User Control and Freedom
Users make mistakes and change their minds, so every state needs a clearly marked way out.
Definition
Nielsen's third heuristic. Users often choose functions by mistake and need a clearly marked emergency exit to leave an unwanted state without going through an extended dialogue. Undo and redo support this directly.
Expert heuristic. A review criterion developed by practitioners. Useful and widely taught, but evaluated by judgement rather than measurement.
On this page
Undo beats confirmation
A confirmation dialog interrupts every user to protect against a mistake that a minority make. Undo interrupts nobody and protects everyone, and it produces a better outcome in the failure case because the user sees the result before deciding.
The exception is genuinely irreversible action: permanent deletion, sending money, publishing to an audience that cannot be recalled. There, confirmation is correct, and it should describe the specific consequence rather than asking 'Are you sure?'.
Choosing the safety mechanism
| Action | Mechanism |
|---|---|
| Reversible, low cost | Just do it. No confirmation, no undo needed. |
| Reversible, disruptive | Do it, then offer undo in a persistent inline message. |
| Recoverable within a window | Soft delete with a visible restore path, such as a trash that keeps items for 30 days. |
| Irreversible, high cost | Confirmation naming the specific object and consequence, with the destructive action clearly secondary. |
| Irreversible and catastrophic | Type-to-confirm, naming the object exactly. |
Exits users expect to find
- Escape closes a modal, and clicking the backdrop closes non-destructive ones.
- Browser back behaves sensibly inside multi-step flows, without losing entered data.
- Cancel is present on every dialog and never styled as the primary action.
- A partially completed flow can be abandoned without losing the work already done.
- Filters and search can be cleared in one action.
In practice
Soft delete with a restore window
Content toolsDeleted items move to a trash that empties after thirty days. Deletion stays instant, the safety net is real, and the confirmation dialog becomes unnecessary.
Type-to-confirm for irreversible operations
Developer toolsRequiring the user to type the repository name before deletion is deliberate friction proportional to consequence. Applying the same friction to deleting a draft would be absurd.
Sources
Where a source establishes something narrower than the popular reading of it, the note says so.
10 Usability Heuristics for User Interface Design
J. Nielsen, Nielsen Norman Group, 1994, revised 2020
Continue from here
Each link says what the connection is, so you can tell a principle from an alternative from a thing people mix this up with.
Applies when you are designing
Applied through
Where this shows up as a concrete interface decision.
- Modal DialogComponent
- ToastComponent
- ConfirmationPattern
- Destructive ActionsPattern
- Multi-Step FlowsPattern
- UndoPattern
- MicrocopyUX writing
Practical example
A worked decision where this was the deciding factor.
- Designing a Cancellation FlowCase study
- Designing an AI Suggestion Feature People Would UseCase study
Related concept
Connected closely enough to change how you apply this.
- Error PreventionHeuristic
- Help Users Recognise, Diagnose and Recover From ErrorsHeuristic
- Peak-End RuleLaw
- ForgivenessPrinciple