Good protection fades into the task. Bad protection keeps pulling you out of it.
Concept of the week · Good Mitigations Respect the Task
Safety controls should reduce risk without repeatedly disrupting normal work. Under pressure, the wrong safeguard shifts work into extra unlocks, repeat actions, and recovery steps.
So we judge a mitigation not only by what it prevents, but by the workload it adds.
While designing a transport monitor with a capacitive touchscreen, we identified the risk that fluid on the display could cause accidental touches. To address this, we implemented an automatic screen lock with a two-step unlock process. On paper, this solution seemed to lessen the hazard.
In practice, the lock could also activate during normal handling, such as when someone grasps the device and accidentally touches the screen. This meant nurses had to stop, unlock, reorient, and continue while already moving a patient and managing competing demands. The control reduced one risk but also added extra steps to the routine case.
A calmer approach would involve detecting likely spill conditions more robustly, temporarily blocking unintended touches, and keeping recovery simple — for example, using a one-step unlock instead of a full lock-and-recover sequence.
Every added safeguard multiplies trigger conditions, recovery steps, and verification burden.
The same pattern shows up in software. A security measure may be fully justified and still become disruptive if it activates too often during normal work, such as repeated multi-factor authentication (MFA) prompts, short session timeouts, or confirmation layers in the middle of an active task. Protection helps only when it does not keep forcing people to recover their place.
A practical design cue: test safeguards early in realistic conditions and measure not only hazard reduction, but also trigger frequency, recovery effort, and interruption cost.
Asset & resource
Asset: Mitigation Load Check.
Before shipping a safeguard, ask:
What exact risk does this control reduce?
How often could it trigger during normal use?
What extra steps does recovery require?
Can users recover quickly with one hand, divided attention, or time pressure?
Is there a lighter control that still keeps risk acceptable?
Resource: Richard I. Cook’s How Complex Systems Fail
A useful reminder that safety is shaped in practice, not only through formal controls. It helps explain why a mitigation can look correct in analysis and still create friction, workarounds, or new failure paths in practice.
Light wisdom & reflection
“Change introduces new forms of failure.”
What problem have you solved lately that may have quietly created a new point of failure?
Mindful practice
Think of a moment recently when a precaution made you pause.
Not at work only — anywhere.
Notice what happened in your body first: tension, hesitation, double-checking, stopping.
Then ask: what would have helped you feel protected and still able to continue?
Best,
Andreas Walden
Share this with someone designing for clarity.