# Low-Trust-By-Default UX Absorbs Agent Mistakes ## Claim When a system's users can include autonomous agents alongside humans, defaults should assume careless or hostile input and make destructive or irreversible actions structurally harder to reach than reversible ones. <!-- atomicity: 1 idea ✓ --> ## Scope & conditions - Holds when an interface exposes actions with asymmetric cost (delete vs. trash, publish vs. draft) to any actor whose judgment can't be fully verified in advance — human or agent. - Breaks when the friction added to the "hard" path meaningfully blocks the legitimate, common case — WordPress's own double-confirm publish flow was cited on the source panel as already borderline annoying pre-AI, so the asymmetry has a real usability cost that has to be weighed, not assumed free. - Doesn't argue for maximal friction everywhere — only for friction sized to the actual asymmetry in consequence between the reversible and irreversible paths. ## Evidence Matt Mullenweg's "defensive data design" proposal for WordPress core lays out UI defaults for a world where AI agents, not just people, act inside wp-admin: trash easy / permanent delete hard, drafting easy / publishing hard, changes reversible and visible, treat all input (not just user input) as potentially hostile rather than merely unreliable. A WP Builds panel discussing the post initially read it as a break from WordPress's "democratize publishing" default-trust posture, then reframed it as ordinary risk-management practice extended to a new kind of actor — you'd build the same guardrails around any human whose judgment you couldn't fully verify in advance. > "Proposing a draft should be easy. Publishing to the world should be hard." ## Links - [[3. Resources/Permanent Notes/Early Observability Hooks Trade Completeness for Exposure Risk]] — because applies-in: both are examples of a system choosing an explicit tradeoff (coverage vs. exposure; ease vs. safety) at a boundary an autonomous actor can cross, rather than pretending the boundary is free. - [[3. Resources/Permanent Notes/A Privileged Setup Flow Needs Explicit Consent at Every Trust-Boundary Crossing]] — because extends: that note argues consent must be explicit at each boundary crossing; this note argues the *cost* of crossing destructive boundaries should also be asymmetric, as a second layer of the same defense. - [[3. Resources/MOCs/AI Agent Safety MOC]] — because applies-in: a concrete design checklist for any plugin or feature exposing publish/delete actions to automated agents. - [[3. Resources/Permanent Notes/An Upgrade Review Diffs the Defaults Not the API]] — contrasts: a release that moved six defaults toward higher trust in the same version that added real safety engineering, showing trust posture and security work can diverge inside one release. ## Tests / falsifiers - Ticket/report analysis of accidental-deletion and unintended-publish incidents in WordPress installs with agent integrations, before and after any core adoption of defensive-design defaults. - If added friction on the "hard" path measurably increases legitimate-user abandonment without a corresponding drop in accidental destructive actions, that would weaken the claim that the asymmetry is worth its usability cost. ## Maintenance - Last tended: 2026-08-16 - Next review: 2026-11-16 ## Source - [[3. Resources/Readwise/Articles/'Blame Nathan Subscription Service' - This Week in WordPress 383]] — WP Builds panel discussing Matt Mullenweg's make.wordpress.org "defensive data design" post.