Enterprise UX in the Age of AI, Part 5: Audit Trails and Undo Buttons
Part five of a series of a series on designing the tools behind the business. This time: Invisible Compliance and Mistake Recovery.
Principle 9: Invisible Compliance
Enterprise software lives under rules: GDPR, HIPAA, financial audit requirements, data retention policies, role-based permissions. The lazy response is to bolt compliance on at the end, and users feel it immediately: the extra login, the blocking dialog, the form that exists for the auditor rather than the person filling it in.
The better response is to design it in from the start so it disappears. Single sign-on instead of password theatre. Masked fields that reveal on demand for the roles allowed to see them. Logging that happens silently and completely. The best compliance UX is the kind users never notice, because the system handles it and never asks them to.
The AI twist
“Who did this, and why?” used to have a simple answer: a named person on a date. Now the honest answer might be: an agent, acting on a briefing, based on what a model inferred from a screen. The audit trail has to grow to hold that. Which model, which version, what it was shown, what it was asked, and what it decided. Explainability is stopping being a research topic and becoming an audit artifact.
Data boundaries need the same attention. Every prompt is a data flow. What leaves your boundary when a user pastes a record into an assistant? What does the provider retain? Who inside your organisation can read the prompt history, which is quietly becoming a record of everything sensitive your staff ever asked?
Regulation is arriving faster than most roadmaps assume; the EU AI Act is already phasing in. The practical advice hasn’t changed since GDPR: build the log before you need it. Retrofitting an audit trail after the incident is the most expensive way to get one.
Principle 10: Mistake Recovery
Mistakes in enterprise software are expensive, and the people making them are human, tired and mid-shift. Great design attacks both halves: make errors harder to commit, and cheaper to survive.
Prevention is validation at the moment of entry, required fields that explain themselves, and friction placed deliberately in front of destructive actions. Recovery is autosave, drafts that survive a crash, undo, and version history. Google Docs and Git set the standard: work is never lost, and almost nothing is final. Users who trust the safety net work faster on the wire.
The AI twist
The most important button in agentic software is undo, and it’s the hardest one to build.
When a person makes a mistake, they usually know the moment it happens. When an agent takes ten actions across three systems and one of them was wrong, someone has to discover that, understand it, and unwind it, without breaking the nine actions that were right. Recovery stops being a button and becomes an architecture: every agent action logged, grouped, inspectable and reversible as a unit.
The design patterns are emerging. Dry-run modes that show what would happen before it does. Staged changes a person approves before they commit, with the approval fast to give, as part two argued about review. Blast-radius limits so an agent can touch drafts but not payments. And a bias, wherever possible, toward reversible paths: an agent should prefer the recoverable action the way a careful colleague does.
Part one said users need the confidence to explore. That now extends to their agents. Delegation without recovery isn’t trust; it’s gambling.
Where This Series Goes Next
The final pair, Power-User Personalisation and Measure What Matters, closes the loop: what happens when users start building their own automations, and how to measure whether any of this AI actually made work better.
Patrick Mooney is a senior design leader based in Ireland, with more than 25 years’ experience in UX, product and enterprise software, and the founder of Dublin UX. He writes at patrickmooney.me..