Part Two: The product · Trouble and change
Warnings are easier to add than undo. People who fear breaking something stop exploring, and one slip costs them an hour.
A person learns a product by trying things. They press the button to see what it does. That only works if pressing the wrong one is cheap.
When it is expensive, people change how they behave. They stop experimenting. They keep a copy of everything in another file "just in case." They ask a colleague before touching a setting. The product has features they will never find, because finding them means taking a risk.
Most of what goes wrong is a slip: the wrong row, the wrong key, a finger that landed a line too low. A warning does little for a slip, because the person believes they are doing the right thing and agrees without reading. What helps is a way back afterward.
A way back is harder to build. The product has to keep the old state and know how to restore it. A deleted record goes to a trash that empties after a month. An edited document keeps its earlier versions. A changed setting remembers what it was. These decisions reach down into how the data is stored, so they are cheap at the start and costly to add once the product is built.
Gmail shows what it buys, on the action that seems least reversible. After you send a message, a small bar offers Undo for a few seconds. The message has not really gone yet. Hardly anyone presses it. Knowing it is there changes how sending feels.
Some things cannot be taken back: money that has moved, a message other people have read. Those are few, and they are the subject of another pattern.
Therefore:
Make every action reversible that can be: deleting, moving, editing, changing a setting. Do it at once and show a way back. Plan for it early, because undo is hard to add later.
In practice. List the product's destructive actions. Next to each write "undo," "trash for 30 days," or "cannot be undone." Start with the one that support hears about most.
Goes with. Undo covers what a person did, and NOTHING IS LOST (55) covers what the product did. Decide what must be reversible while the work is ROUGH ENOUGH TO CHANGE (22). For the acts left over, CONFIRM ONLY WHAT MATTERS (78).