is never automated — matters more than the first two, because it usually goes unwritten.
Cost
The document goes stale if it has no owner. With no tie to the launch process it becomes a declaration.
Use when
More than one team works on an agentic platform.
Evidence
The autonomy rules the platform is designed against. Three other teams build to them.
Seen elsewhere
OpenAI, in its document on governing agentic systems, describes the same elements under other names: constraining the action space, requiring confirmation, setting default behavior, interruptibility. Anthropic describes the same problem from the engineering side, as confirmation fatigue.
[04] BoundingShown in ModelOps
Fig. 04
Paired Guardrail
No target metric ships without the metric that would catch it being gamed.
Problem
A target metric improves at the expense of something nobody measures. A faster review is bought by a worse review.
Mechanism
Every target metric ships paired with a guardrail metric that would catch the degradation. The pair is a launch requirement, not a recommendation.
Cost
It slows the launch. It requires agreeing the guardrail threshold up front, the most contested conversation in the project.
Use when
A speed or volume metric can be improved at the cost of quality — which is nearly always.
Evidence
The paired metric became a launch requirement on the platform: review time against completeness of reasoning. That pair showed the speed-up had not been bought with quality.
Seen elsewhere
NN/g states the adjacent rule plainly: one good result is an example, not an evaluation. Anthropic describes regression sets that must pass at near-100% as a distinct class of check alongside target metrics.
[05] BoundingShown in Interlock
Fig. 05
Constrained Composition
Make the invalid configuration impossible to build instead of validating it at runtime.
24%→58%
Launched without a solutions engineer
Problem
The configurator allows combinations the product never intended. The error is found in production, far from whoever created it.
Mechanism
The set of permitted combinations is constrained at the editor level. An invalid state cannot be assembled, rather than being refused on save.
Cost
It cuts off legitimate rare scenarios along with the mistaken ones. It needs an explicit channel for exceptions, or the product turns rigid.
Use when
A user assembles a process or a rule out of parts, and some combinations are meaningless.
Evidence
A diary study showed most configuration errors fell on combinations the product permitted but did not intend. After the rebuild, processes launched without a solutions engineer rose from 24% to 58%.
Seen elsewhere
In software this is ‘make illegal states unrepresentable’, from typed programming. Linear applies a close version at the data-model level: a task can only be assigned to a person and only delegated to an agent.
[06] FailingShown in Interlock
Fig. 06
Degraded by Design
Enumerate the degraded states and design them as first‑class screens.
Problem
Degraded states get designed last, or not at all. In a system with a queue and an external deadline, failure is a regular mode.
Mechanism
The states are enumerated and get screens of their own. Each answers what is unavailable and what the person can do right now.
Cost
A substantial amount of work that cannot be justified with a demo. Selling that volume is harder than building it.
Use when
The system depends on external data of variable quality and works against a deadline.
Evidence
Five degradation states behind the review screen, from unreadable scans to extraction failure against an external deadline.
Seen elsewhere
The requirement to design failure, not only the happy path, appears verbatim in job descriptions. Google PAIR gives it a chapter of its own; Microsoft Research adds that happy paths are unfit for assessing overreliance risk.
CONNECT
[ COPY ]
BASED IN
San Francisco · remote · open to relocation
LOOKING FOR
Senior Product Designer · AI Product Designer · UX/UI