Architecture & Trust
Autonomy levels, integration architecture, and what builds or destroys trust in AI products.
Architecture & Trust
Autonomy levels — a design decision, not an implementation detail
Autonomy level determines how much the user is in the loop. It should match the reversibility of actions and the trust earned through product experience. Design for Level 1. Earn Level 4+.
| Level | Name | What AI does | What human does | Required when | Review UX |
|---|---|---|---|---|---|
| L0 | No AI | Nothing | Everything | Scope is deterministic | None |
| L1 | Suggest | Proposes options | Decides and executes | Always for novel AI introductions | Prompt/suggestion UI |
| L2 | Confirm | Executes with step approval | Confirms each step | Consequential, reversible actions | Step-by-step checkpoint |
| L3 | Delegate | Executes at checkpoint gates | Reviews at defined milestones | Complex tasks, trusted domain | Milestone review UI |
| L4 | Automate | Executes, notifies after | Monitors and can intervene | Routine, reversible, high-volume | Action log + undo |
| L5 | Autonomous | Executes without notification | Audits retrospectively | Only with full reversibility guarantee | Audit trail only |
Integration architecture — how AI fits into a product
Visibility
Invisible AI
AI operates without surface-level disclosure. Risk: hidden manipulation. Use only when action is trivially reversible and stakes are zero.
Explicit AI
AI is always labelled and its outputs are clearly attributed. Required for all consequential AI.
Timing
Synchronous AI
User waits for AI output. Best for interactive, real-time flows. Max acceptable latency: ~2s before UX degrades.
Asynchronous AI
User continues working while AI processes in background. Best for long-running tasks, batch operations.
Assistant vs Collaborator vs Agent
| Assistant | Collaborator | Agent | |
|---|---|---|---|
| Initiation | User | Bidirectional | AI |
| Scope | 1 action | Session-wide | Goal-wide |
| Memory | None | Session | Full context |
| Write access | Never | Limited | Full + gates |
| Failure | User retries | User corrects | Auto-recovery |
| Audit | Output only | Process + out | Full trail |
Trust & Safety — what builds it, what destroys it
What builds trust
Transparency about what AI did and why — every time
Consistent, predictable behaviour across sessions
Accurate confidence calibration — AI knows what it doesn't know
Easy, fast, prominent correction and undo mechanisms
Visible review loop for high-stakes actions
AI that admits uncertainty rather than guessing confidently
Source attribution for factual claims
Clear scope boundaries — users know what AI can and can't touch
Behaviour that matches what was promised during onboarding
What destroys trust
AI making errors without acknowledgment or recovery
No way to undo AI actions — especially consequential ones
Uncertain information presented with false confidence
Surprise automation — user didn't know AI would act
AI behaviour that feels like surveillance, not assistance
Sycophancy — AI always agrees with users regardless of facts
AI ignoring user corrections or failing to learn from them
Invisible AI — users don't know they're interacting with it
Over-promising capability, then consistently under-delivering