Agentic AI UX checklist

OWASP's mitigations for excessive agency start with limiting the extensions, functionality and permissions an agent has to the minimum necessary. OWASP LLM06:2025 Excessive Agency

Microsoft's agent principles: an agent's knowledge, tools and connections are transparent and customisable. Microsoft Design: UX design for agents

People should be able to grant read access to a calendar without granting the power to cancel meetings.

OWASP recommends executing actions in the user's context and enforcing authorisation in downstream systems rather than letting the model decide what is allowed. OWASP LLM06:2025 Excessive Agency

A limit turns a runaway mistake into a bounded one.

A plan is where a misunderstanding is cheapest to fix. Microsoft's G10 asks systems to scope their actions when in doubt. Microsoft HAX: Guidelines for Human-AI Interaction

Microsoft's G16: convey the consequences of user actions. Approving a summary of an action is not the same as approving the action. Microsoft HAX: Guidelines for Human-AI Interaction

Microsoft's G10: disambiguate or degrade gracefully when uncertain about the user's goal. Microsoft HAX: Guidelines for Human-AI Interaction

Drafts let people check the agent's work at no cost before trusting it with the real action.

Apple: avoid automating destructive actions and actions that are hard to undo, such as purchases, and ask for confirmation before a significant action on someone's behalf. OWASP lists human approval of high-impact actions as a core mitigation. Apple HIG: Generative AI

If every step asks for confirmation, people stop reading the confirmations. Sort actions by risk and only interrupt for the risky ones.

An approval dialog is only a safeguard if it contains the information needed to say no.

Mistakes that reach other people are harder to undo and more embarrassing than private ones.

Microsoft's agent principles: agent status is clearly visible at all times, and background agents have a user-facing way to view and control their actions. Microsoft Design: UX design for agents

Microsoft's agent principles put people in control of when the agent is on or off. Microsoft Design: UX design for agents

PAIR recommends returning control to people when the AI fails, without making them start again. PAIR: Errors + Graceful Failure

A silent partial success is worse than a reported failure.

Microsoft's G9: make it easy to edit, refine or recover when the AI is wrong. Microsoft HAX: Guidelines for Human-AI Interaction

A send delay turns some irreversible actions into reversible ones for a few seconds.

An agent that changed fifty files should not need fifty undos.

People should never find out an action was permanent after it happened.

Microsoft's agent principles call for a way to view and control actions and automations. Microsoft Design: UX design for agents

Microsoft's G11: make clear why the system did what it did. Microsoft HAX: Guidelines for Human-AI Interaction

Other people deserve to know when they are dealing with an automated action. In the EU, systems that interact directly with people must say they are AI (AI Act Article 50(1)). EU AI Act, Article 50 (EUR-Lex)

Background work people never see is work they can't check.

OWASP describes indirect prompt injection: instructions hidden in external content that alter the model's behaviour. Its mitigations include segregating and identifying external content. OWASP LLM01:2025 Prompt Injection

OWASP lists requiring human approval for high-risk actions as a prompt-injection mitigation. OWASP LLM01:2025 Prompt Injection

OWASP recommends adversarial testing and attack simulations; Apple recommends testing harmful and out-of-scope requests. OWASP LLM01:2025 Prompt Injection