AI patterns.
How to decide what an AI-powered feature should do, how much it should be trusted to do on its own, and what it owes the person using it — before it ships.
Why this exists
This page exists to give every team the same two decisions to work through before building anything, the same shared infrastructure once they have, and the same minimum bar to check against before shipping.
Principles
Five principles that hold regardless of which pattern or autonomy level a feature uses.
Disclose, don't disguise
People can always tell when they’re looking at or triggering AI, before they commit to it.
Suggest before you act
Every capability starts at the lightest touch and earns more autonomy.
Show your work — especially when it fails
AI output is traceable, and low confidence or errors are surfaced, not hidden.
Nothing is final without the user
Every AI output can be edited, regenerated, or reversed.
Consistency over novelty
AI features feel like part of the product, not a bolted-on gimmick.
Which pattern is this?
Work this out first — it determines the default autonomy in step 2.
How much autonomy has it earned?
Every AI capability starts small and earns more control by proving reliable. Get this wrong and a feature ends up either useless or unaccountable.
AI proposes — nothing changes until the user acts. Every new capability starts here. Ships opt-in; advances once people consistently accept it.
AI drafts a first version — a quote line, an invoice text — for the user to edit and approve. Ships once Suggest has proven reliable, with a visible diff to what the user would've done.
AI completes a step on its own, within limits the user set. Ships only once every item in Shared AI infrastructure below is in place — no exceptions.
If a feature can't clear its level's gate, it doesn't ship at that level. That's what keeps "AI suggests, you confirm" true as capabilities grow.
Shared AI infrastructure
The shared infrastructure every AI feature draws from. Build order: controls → receipts → logs → undo.
- Controls. Start, stop, pause. The user decides when the AI works — it never runs without a visible switch.
- Receipt card (planned). Every consequential suggestion shows its work: which documents it read, what it is and isn't sure about, and a confirm step. No receipt, no action.
- Confidence indicator (planned). Uncertainty shown in words a tradesperson can act on — never a bare "87%." Low confidence looks visibly different from high confidence.
- Activity log. What the AI did, when, and on whose approval — reviewable after the fact. The audit trail is a feature, not a compliance chore.
- Undo / rollback. Every AI action can be reversed. If a workflow can't offer undo, it doesn't clear Suggest, let alone Draft or Act.
- Escalation to human. A clear path from "the AI is handling this" to "a person is handling this" — for the user's judgement, not as a failure state.
Signaling AI before it's clicked
Before a user clicks anything, they should be able to tell an action will invoke AI.
While AI is working
Marking and labeling AI output — what "AI-generated" vs. "AI-modified" looks like, when the EU AI Act label applies, terminology — is covered on AI Transparency & Disclosure and the AI disclosure label component. Use those as-is; don't improvise a different treatment per product.
What's specific to this page is the moment before there's anything to label yet — while AI is still generating:
Keeping the user in control
Every AI moment needs a visible way to push back on the result.
Minimum bar for any AI feature
- Regenerate — try again if the first result isn't useful
- Edit directly — AI output should never be locked or read-only
- Revert — if a user edits AI content and wants the original suggestion back, let them get it back in one action
- Feedback — a lightweight thumbs up/down is fine as a start, but pair it with an optional "what was wrong?" so we're not just collecting an unexplained thumbs-down
For anything that takes an action beyond suggesting text — creating a task, sending something, changing a record, notifying someone — add an explicit authorization step before it happens. Describe what will happen in plain language ("This will send the updated schedule to 4 subcontractors") rather than a generic "Confirm?" A person should never discover an AI took an action after the fact.
When AI gets it wrong
AI will sometimes be uncertain, contradict itself, or act on the wrong information. In a field where mistakes have real cost — a wrong measurement, a misfiled ÄTA, an incorrect invoice line — silently failing is worse than failing visibly. Build these into every feature, not just the happy path:
- Low-confidence state — if the AI isn't confident, say so and offer a narrower, more certain answer instead of a broad guess presented flatly.
- Conflicting sources — if AI drew from two documents that disagree, surface the conflict rather than silently picking one.
- Wrong citation or reference — let users flag the specific claim or source that's wrong, not just the answer as a whole.
- Undo and escalation — the same patterns from Shared AI infrastructure above apply here; every failure state needs both within reach.
If a feature can't reasonably support these states yet, that's a sign it's not ready to ship — not a reason to skip the states. For output that could influence a decision, pair the wrong-citation flag with the explanation guidance on AI Transparency & Disclosure.