Approval gates are binary — either pause or do not. Real risk is continuous: a one-cent transaction and a $50,000 transfer cannot need the same number of clicks, but most systems give them either both no friction or both the same friction.
← Back to patterns
Intelligent AI Delegation Cognitive Agency Surrender: Defending Epistemic Sovereignty via Scaffolded AI Friction Computer Use · Claude 3.5 Sonnet
Agent Workflow
EmergingCognitive Friction
Adaptive speed bumps — seamless for low stakes, mandatory pause for high uncertainty
Approval gates are binary: pause or do not. Cognitive Friction is a continuous axis baked into the flow itself. The system reads task stakes — criticality × uncertainty × reversibility — and inserts proportional friction: a one-second confirm for low stakes, a written rationale for high uncertainty, a 5-second cool-down + secondary signer for irreversible high-criticality steps. Builds on the aviation principle that pilots need different attention budgets for different actions, and the medicine principle that surgeons get mandatory checklists before incisions but not before pre-op chart review. From Google DeepMind's "Intelligent AI Delegation" (Tomašev, Franklin & Osindero, Feb 2026): "friction must be context-aware: the system should allow seamless execution for tasks with low criticality or low uncertainty, but dynamically increase cognitive load."
Metaphor
Adaptive Speed Bump
Interaction
Variable Mandatory Step, Context-Aware Intensity
Use case
High-Stakes Decisions, Long Delegation Chains, Avoiding Rubber-Stamp Approval
Failure mode
Binary Friction
Control mechanisms
Stakes Detector · Friction Intensity Dial · Mandatory Justification Field · Cool-down Timer
Reference examples
Apple Authentication Required (tiered) · GitHub Branch Protection Rules · Stripe Strong Customer Authentication · Anthropic Claude Code permission prompts
Concept Frame
Friction is not a binary. It is a dial.
Approval gates ask the same question for a $1 confirmation and a $10,000 transfer. Friction calibrated to stakes is older than computing — surgeons get checklists before incisions but not before pre-op chart reviews, pilots get takeoff briefings but not before taxi. The Google DeepMind Intelligent Delegation framework (Feb 2026) calls this dynamic cognitive friction: seamless execution for low criticality, dynamically increased cognitive load when uncertainty rises. A binary pause is the wrong shape; a dial is the right one.
Interactive Example
The live side-by-side is the comparison.
This prototype already contains the contrast between the status-quo approach and the pattern response. The left column names the failure mode of the naive baseline (fixed dispatch, label-as-done, hidden hierarchy, uniform friction); the right column is the move.
Risk is a dial. Most gates are a switch.
A one-cent transaction and a $50,000 transfer arrive at the same binary checkpoint: either both pause, or neither does. Real risk is continuous, but the gate forces it into two positions, so teams tune for the common case and rubber-stamp the dangerous one. Under deadline pressure, the self-discipline this leans on fails predictably.
Cognitive Friction reads stakes as criticality times uncertainty times reversibility, then inserts friction in proportion: a one-second confirm for low stakes, a written justification for high uncertainty, a cool-down plus secondary signer for the irreversible. Because the policy is inspectable and configurable per workspace, friction stays calibrated to load instead of decaying into alarm fatigue.
Friction spent everywhere is friction nobody feels — calibrate it, and the rare high-stakes pause regains its weight.
DOPE Lens
How this pattern improves AI interaction quality.
Observability
The applied friction level is named back to the user along with the stakes inputs that triggered it ("high criticality + low reversibility → mandatory justification")
Directability
Users can override friction with explicit acknowledgement; system records the override for later audit
Predictability
Stakes inputs map deterministically to friction intensity — users learn what a "5-second cool-down" means and trust it
Explainability
The friction policy itself is inspectable as a rule set — what stakes produce what friction, configurable per workspace
Fit
Where it earns its place.
Use it
when
when
Binary approval gates either over- or under-prompt the user for every action. Context-aware friction scales the pause to the actual stakes — flow when it is safe, structured deliberation when it is not.
Avoid
when
when
All actions in the surface have approximately equal stakes (a sandbox, a draft-only tool) — a fixed friction level is simpler and just as safe.
In the wild
Where this pattern already ships.
The pattern is shipping but still maturing across products. Entries below show how different teams have approached it; expect variation as the space settles.
Apple · Authentication Required (tiered)
Apple
iOS/macOS prompts scale by sensitivity: silent for app-launch, Touch ID for low-stakes purchases, Face ID + 6-digit passcode for App Store, full passcode after restart. The same OS-level pattern, applied to four different stakes tiers.
Visit Apple ↗
GitHub · Branch Protection Rules
GitHub
Different branches get different friction: main requires reviews + status checks + linear history; feature branches require nothing. Friction proportional to blast radius, configured as policy.
Visit GitHub ↗
Stripe · Strong Customer Authentication
Stripe
Low-value contactless transactions waved through; high-value or unusual transactions trigger 3D Secure step-up. PSD2 codified the principle: friction calibrated to risk score, not flat per transaction.
Visit Stripe ↗
Anthropic · Claude Code permission prompts
Anthropic
Claude Code gates destructive actions (rm -rf, force-push, git reset --hard) behind confirmation prompts while reversible edits flow freely — stakes-aware friction shipped in a mainstream agent, with the override itself an explicit, logged choice.
Visit Anthropic ↗
Cognitive Agency Surrender: Defending Epistemic Sovereignty via Scaffolded AI Friction
Academic source · Xu, Shen, Yan, Ren (Cyberspace Security University of China, Mar 2026)
Independent argument for *scaffolded* friction — designed to preserve user epistemic agency, not just gate dangerous actions. Same pattern, different load-bearing rationale (cognitive sovereignty over operational safety). Useful counter-frame.
Visit Academic source · Xu, Shen, Yan, Ren (Cyberspace Security University of China, Mar 2026) ↗
Research Frame
Why this pattern exists, and where it breaks.
Read task stakes (criticality × uncertainty × reversibility) and insert proportional friction: no friction for low stakes, a one-line confirm for medium, a written justification for high uncertainty, a cool-down + secondary signer for irreversible high-criticality. The friction policy is inspectable, configurable per workspace.
Chat treats every turn as the same kind of action — there is no signal-carrying surface for "this one is more dangerous than the last one." Users rely on prose disclaimers and self-discipline, which fail predictably under deadline pressure.
Without context-awareness, friction degenerates into alarm fatigue — too many high-friction prompts train users to click through them. Conversely, too little friction on critical actions enables rubber-stamping.
Common questions
What people ask about this pattern.
When should I use the Cognitive Friction pattern?
+
Binary approval gates either over- or under-prompt the user for every action. Context-aware friction scales the pause to the actual stakes — flow when it is safe, structured deliberation when it is not.
When should I avoid the Cognitive Friction pattern?
+
All actions in the surface have approximately equal stakes (a sandbox, a draft-only tool) — a fixed friction level is simpler and just as safe.
What problem does Cognitive Friction solve?
+
Approval gates are binary — either pause or do not. Real risk is continuous: a one-cent transaction and a $50,000 transfer cannot need the same number of clicks, but most systems give them either both no friction or both the same friction.
Why is chat the wrong fit for this?
+
Chat treats every turn as the same kind of action — there is no signal-carrying surface for "this one is more dangerous than the last one." Users rely on prose disclaimers and self-discipline, which fail predictably under deadline pressure.
Grounded in Research
Not just opinion.
The papers, guidelines, and usability studies this pattern rests on.
Nenad Tomašev, Matija Franklin, Simon Osindero
Google DeepMind · 2026
Framework for safe and scalable delegation: cognitive friction, authority gradient, verifiable completion, and task-bid markets as the missing UX layer for cross-org agent work.
Kuangzhe Xu, Yu Shen, Longjie Yan, Yinghui Ren
Cyberspace Security University of China · 2026
Independent argument for *scaffolded* friction designed to preserve epistemic sovereignty — same primitive as Cognitive Friction with a different load-bearing rationale (cognitive agency over operational safety).
Anthropic
Anthropic · product announcement + research note · 2024
First production model trained to operate a computer interface directly. Turns every UI question (preview, audit, gates, friction) into a concrete shipping setting and provides the destructive-action-confirmation primitive several patterns build on.
Related Patterns
Curated connections, not just neighbors.
Hand-picked relationships — what this pattern pairs with in practice, what it replaces, what it builds on, and what builds on it.
Often paired with
Autonomy Dial
Autonomy Dial decides per tool what runs unasked; Cognitive Friction decides how hard to slow each action, by its stakes.
Often paired with
Capability Boundary
Capability Boundary says up front what the system can't do reliably; Cognitive Friction slows the risky steps it can do.
Alternative to
Approval Gates
Approval Gates give every checkpoint the same hard pause; Cognitive Friction scales the friction to each action's stakes.