Protect agency and model responsibility
Every path supports exit and recovery; every risky feature has minimum-data, misuse, safeguard, and removal decisions.
Guidance
Scale preview and confirmation to consequence, preserve undo where possible, and do not ship when foreseeable harm cannot be bounded.
Do
- Design decline, cancel, undo, and recovery
- Document data need, misuse cases, safeguards, and do-not-build threshold
Do not
- Coerce consent or make consequential changes silently
Verification contract
manual threat, consent, consequence, and recovery review
Supporting references
ref.apple.hig-accessibility— Apple HIG Accessibilityref.apple.hig— Apple Human Interface Guidelines