Agentic products change the interaction contract. Traditional software waits for explicit user actions. An agent can plan, call tools, modify state and continue working while the user is elsewhere. That makes autonomy itself a UX parameter.

Too little autonomy and the product becomes a sequence of annoying confirmation dialogs. Too much autonomy and the user stops knowing what changed, whether an action can be reversed, or when intervention is still possible.

The Autonomy × Reversibility matrix

I use two variables before deciding how much approval an agent needs:

  • Consequence: what happens if the action is wrong?
  • Reversibility: how completely and cheaply can the action be undone?

Autonomy × Reversibility

Low consequence + reversibleLet the agent act. Show a compact status and preserve undo. Example: reorganize draft items or apply a reversible formatting change.
High consequence + reversibleAllow action only when the result is inspectable and rollback is obvious. Consider review-after rather than blocking every step.
Low consequence + irreversibleUse a focused confirmation at the point of no return. Do not ask for repeated approval during preparation.
High consequence + irreversibleRequire explicit review with evidence, scope and consequences visible before execution. Strong identity or role boundaries may also be required.

This avoids the common mistake of applying one approval policy to every agent action.

Approval is a product state, not a button

A useful approval screen should help the user make a decision. “Approve / Reject” without evidence merely transfers responsibility to the user.

Before approval, show:

  • scope: exactly what the agent intends to change;
  • reason: the user-facing basis for the proposed action, not raw chain-of-thought;
  • impact: affected records, recipients, cost, permissions or other consequences;
  • uncertainty: what remains unknown or ambiguous;
  • recovery: whether the action can be undone and for how long.

Microsoft's current agent runbook makes a similar operational point: approval flows need explicit reject paths, and different action types should not share one blanket approval policy.

Four checkpoint locations

Human oversight can happen at different moments. Choose the moment based on risk, not habit.

CheckpointBest forUX requirement
Before executionHigh-impact or irreversible actionsPlan, scope, evidence and consequences before approval.
During executionUncertainty or branching decisionsPause cleanly, preserve context, ask one bounded question.
Before commit / publishLong-running preparation with a final consequential stepLet the agent do reversible work first; review only the final change.
After executionReversible low-risk automationClear change log, result inspection and undo.

Do not turn permission prompts into noise

Repeated confirmations can create the appearance of safety while reducing actual attention. Anthropic reported in 2026 that users approved roughly 93% of Claude Code permission prompts in one context, illustrating a familiar UX problem: when prompts are frequent and predictable, users stop treating them as meaningful decisions.

The design implication is not “remove permission.” It is to move control to the moments where judgment matters.

The safest interface is not the one with the most approvals. It is the one where the user can recognize the few approvals that actually matter.

Progress must expose state, not internal monologue

An agent that works for 30 seconds or 10 minutes needs a visible operational state. Users usually do not need hidden reasoning. They need answers to practical questions:

  • What is the agent doing now?
  • What has already completed?
  • What is blocked?
  • What external systems or tools are being used?
  • Can I pause or cancel?
  • Will leaving this screen stop the task?

Anthropic's guidance on effective agents prioritizes transparency and meaningful human oversight, while its agent work also emphasizes grounding against the environment during multi-step execution. In UX terms, the agent's operational state should be legible enough that users can supervise without reading a transcript.

Undo is an autonomy feature

Teams often treat undo as post-error polish. For agentic products, undo directly changes how much autonomy can be safely granted.

If an action is:

  • fully reversible;
  • visible after completion;
  • logged with enough context;
  • recoverable without expert support;

then the interface can often allow more automatic execution with less pre-action friction.

Conversely, if a wrong action is invisible or impossible to reverse, the product needs stronger pre-action control.

Design the reject path

“Reject” is not a complete state. What happens next?

A rejected agent action may need to:

  • return to the agent with a correction;
  • route to a human operator;
  • save as a draft;
  • discard only the proposed step while preserving prior work;
  • ask the user which constraint was violated;
  • stop the entire run.

If the product has no answer, users learn that “Reject” is risky too.

Recovery needs three levels

Recovery ladder

CorrectEdit the agent's input, scope or assumption and continue from the current task.
UndoReverse a completed action without restarting the whole workflow.
EscalateStop automation and transfer the current context, actions and evidence to a human.
Abort safelyTerminate the run while clearly showing what already changed and what did not.

A five-question UX review for any agent action

  1. What is the worst plausible consequence if this is wrong?
  2. Can the user see exactly what the agent is about to affect?
  3. Is approval placed at the smallest meaningful point of no return?
  4. Can the user correct or undo without restarting?
  5. If automation stops, can a human understand what already happened?

These questions are more useful than defaulting every AI interaction to chat plus an “Approve” button.

The target is calibrated autonomy

The best agent UX does not maximize automation. It maximizes useful autonomy while preserving meaningful control. That usually means fewer generic interruptions, more visible state, stronger boundaries around irreversible actions and much better recovery.

Sources and further reading