Traditional software is deterministic: the button does the thing, every time. AI products broke that contract. The same prompt can produce brilliance or nonsense, and the interface has to carry that uncertainty without terrifying the user. After two years of designing AI-native surfaces, we think trust comes from three materials: streaming states, confidence signals and graceful failure.
Streaming is a design material
A response that streams feels alive; a spinner feels like a slot machine. But raw token streams have their own problems — text reflowing under the cursor, layouts jumping as code blocks form. The fixes are mundane and they matter: reserve vertical space before content arrives, commit markdown blocks atomically instead of character-by-character, and keep the scroll anchored to the user's reading position, not the bottom of the stream.
The most underrated streaming pattern is the thinking preamble: a short status line — "reading 4 files", "checking your calendar" — that fills the gap before the first token. It converts dead air into evidence that something purposeful is happening.
Confidence, made visible
Models are confidently wrong; interfaces shouldn't be. The goal isn't to display raw probabilities — users can't act on "0.73" — it's to change posture when the system is unsure.
- Cite or qualify: answers grounded in retrieved documents show their sources inline; ungrounded answers say so in words, not decimals.
- Hedge structurally: when confidence is low, offer two interpretations side by side instead of one authoritative wrong one.
- Make verification cheap:one-click "show the query it ran", "jump to the source paragraph". Trust is built by auditability, not assertion.
The honest AI interface isn't the one that's always right. It's the one that never pretends to be more certain than it is.
Failure is a first-class state
Every AI product fails: refusals, timeouts, hallucinated tool arguments, rate limits. Design for these the way you design the happy path. A refusal should explain whichpolicy applied and offer a compliant rephrase. A timeout should preserve the user's prompt and retry with one tap. A low-quality generation should make "regenerate with changes" feel like a natural next step rather than an admission of defeat.
We keep a "failure inventory" for every surface — a list of every way the model can disappoint, each mapped to a designed response. It's the single highest-leverage document our design team owns.
The trust ledger
Users keep an unconscious ledger: every kept promise adds a point, every silent failure removes five. Streaming honestly, signaling confidence and failing gracefully are how AI products stay in credit. Capability gets people to try your product — the ledger decides whether they stay.