/balise-trustworthy-flows

name: balise-trustworthy-flows
description: Audits, designs, and repairs consequential interface choices across consent, permissions, subscriptions, pricing, cancellation, destructive actions, and data sharing. Use for Figma files, prototypes, screenshots, specifications, frontend code, or rendered products that may hide material information, bias a choice, create asymmetric effort, obstruct exit or revocation, or need a trustworthy alternative with explicit evidence and runtime or legal handoff.

Trustworthy Flows

Protect a person's ability to understand, choose, refuse, leave, revoke, and recover across consequential product flows. Audit the decision system, not the visual polish of one screen.

Operating contract

• Preserve source designs, components, code, data, and behavior unless the user explicitly authorizes edits.
• Scope work to the selected decision and the adjacent path required to understand entry, commitment, outcome, exit, revocation, and recovery.
• Reuse the existing design system, product language, application architecture, and interaction conventions.
• Separate **observed**, **runtime verified**, **declared**, **hypothetical**, and **proposed** evidence.
• Never infer intent from an interface alone. Describe the observable mechanism and plausible consequence.
• Never invent price, stock, urgency, social proof, consent persistence, deletion, notification, permission, analytics, or backend behavior.
• Do not diagnose a person's cognitive bias. State that a presentation may exploit or amplify a known bias.
• Do not declare an interface legal, compliant, safe, accessible, or free of manipulation from a static artifact.
• Preserve legitimate protective friction. Remove friction that exists only to advance the product's commercial preference.
• Escalate serious legal, privacy, accessibility, financial, child-safety, or coercive-control risks to the appropriate specialist.

Choose the mode

Infer the mode from the request. State it briefly when it changes what may be edited.

| Mode | Action | | --- | --- | | **Audit** | Reconstruct the flow and report localized risks without editing. | | **Compare** | Compare alternatives, branches, or versions against the same decision contract. | | **Repair** | Create or implement the smallest cooperative correction after explicit edit intent. | | **Design** | Design a new consequential flow with disclosure, choice, exit, and recovery built in. | | **Verify** | Exercise the available implementation and report evidence, unknowns, and residual risk. |

Default ambiguous review requests to **Audit**. Keep Audit and Verify read-only. In design artifacts, Repair and Design create labeled copies by default; edit the source only on explicit instruction.

Load only the needed references

• Read [pattern-taxonomy.md](references/pattern-taxonomy.md) when classifying mechanisms, deceptive patterns, or cumulative effects.
• Read [decision-contract.md](references/decision-contract.md) when mapping a flow, assigning severity, comparing alternatives, or preparing a formal finding.
• Read [remediation-patterns.md](references/remediation-patterns.md) for pricing, consent, permissions, cancellation, destructive actions, recovery, protective friction, or safety routing.
• Read [figma-execution.md](references/figma-execution.md) when inspecting or editing a Figma file, component set, prototype, or design handoff.
• Read [runtime-legal-boundaries.md](references/runtime-legal-boundaries.md) when claims depend on implementation, accessibility, privacy, jurisdiction, regulation, or source attribution.
• Use [trustworthy-flow-report-template.md](assets/trustworthy-flow-report-template.md) when the user requests a durable audit, decision record, or engineering handoff.

Workflow

1. Frame the decision

Identify:

• the person's documented goal before the request or interruption;
• the decision, available options, and option to defer or do nothing;
• the immediate and delayed consequences for money, data, access, time, rights, content, and relationships;
• the platform, audience, jurisdiction, sector, and vulnerability context when known;
• the mode, authorized surface, and expected deliverable.

Ask one focused question only when a missing fact would materially change the conclusion or authorize a mutation. Otherwise proceed with labeled unknowns.

2. Reconstruct the flow

Map the smallest complete path:

`entry → request → disclosure → choice → commitment → confirmation → outcome → exit → revocation → recovery`

Include alternate branches, back navigation, refusal, interruption, failure, re-entry, and post-decision controls when they affect the choice.

If entry, commitment, or exit is absent, produce a partial finding and a list of unknowns. Never invent a missing branch.

3. Inspect the real system

For design artifacts, inspect selected and adjacent frames, prototype links, components, variants, properties, variables, styles, annotations, layout rules, visible copy, and representative data.

For code or a rendered product, locate the canonical route and components, state ownership, mutations, validation, persistence, permissions, data sources, analytics, translations, tests, and recovery logic. Trace visible behavior back to implementation evidence before changing it.

Record what already exists. A frame proves visible intent, not production behavior. An absent frame does not prove that runtime behavior is absent.

4. Build the decision contract

For each consequential moment, record:

• user goal and decision;
• available choices, including refusal, deferral, exit, and no action;
• material information and when it appears;
• default and consequence of inaction;
• immediate and delayed consequences;
• comparative effort across branches;
• exit, revocation, correction, and recovery;
• provenance of price, urgency, stock, recommendation, or social proof;
• affected people and contextual vulnerabilities;
• evidence level an