Trust Signals

Trust signals are the review surfaces that sit between an agent taking action and that action landing in production. The agent acts. The signal appears. The human inspects the exact changes in context then approves rejects or edits before the state commits. This is layer five in the dual user stack from the Designing for Agents Watching article. Everything below it (tool surfaces, selector stability, machine readable structure, status legibility) exists to feed a clean trust signal. Without it users enable the agent once watch it quietly break something important and never flip the switch again. In 2026 where Cursor calls buttons and Anthropic Computer Use clicks forms the trust signal is not optional. It is the insurance policy that keeps the human plane in charge while the machine plane moves at lightspeed.

Trust signals are not confirmation modals before the agent starts. They are not success toasts or color only states or activity log entries. Those assume trust already exists. A real trust signal builds trust by exposing the work in a format both humans and downstream agents can parse. It is not decoration added at the end of a project to make stakeholders feel safe. It is load bearing architecture. Skip it and the product ships half finished no matter how polished the human plane looks. The article calls out the exact failure modes. Success conveyed by a green flash is invisible to the agent. A hover only edit button does not exist for an agent that does not hover. An unlabeled svg close icon forces the agent to guess. Any pattern that relies on a human eye or pointer alone breaks the machine plane and erodes trust the first time something goes sideways.

Cursor delivered the canonical concrete example in 2025. Tell the agent to refactor authentication. It returns to an inline diff view with every changed line highlighted in its original file context. Red for deletions. Green for additions. Each chunk carries its own approve and reject buttons plus a one sentence explanation. Approve the security update but reject the unrelated styling tweak and the agent iterates only on the rejected chunk without touching the approved code. No full rollback. No blind commit. Claude artifacts use the same idea in a different shape. The agent generates a component or mockup and drops it into a dedicated preview pane with live rendering, source code tab, and explicit accept iterate or discard actions. The artifact carries a stable URL and structured JSON so the next agent can consume it without rereading screenshots. GitHub Copilot Workspace adds the plan first discipline. The agent must output a numbered list of intended changes in plain English before it touches any file. That plan appears in a split pane next to the code outline. Edit the plan in writing strike through risky steps add constraints and the agent updates before execution. Replit Agent renders its work as a live editable workspace where every modification is flagged with one click revert. Vercel v0 renders the generated UI immediately in the browser so the human can click around test interactions and request changes through natural language before any code is pulled. Anthropic Computer Use closes the loop with screenshots plus explicit confirmation dialogs that capture the full visual state before the agent continues. Each product ships a different shape of the same four step flow. Agent acts. Diff shown. Human approves. State committed. These are not features. They are the minimum viable contract for letting agents touch important work.

Deploy trust signals on any surface where the agent mutates data writes code spends money or deletes anything a user might regret. Match the weight of the signal to the risk. Double gate credit card charges or customer record wipes. Single gate reversible code deploys with one click undo available. The dual user audit demands a visible diff and human in the loop on every agent driven change. Linear and Stripe prove the upstream payoff. Their API first named action discipline makes trust signals easy to build because the foundation already exists. Use lighter signals for read only research. An agent summarizing a dashboard does not need chunk level approval. Overapply heavy signals to trivial tasks and users develop click through fatigue. Underapply them and one wrong move kills the feature forever. The anti patterns are clear. Div soup breaks selectors. Hidden hover affordances are invisible. Click here links give the agent nothing to distinguish. Color only states communicate nothing to the machine plane. Unlabeled modals force the agent to guess at next steps. Fix those first then layer the trust signal on top.

Trust signals turn agents from flashy demos into tools people actually let loose on their most important work.