Defensive Design (Designing for Misuse)

Defensive design addresses credible error and misuse through prevention, limitation, detection, or recovery. It does not assume that every user action is wrong or that every possible failure can be anticipated.

Defensive design anticipates credible mistakes, unexpected conditions, and intentional misuse so that failures are prevented, limited, or recoverable. Start with a concrete failure path rather than the assumption that people will do everything wrong. Mistaken input, misunderstood instructions, and hostile activity can require different controls and should not be collapsed into one user stereotype.

Match the protection to likelihood, consequence, and practical cost. A reversible action may benefit from undo; a consequential irreversible action may need a clear preview or additional check. Repeated generic warnings can become noise. Test whether the protection blocks the intended failure and whether it creates new barriers, including for legitimate users with different abilities or circumstances.

When to use it

When designing any system that humans will interact with; when post-mortems reveal that failures resulted from foreseeable misuse; when the cost of misuse is high relative to the cost of defensive measures; when expanding a system to a larger, more diverse, or less trained user base.

How it can help

Identify a specific failure path, choose a proportionate control, and test both the failure case and legitimate use. Avoid adding approvals or warnings without a demonstrated purpose.