Trust and Recovery

Trust is built through predictability and tested through failure. Users trust systems that behave consistently and recover gracefully when things go wrong.

Evidence Tiers

code

[Research]   — Peer-reviewed studies, controlled experiments
[Expert]     — Nielsen Norman Group, recognized UX authorities
[Case Study] — Documented examples from major products
[Convention] — Industry practice, limited formal validation

Multiple tags = stronger evidence: [Research][Expert]
Mixed findings noted as: [Research — Mixed]

Research Foundations

Peak-End Rule

[Research][Expert] Daniel Kahneman's research (Nobel Prize in Economics, 2002) established that people judge experiences based on:

•The peak moment (most intense, positive or negative)
•The end (how it concluded)

They do not average the entire experience.

UX implication: A single graceful recovery can redeem an otherwise frustrating experience. Don't let the last interaction be an error.

Source: Kahneman, D. (1999). Objective happiness. In Well-being: Foundations of hedonic psychology.

Loss Aversion

[Research][Expert] Kahneman & Tversky's Prospect Theory showed losses feel approximately 2x as painful as equivalent gains feel good.

UX implication: Users are highly motivated to avoid losing their work. Auto-save, undo, and data preservation are disproportionately important.

Source: Kahneman, D. & Tversky, A. (1979). Prospect Theory: An Analysis of Decision under Risk.

Undo vs. Confirmation Dialogs

[Expert] Nielsen Norman Group and multiple UX authorities recommend undo over confirmation dialogs in most cases.

Why Confirmation Often Fails

[Expert] From NNg and practitioner observation:

•Users habitually click "OK" without reading
•Frequent confirmations train users to ignore them
•Confirmations interrupt flow

When to Use Each

Approach	Use When	Evidence
Undo	Action is reversible	[Expert] NNg
Confirmation	Action is truly irreversible AND destructive	[Expert] NNg
Neither	Routine, low-risk actions	[Convention]

[Case Study] Google Drive: No confirmation for moving files to trash (reversible). Confirmation required for emptying trash (irreversible).

Pattern: Undo Toast

[Convention]

code

[User clicks delete]
[Item disappears immediately]
[Toast: "Item deleted" [Undo] — auto-dismisses in 10s]

Caution: No controlled studies directly comparing undo vs. confirmation outcomes found. This is strong expert consensus, not validated research.

Source: Nielsen Norman - Confirmation Dialogs

Error Message Design

[Expert] Nielsen's Heuristic #9: "Help users recognize, diagnose, and recover from errors."

The Three Questions

Every error message should answer:

•What happened? (Clear description)
•Why? (Cause, if helpful)
•What now? (Recovery path)

Useless:

code

Error 500: Internal Server Error

Actionable:

code

Couldn't save your changes — the server is temporarily
unavailable. Your draft has been saved locally.

[Try again] [Continue editing]

[Research] Cognitive Load Theory (Sweller) supports this: vague errors increase extraneous cognitive load.

Source: Nielsen Norman - Error Message Guidelines

Core Patterns

trust-1: Confirm Destructive, Not Routine

[Expert] Only interrupt for truly irreversible actions.

Over-confirming (trains users to ignore):

code

"Are you sure you want to save?"
"Are you sure you want to go back?"

Appropriate confirmation:

code

"Delete 47 files permanently? This cannot be undone."
[Cancel] [Delete]

trust-2: Preserve Data Aggressively

[Research] Loss aversion (Kahneman & Tversky) explains why losing work is disproportionately frustrating.

Trust-breaking:

code

[User writes long comment]
[Accidentally navigates away]
[Returns — comment gone]

Trust-building:

code

[User writes long comment]
[Accidentally navigates away]
[Returns — draft restored]

Auto-save drafts. Preserve form state. Cache locally.

trust-3: Degrade Gracefully

[Convention] Isolate failures. Don't let one problem cascade.

Brittle:

code

[One image fails to load]
[Entire page shows error]

Graceful:

code

[One image fails to load]
[Placeholder shown with retry option]
[Rest of page works fine]

trust-4: Show System Status

[Expert] Nielsen's Heuristic #1: "Visibility of system status."

Opaque:

code

[User clicks Submit]
[Nothing happens for 3 seconds]
[Suddenly: "Submitted!"]

Transparent:

code

[User clicks Submit]
[Button shows spinner: "Submitting..."]
[Button changes: "✓ Submitted"]

Recovery Patterns

Pattern: Optimistic UI with Rollback

[Convention]

code

1. User takes action
2. UI updates immediately (optimistic)
3. Server request in background
4. If success: done
5. If failure: rollback UI + show error + offer retry

Pattern: Forgiving Input

[Expert] Postel's Law: "Be liberal in what you accept."

code

// Rigid
Phone: [Must be exactly ###-###-####]

// Forgiving
Phone: [Accepts any format, normalizes internally]
"5551234567" → displays as "(555) 123-4567"

Pattern: Graceful Timeout

[Convention]

code

[Operation takes too long]
"This is taking longer than expected.
 You can keep waiting or try again."
[Keep waiting] [Cancel and retry]

Don't make users guess if something is frozen.

Anti-Patterns

Pattern	Why It Breaks Trust	Evidence
Silent failures	User doesn't know something went wrong	[Expert] NNg
Generic errors	No path to recovery	[Expert] NNg
Lost form data	Punishes user for system failure	[Research] Loss aversion
Inconsistent behavior	Can't build mental model	[Expert] Jakob's Law
Hidden data usage	Feels deceptive	[Convention]

Key Sources

•Kahneman, D. & Tversky, A. (1979). Prospect Theory.
•Kahneman, D. (1999). Objective happiness (Peak-End Rule).
•Sweller, J. (1988). Cognitive load during problem solving.
•Nielsen Norman - Confirmation Dialogs
•Nielsen Norman - Error Message Guidelines
•A List Apart - Never Use a Warning When You Mean Undo