Error
You will delete the wrong file and send the half-written email — not because you’re careless, but because you’re human. Kind design forgives you.
Signals, mapping, feedback, models, constraints — five modules of stopping mistakes. But no design catches them all. A tired, distracted, ordinary human will still slip through every net you build. This last module is about that moment: what a design does after the error, when the damage is one tap away.
The humane answer has three parts: understand the error, catch it, and above all forgive it. A slip (right goal, wrong action) is not a mistake (wrong goal), and they want different fixes. A sensibility check notices the missing zero before the money moves. And a reversible action makes a slip cost a click, not a catastrophe. You’ll feel undo, a sanity check, and the difference between a slip and a mistake.
one that prevents you.- Tell a slip (right goal, wrong action) from a mistake (wrong goal) — and fix each differently.
- Feel why undo is the single most humane feature in software.
- Catch an error before it commits with a sensibility check.
- Stop blaming the human — treat “user error” as a design brief. not merely discouraged.
The undo
The single most humane thing a design can do is let you take it back. Delete the wrong photo, send the wrong message, drag the wrong file — and a good system answers not with “are you sure?” but with “done — and here’s undo if that was a slip.” The mistake still happens; it just stops mattering.
Delete the same photo twice. First where gone means gone, then where a quiet toast offers it straight back. Feel the drop in your stomach vanish.
The sensibility check
Some slips you can’t design away — you can catch them the instant before they matter. A sensibility check is the system glancing at what you did and quietly asking, “that doesn’t look right — sure?” The classic: a bank noticing a transfer is 100× your usual, and pausing on the extra zero your eyes slid right past.
Wire some money. Fat-finger an extra zero, then hit transfer — first on a system that just does it, then on one that catches the nonsense.
Slip, or mistake?
Not all errors are the same, and the difference decides the fix. A slip is when your goal is right but the action goes wrong — autopilot, a wrong button, a look-alike jar. A mistake is when the goal itself is wrong — you planned badly, or believed something false. Slips want better feedback and constraints; mistakes want better information and models.
Sort each of these four. Right goal, wrong action — or wrong goal all along?
People will slip. Catch them.
Error feels like the user’s department until you accept the truth: everyone slips, all the time, and the only question is whether the design was ready for it.
Design for the mistake, not the ideal user.
Start by naming the error. A slip is a right goal gone wrong in the doing — the wrong button, the look-alike jar, the deep habit that hijacks your hands. A mistake is a wrong goal from the start — a bad plan, or a false belief. They need opposite fixes: slips want clearer feedback and constraints so the action can’t stray; mistakes want better information and models so the plan is sound. Blur the two and you fix neither.
Then build in layers, because no single guard is perfect. The Swiss-cheese model says every defence has holes; you stay safe only when the holes don’t line up. So stack them: a constraint to prevent, a sensibility check to catch, a confirmation for the truly dangerous, and — the last, kindest layer — an undo for everything else, so a slip that gets through costs a click, not a catastrophe.
And retire the phrase “user error.” When a tired person makes the same slip a thousand others made, that’s not a thousand careless people — it’s one careless design. Treat every ‘error’ as a brief: what could we change so this could not have happened, or could be undone in a breath? A design that forgives is a design that has finally understood who it is for.
Which design forgives?
Five face-offs. Same slip, two designs — one leaves you stranded, one hands you a way back. Pick the kinder, then see why.
Forgiveness, built in
The kindest features are the ones that quietly assume you’ll slip. Two you lean on without a thought.
Gmail holds your email for a few seconds and offers ‘Undo.’ It doesn’t stop the send — it makes it reversible, turning the gut-drop of a wrong recipient into a shrug and a click.
One key combination undoes almost anything, almost anywhere. It’s so ingrained you reach for it in the physical world by reflex — the clearest proof that reversibility is what people quietly rely on.
Six modules, one promise, held from the first page to the last: when a design confuses you, or trips you, or lets you fail — it’s the design’s fault, not yours. Signals, mapping, feedback, models, constraints, and now grace for the error that slips through anyway. That’s the whole craft of how things work: quietly taking the blame, so the person never has to.
The real references
These ideas aren’t ours — they’re the field’s, named and tested over decades. Five worth your time, in the words of the people who wrote them. (Opens in a new tab.)
The Error glossary
Six words that turn “the user messed up” into a precise, fixable diagnosis. Tap a card to flip it.
Questions you actually ask
What people get wrong
Read the error
Ten questions in seven formats, tagged by thinking level — each with layered hints: a nudge, the reasoning, then a deeper connection. A wrong answer opens a door, never a dead end. Served from the question bank, never hardcoded.