Skip to content

Misuse Resistant Affordance Design

Shape affordances and defaults so the harmful path is unavailable, costly, or unattractive while the legitimate path stays easy.

Draft status

This draft provides direct gap-fill coverage for the accepted prime designed_out_misuse / Designed-Out Misuse. It is intentionally broader than narrow physical poka-yoke, standardization, self-checking, and fail-safe designs, while preserving those as neighbors or implementation variants.

Core use

Use this archetype when the harmful path is currently too easy and the legitimate path can be preserved while the harmful path is removed, gated, delayed, made visible, or routed through a governed exception. Do not use it as a justification for blanket lockout, hidden anti-user friction, or punitive design.

Boundary note

The most important merge boundary is with physical_constraint_design_for_impossibility, standardization_and_simplification, and self_checking_operation. Those accepted archetypes cover narrower child/error-proofing forms. This draft covers the parent-level asymmetric affordance/default pattern named by designed_out_misuse.

Common Mechanisms

  • Constrained Input Control
  • Exception Review Queue
  • Misuse Monitoring Dashboard
  • Permission-Scoped Default
  • Physical Keying or Interlock
  • Point-of-Action Confirmation
  • Progressive Disclosure of Risky Options
  • Rate Limit or Cooling Hold
  • Role-Based Access Control
  • Safe Default Setting

Compression statement

Misuse-Resistant Affordance Design applies when a system relies on users, operators, customers, or adversaries not taking an available harmful path. The intervention changes the action space itself: identify the legitimate path, map the misuse path, compare their relative friction, then remove, gate, delay, expose, or de-reward the misuse path while preserving the legitimate path through proportional exceptions, accessibility checks, and feedback from real workarounds.

Canonical formula: misuse_risk_after_design = f(misuse_path_availability × misuse_path_friction × legitimate_path_preservation × exception_quality × adaptation_feedback)

Abstractions this archetype builds on — directly (a source ingredient) or as a related pattern. Links follow the typed catalog namespace.

Built directly on (9)

Also references 17 related abstractions

  • Absorbing State Under Restricted Modality: A state one can enter but not leave with one's available modality of action.
  • Access Friction: An entry-asymmetric cost paid only by those crossing a membership boundary, shaping who is present rather than who is qualified.
  • Asymmetry: Directed imbalance in a relation whose two sides are not interchangeable under swap.
  • Cognitive Load: Mental effort.
  • Desire Path: An involuntary trace worn into a designed environment's substrate by repeated use, recording revealed preference where the design fails to accommodate it.
  • Deterrence: Preventing an action not by blocking it but by arranging consequences so the target's own cost-benefit calculation makes the action unattractive.
  • Fail-Safe: Default to safe state on failure.
  • Gall's Law: A complex working system is reached only through a connected chain of simpler systems that each worked, never by from-scratch design of the whole.
  • Interface: A bounded, rule-governed surface across which two systems exchange information or control while hiding their internals, letting each evolve independently behind a stable contract.
  • Intervention: Externally fixing a variable's value, severing its normal upstream causes while retaining its downstream effects.

Variants

Narrower or domain-specific specializations that share this archetype's core structure. Recognized variants are established; candidate variants are provisional.

Physical Poka-Yoke Misuse Blocking · mechanism family variant · recognized

A variant where the misuse or error path is blocked by shape, orientation, interlock, fixture, or material incompatibility.

  • Distinct from parent: The parent includes all asymmetric affordance/default moves; this variant covers physical impossibility and physical keying.
  • Use when: The wrong action is physically identifiable; The correct action can remain easy while the wrong action is made impossible or obviously rejected.
  • Typical domains: manufacturing, medical devices, consumer product safety
  • Common mechanisms: physical keying or interlock, constrained input control

Permission-Scoped Misuse Prevention · governance variant · recognized

A variant where risky capabilities are withheld from the default action set and released only through role, context, authorization, or review.

  • Distinct from parent: The parent covers any affordance/default asymmetry; this variant centers capability scoping and authority boundaries.
  • Use when: Risk depends on actor role or context; The same action is legitimate for some actors but dangerous as a default.
  • Typical domains: software platforms, financial controls, enterprise security
  • Common mechanisms: permission scoped default, role based access control, exception review queue

Safe Default Path Biasing · implementation variant · recognized

A variant where the starting state, selected option, or easiest path is safe unless the actor deliberately and legitimately changes it.

  • Distinct from parent: The parent includes path removal and gating; this variant focuses on default-state asymmetry.
  • Use when: Many users accept defaults; The harmful path depends on permissive initial settings or unchecked continuation.
  • Typical domains: privacy settings, medical ordering, consumer finance
  • Common mechanisms: safe default setting, progressive disclosure of risky options

Near names: Designed-Out Misuse, Misuse-Resistant Design, Abuse-Resistant Interface Design, Poka-Yoke, Mistake Proofing, Error Proofing.