Confirmation and Destructive Copy
Name the object, the scope and the reversibility, then label the button with the action rather than with agreement.
Definition
Confirmation copy is the last thing read before something irreversible happens. It has to carry what will be affected, how much of it, and whether it can be undone.
Expert heuristic. A review criterion developed by practitioners. Useful and widely taught, but evaluated by judgement rather than measurement.
On this plate
Reach for this when
- Any irreversible action.
- Bulk operations across many records.
- Actions that affect other people, such as removing access.
Common mistakes
- Yes and No as the only labels.
- Confirmations on actions that could simply be undone.
- Scope left unstated, so the reader cannot tell whether one item or forty are affected.
- Using the same confirmation wording for a reversible action and an irreversible one, which flattens the difference the reader most needs to see.
The same confirmation, three ways
| Weak | Better | Best | Why the last one wins |
|---|---|---|---|
| Are you sure? | Delete this project? | Delete Q3 Roadmap and its 48 tasks? This cannot be undone. | Object, scope and reversibility in one sentence. |
| This action cannot be undone | Removing a member is permanent | Removing Sam ends their access immediately. Their comments stay. | Says what survives as well as what goes. |
| Cancel / OK | Cancel / Delete | Keep project / Delete project | Both options name an outcome, so neither can be pressed by reflex. |
Decide the strength before writing the words
Most confirmations exist because nobody decided how serious the action is. Grade it first.
- 1
Reversible
No dialog. Perform the action and offer undo in a status message.
- 2
Recoverable within a window
No dialog. Perform the action, say where it went and how long it stays there.
- 3
Irreversible and significant
A dialog naming the object, the scope and the consequence, with a labelled action button.
- 4
Irreversible and catastrophic
Type-to-confirm, so the reader has to reproduce the name of what they are destroying.
The three parts of a confirmation
| Part | Weak | Strong |
|---|---|---|
| Question | Are you sure? | Delete the Q3 roadmap? |
| Consequence | This cannot be undone | This deletes 24 documents. Nobody can restore them |
| Buttons | OK and Cancel | Delete roadmap, and Keep it |
In practice
- i.
Type-to-confirm earns its friction
Deleting a production database behind a typed name is slow on purpose. The typing is not a security measure, it is a way of forcing the reader to read the name of the thing they are about to destroy.
- ii.
Sure about what
Naming the objectThe object's name is the part that prevents the wrong-item error, and it is the part most often left out. Are you sure protects nobody who clicked the wrong row.
Local chart
WRT·012 · Region III · Grid F2
This entry and the entries it is stated to connect with. Each line is labelled with what the connection means.
Continue from here
Each link says what the connection is, so you can tell a principle from an alternative from a thing people mix this up with.
Principles behind this
The reasoning this solution is an application of.
- Loss AversionBIAS·002 · Cognitive bias
- ForgivenessPRIN·006 · Principle
Related concept
Connected closely enough to change how you apply this.
- Modal DialogCMP·010 · Component
- ConfirmationPAT·008 · Pattern
- Destructive ActionsPAT·009 · Pattern
- UndoPAT·022 · Pattern
- Button and Action LabelsWRT·008 · UX writing