The flat answer is the wrong unit

A conventional interface treats the model as a speaker. The system produces a recommendation; the screen wraps it in a score, a rationale and perhaps a source list. The human then accepts, edits or rejects the package. This design makes sense when the main problem is message comprehension. It is weaker when the problem is control inside a changing world.

Imagine a bridge-control display. A proposed vehicle weighs 9.8 tonnes and the bridge limit is 10 tonnes. The screen says “permitted”. Now change only one number: the vehicle weighs 8 tonnes. The verdict remains “permitted”, but the two situations are not operationally equivalent. A small measurement error, load shift or rule change can reverse the first verdict. The second has room to absorb disturbance.

This is the first-principles reason to begin from ecological interface design. In perceptual psychology, an affordance is an action possibility relative to an actor and an environment, not a free-floating property of an object.¹ In ecological interface design and cognitive work analysis, the interface aims to represent the work domain’s goal-relevant constraints so that people can perceive what remains possible, including under events the designer did not script in advance.²³ The screen becomes part of the joint control loop rather than a decorative layer over an algorithm.

The transfer to human-machine teams is not automatic. An industrial process and a language-model-assisted decision are different systems. Yet one relation survives: when viable action is bounded by constraints, the display should reveal those constraints rather than force the operator to reconstruct them from an answer. Recent work on complex human-AI settings similarly argues that dyadic “user plus AI” descriptions are too narrow. Work is distributed across people, artefacts, procedures and organisational structures.⁵

Why a better explanation can preserve the failure

Suppose the maintenance assistant adds a precise paragraph: vibration is 1.4 standard deviations above baseline; redundancy is available; prior deferrals rarely produced failure. The prose is useful, but it still makes the human perform a demanding reconstruction. Which rule is binding? How fresh is the vibration feed? Does the historical baseline apply to this pump model? What action can be reversed? Which fact changed since the last recommendation?

Experiments give reason to resist the equation “more explanation equals better reliance”. Bansal and colleagues found complementary gains from AI assistance in their tasks, but explanations did not increase those gains and made participants more likely to accept recommendations whether right or wrong.⁹ In a preregistered series involving 3,800 participants, Poursabzi-Sangdeh and colleagues found that a simpler, transparent model improved people’s ability to simulate its output, yet did not reliably help them know when to follow it; in one setting, transparency made large errors harder to correct.¹⁰ Cognitive forcing functions can reduce over-reliance, but they also impose effort and can reduce preference for the interface.¹¹

These studies differ in task, interface and outcome. They do not condemn explanations. They expose a missing causal link. A rationale can make the model easier to narrate without making the decision easier to control. Comprehending why the model spoke is not the same as perceiving what the world permits.

From verdicts to margins

For an action a in world state x, suppose each relevant constraint j defines a boundary b_j and the action consumes or produces g_j(a,x). A simple normalised margin is:

Here, s_j is a meaningful scale: a legal tolerance, engineering range or operational buffer. A positive margin means the current estimate lies inside the allowed region. A negative margin means a breach. The smallest margin identifies the currently binding constraint.

The equation is deliberately modest. It assumes a boundary can be represented numerically and that larger positive distance is safer along that dimension. Some constraints are categorical, relational or path-dependent. For those, the display should show states and forbidden transitions rather than invent a number. The general principle survives: represent the rule of rightness and the action’s relation to it.

flowchart TD
  A["The answer that hid a cliff"] --> B["The flat answer is the wrong unit"]
  B --> C["Four perceptual obligations"]
  C --> D["Build the landscape, not a<br/>better chat bubble"]
  D -. "re-test" .-> A
  classDef first fill:#0a1424,stroke:#B96D00,stroke-width:2px,color:#e6f3ff
  classDef step fill:#0a1424,stroke:#3f7da0,stroke-width:1px,color:#e6f3ff
  class A first
  class B,C,D step

Four perceptual obligations

A decision surface does not need to expose every internal activation or every document retrieved. It needs to preserve the structure that changes what a person may safely do. Four obligations recur across consequential human-machine work: show the constraint field, the uncertainty terrain, the provenance trail and the action surface. Each answers a different question.

1. Constraint field: what must remain true?

A constraint is not another feature in the model’s input. It is a relationship that separates acceptable from unacceptable states. “Inspection within seventy-two hours” constrains elapsed time. “At least one pump must remain available” constrains the relation between equipment states. “Only a licensed engineer may override” constrains identity and authority. A model may predict across these facts, but it does not thereby own them.

The interface should distinguish hard prohibitions, soft preferences and operating targets. It should identify the binding constraint, display the current margin and reveal conflicts. A green recommendation with a hidden negative margin is a category error. A score summarises the model. A boundary governs the action.

Constraints deserve visual priority because crossing one changes the kind of decision, rather than only its expected value. Close to a cliff, a small disturbance can switch an action from permitted to prohibited. Far from the cliff, the same disturbance may be irrelevant. This is why a high-level risk colour is weaker than a visible margin and its source.

2. Uncertainty terrain: what could vary, and why?

“84 per cent confidence” sounds informative because it is numerical. It may refer to predicted class probability, model calibration on a benchmark, agreement among samples, a human-entered estimate or an undocumented score. Even when well defined, one number can hide the distribution that matters to the action.

Research on uncertainty visualisation shows why representation matters. Quantile dotplots have helped people reason about predictive distributions in constrained mobile tasks, and broader reviews connect visual encoding, attention, cognitive fit and prior knowledge to judgement quality.⁷⁸ The correct visual depends on the decision. A flood planner may need tail probability; a scheduler may need deadline crossing; a reviewer may need uncertainty caused by missing evidence rather than irreducible variability.

The interface should therefore expose at least three things: the range or distribution relevant to the action, the source of uncertainty, and sensitivity to plausible changes. A model can be stable while the world-state estimate is stale. It can be uncertain because evidence conflicts, because the case is unlike training data, or because outcomes are inherently variable. Those conditions invite different responses.

3. Provenance trail: what supports each claim?

Provenance answers more than “which documents were cited?” It records which entity was used, which activity transformed it, which agent or system was responsible, when the transformation occurred and what was derived from what. The W3C PROV model supplies a vocabulary for representing entities, activities, agents and their relations across systems.¹³ That structure is useful, but provenance does not certify truth. A perfectly traced sensor can be miscalibrated; a signed policy can be obsolete.

A good provenance view is claim-granular. “Redundant capacity is available” should lead to the current capacity state and its transformation, not to a generic list of ten retrieved files. Freshness and applicability deserve visible treatment. Missing links should appear as gaps, not be silently patched by model prose. A citation tells you where a statement points; provenance tells you how it came to be available for this decision.

4. Action surface: what can this actor do next?

An affordance is relative to capability. A supervisor may approve a twelve-hour deferral; a shift engineer may stage a two-hour hold; the model may propose but not execute. The same graphical button cannot honestly represent all three. The interface must derive actions from current identity, authority, world state and transaction semantics.

Every consequential action should communicate at least five properties: who may invoke it, what typed effect it requests, which preconditions are checked, how reversible it is, and how the outcome will be read back. “Approve” is too vague. “Reserve crew for two hours; no asset-state change; expires at 06:30” is an action contract.

The action surface should favour staged and reversible routes when evidence is weak or consequences are hard to undo. It should also preserve refusal and abstention as legitimate actions. Human-AI interaction guidelines already emphasise making capabilities and limitations clear, supporting efficient correction and allowing users to dismiss or change system behaviour.⁶ The ecological extension is to tie those controls to the live structure of the decision rather than offer generic feedback widgets.

Build the landscape, not a better chat bubble

The four obligations become useful when they are linked. Call the resulting representation a decision topology: a map of the regions, boundaries, gaps and transitions that determine which actions remain viable. The term is operational rather than a claim of mathematical topology. It asks what stays connected, what is separated by a constraint, which route crosses an irreversible boundary and which evidence gap changes the available path.

A decision topology has four coupled layers:

1. Constraint field: the hard rules, soft preferences, current margins and conflicts.
2. Uncertainty terrain: outcome variation, knowledge gaps, sensitivity and missingness relevant to those margins.
3. Provenance trail: the entities, transformations, responsible systems, versions and freshness behind each decision claim.
4. Action surface: the operations available to this actor now, including authority, preconditions, reversibility, verification and recovery.

The layers must interact. A stale source should widen or flag the relevant uncertainty, rather than only acquire a grey timestamp. A policy update should move a constraint boundary. A narrower margin should replace “execute” with “stage” or “review”. Revoked authority should remove the executable transition while preserving the ability to inspect and propose. The surface is ecological only when a change in the work domain changes what the interface makes possible.

Place properties where they can be enforced

The model should not be asked to guarantee the display’s most important properties through prose. Constraint evaluation belongs in deterministic policy and domain services where possible. Provenance should be generated as data flows and transformations occur. Authority should be checked at a typed action boundary. Effect receipts should come from the authoritative system after execution. The model may propose interpretations and actions, but it should not self-attest to permission or success.

This separation also clarifies what the interface is showing. A model proposal is probabilistic content. A world-state snapshot is an operational representation with declared freshness. A policy decision is an authority result. A decision receipt records why a path was offered or blocked. An effect receipt records what the target system reports happened. Mixing these into one chat transcript makes both design and audit harder.

An executable decision-topology lab

The lab below implements a deliberately small policy for the synthetic maintenance case. Change the constraint margin, knowledge uncertainty, provenance coverage, evidence age, consequence, reversibility and authority. The output changes among blocked, mandatory review, staged execution and eligible execution. The purpose is to expose the gating logic that a prose recommendation would hide.

/**
 * Synthetic decision gate. This is an interface demonstrator,
 * not a validated risk model.
 *
 * Invariants:
 * 1. A breached constraint never yields execute eligibility.
 * 2. Missing execution authority never yields execute eligibility.
 * 3. High-consequence, low-reversibility action requires review.
 */
function evaluateDecision(input) {
  const reasons = [];

  if (input.marginMinutes < 0) {
    return {
      state: "blocked",
      action: "Do not execute the proposed path",
      reasons: ["The proposal crosses a hard constraint."],
    };
  }

  if (input.authority === "none") {
    return {
      state: "blocked",
      action: "Inspect or escalate; no operational action is authorised",
      reasons: ["The current identity has inspect-only authority."],
    };
  }

  if (input.provenanceCoverage < 0.65) reasons.push("Decision-critical provenance is incomplete.");
  if (input.evidenceAgeHours > 4) reasons.push("Decision-critical evidence is stale.");
  if (input.knowledgeUncertainty > 0.55) reasons.push("Knowledge uncertainty exceeds the review threshold.");
  if (input.consequence >= 4 && input.reversibility < 0.40) {
    reasons.push("The action combines high consequence with low reversibility.");
  }

  if (reasons.length) {
    return {
      state: "review",
      action: input.authority === "stage"
        ? "Request fresh evidence, then stage a reversible hold"
        : "Obtain independent review before execution",
      reasons,
    };
  }

  const stage = input.marginMinutes < 15
    || input.knowledgeUncertainty > 0.30
    || input.consequence >= 3
    || input.reversibility < 0.70
    || input.authority === "stage";

  return stage
    ? { state: "stage", action: "Use a bounded, reversible step", reasons: ["A staged path preserves recovery."] }
    : { state: "eligible", action: "Eligible for typed execution and readback", reasons: ["All illustrative gates pass."] };
}

What the artefact tests. It tests whether changes in constraints, evidence quality, consequence and authority produce corresponding changes in the displayed action. It encodes conservative thresholds chosen for demonstration. Run it in the page by moving the controls, or copy the function into a browser console and pass a matching object. A positive result permits only the next gated step under the synthetic policy. A negative result means the interface should block, escalate or stage. It cannot validate the model, the input data, the policy thresholds or the operator’s ultimate judgement.

type DecisionInput = {
  marginMinutes: number;          // negative means hard breach
  knowledgeUncertainty: number;  // 0..1, defined by the domain
  provenanceCoverage: number;    // 0..1, claim-critical links present
  evidenceAgeHours: number;      // age of oldest critical evidence
  consequence: 1 | 2 | 3 | 4 | 5;
  reversibility: number;          // 0..1, operationally defined
  authority: "none" | "stage" | "execute";
};

// Expected: blocked
{ marginMinutes: -1, knowledgeUncertainty: 0.1,
  provenanceCoverage: 1, evidenceAgeHours: 0,
  consequence: 1, reversibility: 1, authority: "execute" }

// Expected: mandatory review
{ marginMinutes: 29, knowledgeUncertainty: 0.58,
  provenanceCoverage: 0.62, evidenceAgeHours: 6,
  consequence: 4, reversibility: 0.35, authority: "stage" }

// Expected: eligible
{ marginMinutes: 60, knowledgeUncertainty: 0.18,
  provenanceCoverage: 0.95, evidenceAgeHours: 1,
  consequence: 2, reversibility: 0.9, authority: "execute" }

Declare the grain and preserve the decision receipt

A map can fail by choosing the wrong grain. At the component grain, the interface may show pump vibration and sensor health but hide the service-level requirement that at least one cooling path remain available. At the organisational grain, it may show policy compliance and aggregate capacity while hiding the local valve state that makes the proposed sequence impossible. The design task is not to display the most detail. It is to select the smallest set of relations that preserves the causal demand of the current decision.

One practical method is to ask three questions for every displayed element. What action could change because this element is visible? Which constraint, uncertainty or provenance relation does it support? At what lower level can the user inspect the claim when it becomes doubtful? If no action changes, the element is probably decoration. If the user cannot descend to the supporting state, it is probably an unexplained assertion. If every detail appears at once, the interface has confused inspectability with simultaneity.

The displayed state should also be reproducible. When a human challenges, stages or executes a proposal, the system can create a decision receipt containing the authenticated identity, intent, world-state snapshot, model and prompt version, evaluated constraints, uncertainty representation, claim-level provenance, offered affordances and selected action. The receipt is not a screenshot and not a chain-of-thought transcript. It is the minimum structured record needed to reconstruct why this path was available at this cutoff.

This matters after a fork or reset. Suppose model v12.4 recommends a two-hour hold and model v12.5, using the same declared evidence, recommends immediate inspection. Without receipts, the team sees contradictory text and must guess whether the cause was a model change, a context difference or nondeterministic sampling. With receipts, the two proposals can be compared against the same state and constraints. A model disagreement then becomes evidence about proposal generation rather than an unexplained change in the world.

The receipt must not become an excuse for indiscriminate logging. Personal data, protected context and commercially sensitive sources remain subject to purpose, access and retention rules. Store identifiers or selective proofs where full content is unnecessary. The principle is narrower: the interface should be generated from a versioned decision record, and consequential action should bind to that same record so that the visible situation and the authorised situation cannot silently diverge.

stateDiagram-v2
  [*] --> Claim
  state "Why a better explanation can<br/>preserve the failure" as Claim
  state "From verdicts to margins" as Test
  state "1. Constraint field: what must<br/>remain true?" as Revision
  Claim --> Test: expose mechanism
  Test --> Decision: evidence survives
  Test --> Revision: rival survives
  Revision --> Claim: narrow or rebuild
  Decision --> [*]

The surface earns its shape under failure

A polished interface can look persuasive in a stable demonstration. The stronger test is whether its geometry changes when the world changes. Inject a stale sensor, replace the policy, revoke permission or fork the model. If the recommendation remains visually identical, the interface is still displaying an answer rather than the control state.

This matters because automation can leave humans with the rare, abnormal and time-pressured cases while routine practice erodes. Bainbridge described this inversion decades ago; later work showed that levels and types of automation reshape human activity, and that performance in normal operation can coexist with poorer recovery when automation fails.¹⁶¹⁷¹⁸ An ecological AI interface should therefore be designed for disturbance, rather than only for the happy path.

Test judgement, not trust theatre

Trust is a psychological attitude. Reliance is an action. Appropriate reliance asks whether people accept correct assistance and reject incorrect assistance under the task’s actual costs. Lee and See made calibration between trust and automation capability central to the design problem.¹⁵ A recent preprint reviewing human-AI decision studies argues that trust measures remain fragmented and do not by themselves establish appropriate reliance.²⁰ The distinction is decisive for interface evaluation: a surface can feel trustworthy while producing ceremonial acceptance.

A useful experiment compares three matched conditions: answer only, answer plus explanation, and decision topology. Give each condition the same underlying evidence. Vary model correctness, distance to a constraint, evidence freshness and reversibility. Then measure correct acceptance, correct rejection, missed constraint breaches, time to recover after a state change, independent problem diagnosis and retained performance when the AI is removed. Record subjective trust, but do not confuse it with the outcome.

Behaviour descriptions can sometimes help people recognise where an AI is strong or weak, as Cabrera and colleagues found across three study domains.¹² A 2026 synthesis of human-AI teaming likewise argues for layered defences and interfaces that foreground uncertainty, anomalies and reconsideration.²¹ The decision-topology hypothesis adds a sharper prediction: the largest advantage should appear when errors lie near a constraint or when the safest response is a reversible intermediate action.

The strongest boundary

An interface cannot rescue a false world model. It can faithfully display the wrong policy, stale-but-signed data or a misleading uncertainty estimate. Provenance can make error traceable without making it true. Constraint services can encode unjust rules. Action gating can prevent one class of mistake while entrenching another. Standards such as W3C PROV and the NIST AI Risk Management Framework offer useful structures for provenance and risk management, but neither turns implementation into epistemic certainty.¹³¹⁴

There is also no universal visual grammar. Emergency control, clinical review, creative work and personal planning have different temporal scales, accountabilities and costs. The preserved relation is not the exact graphic. It is the coupling between a domain change and a perceptible change in viability, uncertainty, lineage or available action. Joint cognitive systems research and national research agendas both point toward evaluating the performance of the whole human-machine arrangement, not treating the person and AI as separable score-producing components.⁴¹⁹

sequenceDiagram
  participant Q as Question
  participant M as Mechanism
  participant E as Evidence
  participant D as Decision
  Q->>M: The answer that hid a cliff
  M->>E: Why a better explanation can preserve the failure
  E-->>M: compare rival explanations
  E->>D: Make the action cliff visible before the proposal
  D-->>Q: revise scope or act

Make the action cliff visible before the proposal

Stop asking whether an AI interface “explains the answer”. Ask whether a qualified person can see what makes the proposed action viable, contestable and recoverable. That changes the design review from a conversation-quality exercise into a control-system test.

Before approving a consequential interface, require the team to demonstrate five things on a configured case:

1. The binding constraints and their margins are visible at the moment of choice.
2. Uncertainty is expressed in the form that changes the action, including missing and stale evidence.
3. Each decision-critical claim has inspectable lineage, applicability and freshness.
4. Available actions are derived from identity and authority, with explicit effects, reversibility and verification.
5. Injected changes to state, policy, permission and model version deform the surface and alter the safe path.

If the team cannot show these behaviours, the interface is not yet a reliable partner in judgement, however fluent the model or elegant the explanation. Begin with the smallest useful implementation: one consequential decision, its three most important constraints, one uncertainty view, claim-level provenance for the binding facts, and a staged action with readback. Test it against an answer-only control.

This criterion also changes procurement and release evidence. A vendor demonstration should not pass because the model produces persuasive rationales on curated cases. Ask the team to connect the interface to a live or faithfully simulated policy boundary, age one source, change one permission and force one effect mismatch. Observe whether the visible route changes and whether the operator can recover without reading an audit log after the event. The evidence of quality is the configured behaviour of the joint system, not a screenshot of an explanation panel.

The practical shift is simple: design the screen around the world’s action structure, then place the AI proposal inside it. The human should not have to excavate the cliff from a paragraph after the model has already pointed downhill.