Interlock
about the project
A runtime authorization layer for AI-agent actions. When an agent tries to move money or touch personal data outside policy, the action is held, a named person sees what will happen and who it touches, and decides while the agent waits. The design problem was never the approval queue — it was making it impossible to approve without reading.
Sole product designer, end to end: framing, desk research across ~120 graded sources, PRD, information architecture, UX/UI, a design system with a light core and a dark product layer, a coded prototype with its own verification suite, and the public landing page.
Built at DigitalVertex for an enterprise client under NDA. The public prototype is an anonymized implementation I designed and built.
Role
Sole product designer
Team
4 engineers, 1 PM
client
DigitalVertex client · NDA
year
2026
Duration
3 months
Status
In development · closed beta next
Refund of $4,200 to 12 customers — held before execution, waiting on a named person
the case in 60 seconds
Problem
Agents now move money and touch personal data. The industry answer is to stop and ask a human — but the request arrives bare, and the human presses Approve.
Read→
The shift
The queue was never supposed to empty. It was supposed to concentrate.
Read→
My role
Sole product designer, end to end: framing, desk research across ~120 graded sources, PRD, information architecture, UX/UI, a design system in two modes, a coded prototype and the public landing page.
Read→
Key decisions
Transcribe four digits of a fact to approve anything irreversible. Risk as reversibility × reach, not one score. A timer that starts when the card opens, with a named escalation at three minutes.
Read→
Outcome
Client product in development, closed beta next: a coded prototype with its own verification suite, handed to engineering, and a public landing page.
Read→
brief
The problem
In production 97% of agent permission prompts are approved. Handed a planted dangerous command, 86% of testers let it through.
Business goal
Be the layer a security lead can sign an agent launch on — and bill actions under policy, never human decisions, so success doesn’t shrink revenue.
User goal
The on-call approver arrives by notification from other work. They need to decide correctly — and be able to defend the call a month later.
Design goal
Reading becomes a condition of the action, not something the designer hopes for.
Strategic focus
The MVP covers one class of action — refunds, credits, plan changes. Data and access follow in v1.1.
North star
A two-part North Star. Autonomy alone means people are rubber-stamping; disagreement alone means the policy never learns.
the problem
Agents now move money and touch personal data. When an action falls outside policy, the industry answer is to stop and ask a human. The request arrives bare — a tool name, some parameters, an Approve button — and the human presses it. The market had interception and it had notifications. Nobody had built the screen where a person actually understands what they are allowing.
97%
Prompts approved in production
86.4%
Let a planted command through
66.3%
Accuracy · 409,000 decisions
The market solved interception. Nobody solved the moment a person decides.
Anthropic telemetry on Claude Code · planted-command test, 1,053 paid testers · Scale X, 40,000 runs.
diagnosis
Four fixes that would not have worked
01
Not a clearer dialog
Approval by tap is a reflex, not a misunderstanding. 97% of permission prompts are approved in production, and 86.4% of 1,053 testers let a planted dangerous command through. Rewording the dialog does not make anyone read it — reading has to be a condition of approving.
02
Not more interceptions
Rarity is what breaks attention. At 1% prevalence 30% of threats are missed; at 50%, only 7%. Just 0.8% of agent tool calls are irreversible, so intercepting more would make every request routine. The queue has to concentrate, not grow.
03
Not a countdown
A visible countdown drops accuracy toward the end, and the median time to even notice a notification is 3.5–6.6 minutes. The deadline has to start when the card is opened, with a named escalation at three minutes — not a clock running from the push.
04
Not a simpler phone card
At night judgment fails first: diagnostic errors ×5.6 overnight, execution errors +20.8%, sleep inertia of 15–30 minutes. Simplifying the card does not restore that. The phone can hand over or deny — never approve the irreversible.
the market
Two halves of a market, and no bridge
Eight products checked against their public documentation. Four can intercept a call but ship no human interface at all; four can wake a human but deliver the request bare.
Absent from the docs is not absent from the product
Intercept the call, no human interface
Human interface, no interception
What this meant for the design
A screen where a person understands what they are allowing.
Reading as a condition of approval, delivery separated from decision, bypasses closed by inheritance, rules derived from decisions. HumanLayer and Indent left the niche, Sym went dark, and six guardrail start-ups were acquired in 24 months.
how the work unfolded
Six stages — each one rewrote the brief
01
Frame
Name what actually fails in a human approval, then cut the scope to one shift.
Output
Problem statement + scope · one org, one agent class, one shift
02
Research
Desk research across ~120 sources, each graded by the kind of evidence behind it.
Output
Graded source log
03
Synthesize
Collapse the signals into the few patterns a design can actually answer.
Output
20 signals → 5 patterns
04
Structure
Turn the patterns into requirements and an architecture split by role.
Output
PRD, IA split by role
05
Design
Screens and a design system in two modes, with states designed before layouts.
Output
Screens + design system
06
Build & verify
A coded prototype with its own verification suite, plus the public landing page.
Output
Live prototype, landing
current state
Six places a human approval quietly fails
The approval as the market ships it. Each step loses something the next one needed — and within a week the reflex takes over. Every failure is tagged with the kind of evidence behind it.
01
Agent calls a tool
No context arrives — a tool name and raw parameters, nothing else.
DESK RESEARCH
02
Request is held
Silence reads as a no — timeouts are logged as denials.
DESK RESEARCH
03
A push goes out
Nobody is looking — median time to notice a notification is 3.5–6.6 minutes.
PUBLISHED RESEARCH
04
Someone opens it
The header lies — benign-named attacks slipped past 52.5% of the time.
PUBLISHED RESEARCH
05
They tap Approve
The tap is a reflex — 97% of permission prompts are approved.
PUBLISHED RESEARCH
06
Money moves
Nothing to defend — no record of what the approver was actually shown.
DESK RESEARCH
Approved without reading. Nothing stopped it.
users
Three rhythms: seconds, daily, quarterly
Proto-personas built from secondary research — every pain point is tied to a source, none invented. No live sessions were run yet; that is the first thing the closed beta has to fix.
On-call approver · primary
Policy admin · second surface
Security lead · buyer
Agent owner · not designed for
Support or finance ops with a duty rota on top of the day job. Lives in billing, CRM and chat; arrives by notification and leaves.
Owns what agents may do. Keeps rules in git and works in batches of 20–40 minutes.
Signs off agent launches and barely uses the product. Judges by demo and documentation; carries Article 14 of the EU AI Act.
Feels Interlock as friction: their agent stopped and is waiting. Practitioners report aliasing the skip-permissions flag within about a week.
Needs
Needs
Needs
Needs
What will happen and who it touches in the first words — and a decision they can defend a month later.
To see what a rule would have done before switching it on — divergences first, coverage second.
Proof a human can really intervene — and a log that answers “why was this allowed?” a year later.
Interception that costs little, and a plain answer to “why is it still asking?”
What they need from it
What they need from it
What they need from it
What they need from it
Tell me in seconds what happens and who it hits — so I can decide, and not fear answering for it.
Show me what this rule would do in reality, so I can enable it without learning the consequences afterwards.
Let me prove a human can really step in, so I can sign the launch and defend it at audit.
The competitor is not another product. It is the off switch — and this is the hand on it.
role map
Who asks, who decides, who hears back
Three roles on three rhythms, joined by one request. The approver can propose a rule but never enable it; an unopened request escalates to a named person; and all three roles need the same proof of a live human.
The object · decision record
What was asked, what the human was shown, what was decided, rule version · 7 years
Reads, exports → security lead
signs the launch, never blocks the queue
01 Seconds
02 Daily
03 Quarterly
On-call approver
Primary · seconds
Decides one action. Can propose a rule by ticking a box — never for high risk
—
—
Second on-call
Named handover
Gets the full card and what is left of the timer
—
—
Agent owner
Not designed for
Must see why it stopped — but holds the off switch
—
—
Policy admin
Second surface
—
Reviews drafts in shadow mode — divergences first, coverage second. No bulk approve
—
Security lead
Buyer
—
—
Signs the launch; reviews quarterly, never blocks the queue
● acts × blocked by design ┆ loop the product added
what the research overturned
Nine beliefs the brief started with — and what happened to them
Nine beliefs the brief started with, tested against desk research, published studies, a design review and the act of drawing the screens. Five were refuted, one broke, one was rejected, and two ship as hypotheses.
I assumed
What the evidence showed
What the product does now
25 seconds per high-risk card
Desk research · decision timings — refuted
No hard timer on the irreversible; 40 words kept only as a text budget
A 60-second night timer, started at the push
Desk research · sleep and notice time — refuted
5, 10 and 30 minutes by risk — counted from when the card opens
Success = fewer interceptions
Published research · inverted U, Vectra — refuted
Escalations held within reviewer capacity, plus interception precision
Denial needs a written reason
Published research · blame asymmetry — refuted
One-tap reason chips; the form was removed
Show the amount beside the confirm field
Design review — refuted
The hint says where the fact is, never what it is
A retry is risk-scored from scratch
Drawing the mobile screen — broken
Retry risk = max(original, computed); the timer is inherited
The card is enough to decide
Modeled role — hypothesis
Subject history and a running total inside the card
Rules need a mandatory owner field
Modeled role — hypothesis
No mandatory field — ownership visibly goes stale instead
Fake test cards keep reviewers sharp
Published research · TIP limits — rejected
Calibration moved to a weekly digest after the fact
research synthesis
Twenty signals, five patterns, one mechanism each
Every design response traces back through an insight and a pattern to graded evidence. Where a claim rests on our own check rather than a source, it says so.
Pattern
Signals
Pattern 01
Approval by tap is a reflex
Reading can’t be hoped for — it has to be required
→ Transcribe four digits of a fact to approve anything irreversible · Decision card
97% of permission prompts approved in productionPUBLISHED RESEARCH
86.4% of 1,053 testers approved a planted dangerous commandPUBLISHED RESEARCH
Rubber-stamping within a week — 30+ separate commentsDESK RESEARCH
MFA number matching: ~1% blind approvals across 382k attacksPUBLISHED RESEARCH
Pattern 02
Rarity breaks attention, not speed
Concentrate the queue instead of emptying it
→ Intercept less but contested; rules clear the routine · Rules, Nothing waiting
At 1% prevalence 30% of threats are missed; at 50%, 7%PUBLISHED RESEARCH
Alert volume −22%, ignored share 67% → 63%PUBLISHED RESEARCH
Safety vs escalation rate is an inverted UPUBLISHED RESEARCH
Only 0.8% of agent tool calls are irreversiblePUBLISHED RESEARCH
Pattern 03
Delivery is treated as plumbing
Silence is not a decision
→ Sent-not-opened state; timer starts at open; named escalation at 3 min · Queue row
Median time to notice a notification: 3.5–6.6 minPUBLISHED RESEARCH
A timeout is logged as a denialDESK RESEARCH
Messages over Slack’s limit silently lostDESK RESEARCH
The notification never arrived — 6 sourcesDESK RESEARCH
Pattern 04
Order and framing steer the call
Facts first, reasons in words
→ Effect as headline, risk as reasons, rationale after, deadline not countdown · Decision card
AI advice before a view: 48% over-reliance; after: 14%PUBLISHED RESEARCH
Benign tool names missed 52.5% vs 28.4%PUBLISHED RESEARCH
It’s a black box — five years of Radar complaintsDESK RESEARCH
A visible countdown drops accuracy toward the endPUBLISHED RESEARCH
Pattern 05
At night judgment fails first
The phone can’t give what it’s woken for
→ Night card: hand over or deny — never approve the irreversible · Mobile card
Overnight: diagnostic errors ×5.6, execution errors +20.8%PUBLISHED RESEARCH
Sleep inertia 15–30 min, worst 02:00–06:00PUBLISHED RESEARCH
Mobile approval requests: 69, 36, 29 reactionsDESK RESEARCH
Checked: the phone path fits the timer four times overDESK RESEARCH
Five patterns, one gap: the request reaches a person without what they need to decide.
the reframe
The queue was never supposed to empty. It was supposed to concentrate.
01 · Intercept
Held before execution, never after.
In
A tool call outside policy
Out
A paused call with a stated reason
02 · Score
Reversibility × reach, not a single score.
In
The call and its parameters
Out
A risk level and a timer
03 · Deliver
Sent is not opened.
In
A request routed to a class of action
Out
A named escalation at three minutes
04 · Decide
Reading is a condition of approval.
In
An opened card
Out
A decision logged with the card exactly as shown
↺ Feedback loop
Decisions become draft rules in shadow mode; divergences are read before coverage, and the routine leaves the queue.
PRIORITIZATION
How 73 features became 29 Musts and three builds
The cut
Each phrase of the primary job became a Must criterion.
0
Must · the MVP, three builds
0
Should · v1.1 — rule loop, mobile screen, digest
0
Could · v2.0 — rule hygiene, batches
0
Won’t now · deferred, with the reason written
What was refused, and why
Hotkeys → Should
The brief said dozens of requests a day; the stress test said five a shift. Reversible if volume is real.
The phone rule is Must, the phone screen is Should
No irreversible approvals from a phone on day one — the screen can follow.
Execution delay is Must, 15-min revoke is Should
Stopping before is cheaper and truer than undoing after.
system architecture
From tool call to external system — and back into policy
Seven stages, four places the action can stop, and a log that keeps what the person was actually shown. Traces feed draft rules, which reach policy only through a person.
Tool call → external system
00 · Request
AI agent
Calls a tool; waits, paused
01 · Intercept
Intercept
Held before execution; fail-closed
02 · Score
Risk model
Reversibility × reach → level, timer
03 · Route
Route
Class of action → on-call role
04 · Deliver
Deliver
Push or messenger; sent ≠ opened
05 · Decide
Decide
Card: transcribe, deny, edit, hand over
06 · Delay
Delay
Approved irreversible runs after a delay
07 · Execute
External system
Billing, CRM, data store
Stop points
01 · Intercept
Interception down: agents stop; every call refused with a stated reason
04 · Deliver
Not opened in 3 min: escalates to a named person — never a silent denial
05 · Decide
Denied: one tap; the reason goes into the agent’s context
06 · Delay
Revoke: pending stops instantly; executed gets a compensating review
risk model
Two axes instead of a score
Reversibility and reach decide the timer, what happens at expiry, how approval works and whether a rule may be proposed. A retry can never lower its own risk.
ReversibilityReversible → Irreversible
ReachNarrowWide ↓
Reversible · narrow
Low
Decide within 30 min, approved on expiry. Approve from a phone. A rule may be proposed.
Reversible · wide
High — external customer
Decide within 5 min, denied on expiry. Approved normally — it can be undone. No rule may be proposed.
Irreversible · narrow
High — always, whatever the amount
Decide within 5 min, denied on expiry. Approve only by typing four digits of a fact. No rule may be proposed.
Irreversible · wide
High — always, whatever the amount
Decide within 5 min, denied on expiry. Four digits to approve, never from a phone at night. No rule may be proposed.
A retry can never lower its own risk.
information architecture
Split by role, not by content type
Twenty-three screens in six sections, each with a release priority. Mobile is a branch of its own because it offers different actions, not a narrower layout.
Show by role
Interlock23 screens
On-call approver
Decisions7
Queue
Decision card
Edited approval
Decision sent
Nothing waiting
Not my classv1.1
Revokev1.1
Approver, by push
Mobile2
Mobile notice
Night cardv1.1
Policy admin
Rules2
Rules queuev1.1
Rule draftv1.1
Security · retrospective
Evidence3
Audit log
Weekly digestv1.1
Security digestlater
Everyone
Settings3
Profile
Notifications
Shift handoverv1.1
Everyone
System6
Sign in · SSO
Onboarding
Connection lost
Forbidden
Not found
Server error
Split by role, not content type
The decision surface, the rule surface and the evidence surface have different people and different rhythms.
Mobile is a branch, not a breakpoint
Different actions — no irreversible approvals at night — so it cannot be the desktop card in a narrow window.
Onboarding is core
Confusing for someone who visits rarely was the second most common complaint (13 sources). The approver is that visitor.
design principles
Four rules the interface is not allowed to break
01
Reading is a condition
On irreversible actions Approve stays locked until four digits of a fact from the card are typed. Tapping proves nothing; typing proves the card was read.
02
Denial costs what approval costs
One tap on a reason chip, no form. A product where refusing is more expensive than agreeing manufactures rubber-stamping.
03
Silence is not a decision
“Sent, not opened” is a state of its own. It escalates to a named person — it never quietly turns into a denial.
04
Stakes, not urgency
Risk as reasons in words and a deadline with its consequence — never a composite score, never a countdown ticking under the text.
the patterns have names
Four patterns, named
Low-prevalence effect
Wolfe et al.
Misses rise as danger gets rarer.
In Interlock →
The interception threshold keeps contested requests frequent instead of letting routine flood the queue.
Automation bias
Parasuraman & Manzey
Complacency isn’t cured by practice.
In Interlock →
The agent’s rationale comes after the facts, and approving means reconstructing a fact, not accepting a suggestion.
Habituation to warnings
Response to a repeated warning collapses after a few exposures.
In Interlock →
Warnings fire rarely by rule — a signal on every second card dies within weeks.
Diffusion of responsibility
With more than one layer, everyone assumes someone else checked.
In Interlock →
Every escalation names exactly one person, on screen and in the log.
user flows
Two paths: at the desk, and at 03:14
The canonical flow every desktop screen is built on, and the night branch — deliberately drawn without an approve path.
At the desk · the canonical path
01 · Intercept
Action intercepted
Held before execution; fail-closed
02 · Deliver
Push sent
Sent, not opened — the timer is not running yet
03 · Decide
Decision card
Opened — the timer starts now
04 · Decide
Deny
One tap on a reason chip
05 · Decide
Edit
Edited approval — both versions logged
06 · Decide
Not my class
Hand over; no approve button
07 · Check
CHECK · irreversible?
Yes → four digits · No → approve
08A · Decide
Type four digits
Of the amount, from the card — never repeated by the field
08B · Decide
Approve
No mandatory fields
09 · Record
Decision sent
Logged with the card as shown; executes after a short delay
10 · Record
Revoke
Stops pending; executed gets a compensating review
At 03:14 · phone — irreversible, high risk
N1 · Intercept
Intercepted at 03:14
Irreversible, high risk
N2 · Decide
Night card
Two actions, not three — it explains the person’s state, not the device
N3 · Branch
Hand over to a named colleague
They get the full card and what is left of the timer
N4 · Branch
Deny in one tap
The reason goes into the agent’s context
N5 · Branch
Nobody on the next line
Recorded honestly as cannot decide in these conditions — not escalated
N6 · Blocked
Approve
Not on this screen. Transcribing digits proves reading; at night it is judgment that fails
Inside the product
The screens behind every decision
Every screen below follows one on-call shift: one class of agents, money actions only, and nothing moves until a person decides.
01 · Decision card
You can’t approve what you haven’t read
The decision
On irreversible actions, approval is a transcription. The hint says where the fact lives — “from the card above, not repeated here” — never what it is.
Why it matters
About 1% of people blindly approve the first unexpected MFA push, measured across 382,000 attacks; typing the number ends it. The same mechanism, applied to money.
What you see
Refund $4,200 to 12 customers. The effect is the headline, the risk is two reasons in words, and where Approve would sit there is a field for four digits of the amount.
decision anatomy
An intercepted call became a readable decision
Eight fields every intercepted call has to carry before a person can decide. If one is missing, the call stays held.
Intercepted call · issue_refund → held
High risk · irreversibleThe request
01
Tool name
02
Parameters
03
Agent id
04
Policy
What Interlock adds
05
Risk
06
Scope
07
Reversible
08
Deadline
8 fields · the card as shown is what gets logged
feedback loop
The queue doesn’t empty — it concentrates
Decisions become traces, traces become draft rules, rules prove themselves in shadow mode and clear the routine. What reaches a person is more often worth their attention.
Decision → trace → rule → proof → queue
01 · Decide
A human decides
Approve, deny with a reason, or edit
02 · Record
The trace is kept
The card as shown, the digits, the rule version
03 · Derive
A draft rule appears
Derived from agreeing decisions — no human author
04 · Prove
Shadow mode
21 of 23 would have agreed · 2 diverged
05 · Read
Divergences first
The admin reads the two cases before the 21
06 · Enable
Enabled, one at a time
Routine leaves the queue
Every enabled rule removes routine, so what reaches a person is more likely to be contested
system states
The failure states are designed too
Misrouted, offline, interception down, not found — each explains what is certain, what isn’t, and what happens to the agent. Friction appears only where mistakes can’t be undone.
design system
Color is reserved for meaning
Two token collections and one rule. A light core kit runs in two modes; the product layer is dark-only by decision. Color means risk, attention or where you are — nothing else. Ten directions were tested and the build kept the graphite core. Green exists once: the on state of a settings toggle. The landing uses its own zinc + cyan, because the public page is allowed a color the product is not.
Token architecture
Primitive
118
Semantic
66
31 core · Light + Dark / 35 app · dark
Components
251
red-550#E0564A
app/risk
Irreversible chip, locked Approve
amber-550#D99B2B
app/attention
Delay timer, “sent, not opened”
mist-400#A6ACB3
app/text-muted
Secondary labels
The product palette
Surfaces
ink-950#07090C
ink-900#0A0A0A
ink-800#0F0F0F
ink-750#141414
ink-700#151515
Text
mist-50#F2F4F6
mist-200#CDD3D9
mist-400#A6ACB3
mist-500#969CA3
mist-700#5E646A
Meaning
red-550
#E0564A
risk · irreversible
amber-550
#D99B2B
attention · timer
blue-500
#5B8CFF
navigation · where you are
success-300
#5CB890
one use · toggle on
Borders are white at 5 / 9 / 24% — no grey hex in the product layer
Type
Refund $4,200 to 12 customersApp/Hero · 34 Medium · −1.5%
Inter — everything you read
Decision queueApp/Heading · 28 Semi Bold
Held before executionApp/Title · 16 Medium
The agent waits while a named person decides.App/Body · 14 / 1.45
IRREVERSIBLE · HIGH REACHApp/Overline · 10 Medium · +13%
The agent’s reasoning — shown only when asked.App/Voice · 12.5 Italic
JetBrains Mono — every fact
$4,200App/Mono Number · 27 Bold
$4,800what the agent askedApp/Mono Number Struck · 27 Bold
refund_batch · 12 customersApp/Mono · 13
02:41 left · escalates to M. KovachApp/Mono Small · 11
ID · act_7Q2K9App/Overline in mono context
Facts are mono, reasoning is italic, everything else is Inter.
Why no brand color
Monochrome accent
ApproveDeny
The dangerous action is the loud one.
Chromatic accent
ApproveDeny
Approve becomes as salient as Deny. For a product whose thesis is “no blind approval”, that is a regression.
Salience is saturation × area, not hue distance: an electric cyan 170° from red still out-shouts it.
Ten directions, one dashboard fragment, ten criteria
landing page
A product built on friction still needs a page that sells it
The landing had one job: make a security lead believe the human in the loop is real — without a single number the product can’t back. So it opens with the rule rather than a benefit: before an AI agent acts, Interlock decides whether it should.
It sells with the screen, not the word “governance” — the gap the competitor audit exposed. “Without Interlock” and “With Interlock” sit side by side; rules are shown with their shadow-mode agreement, and every “Try demo” opens the working prototype.
The public page is allowed a brand color the product is not: outside the product nothing competes with risk, so the cyan lives here and nowhere inside. The coded version of the page is checked by a script that fails on any claim the product can’t back — “SOC 2”, “trusted by”, a risk score.
PRODUCT LANDING PAGE · DESIGNED AND BUILT BY ME
view product landing page
→
mobile
At 03:14 the phone can refuse or hand over — never approve
The phone gets a different set of actions, not a narrower layout. At 03:14 an irreversible refund can be handed over or denied, never approved — reading four digits off a card is a desk task. These screens are designed for the case study; the prototype does not have them yet.
Phone · designed, not yet built
iteration
The one place the first version was wrong
What triggered it
What it became
01
The confirmation field proved nothing
The first draft printed the amount a centimetre from the field. Four characters could be copied by eye — no reading needed, so the step was there formally and absent functionally.
In number matching the fact lives on one screen and is typed on another; the split is what makes it a check. The card body plays the second screen, and the hint says where the fact lives, never what it is.
outcome
What exists, and what is still a hypothesis
Shipped
~120
Sources, each graded by evidence
73 → 29
Features scored · Must in the MVP
0
Component state cells, designed before screens
0
Scripts verifying the coded prototype
A spec, not a pilot: a PRD with a two-part North Star and nine key results, a role-based sitemap, three flows, a design system in two modes, 22 dark screens, 10 overlays, a coded prototype and a landing page. All 12 verification scripts pass.
Still a hypothesis
Measuring
—
Time from intercept to decision
—
Intercepts that were false alarms
—
Approvals revoked afterward
These three need a live queue and real approvers. The prototype shows the path, not the rate. Deliberately not measured: time on the card, uptime and totals, “no incidents” as success, fewer interceptions, or a correct-decision rate — outcomes do not return to the log yet, so it would be invented.
reflection
What I would carry into the next system
The first version of the best idea was wrong
Printing the amount beside the confirmation field turned a check into a captcha with the answer in the margin. One line of copy separated a mechanism that works from one that imitates working.
Constraints come from the person, not the device
“The phone is too small” was the wrong reason and would have produced the wrong design. The right question was which ability the check tests — at 3 a.m., that ability is judgment.
Put what you don’t know on the screen
The digest has a block for what it cannot see. An invented accuracy metric would have been the most persuasive element on the page, and the only dishonest one.
in one line
Interlock turns approval from a button into a decision: nothing irreversible moves until a named person has read what it does.
destinations
Open the live prototypeOpen the live landingNext case study: TeamPulse
Built at DigitalVertex for an enterprise client under NDA. The public prototype is an anonymized implementation I designed and built.
TeamPulse
CONNECT
[ COPY ]
BASED IN
San Francisco · remote · open to relocation
LOOKING FOR
Senior Product Designer · AI Product Designer · UX/UI