When should an action be undoable instead of guarded by a confirmation?

Reach for undo whenever the action can be reversed and you care about keeping the flow fast, and save confirmation for the truly irreversible or dangerous. The deciding question is simple: can the user recover after the fact? If yes, let them act first and recover later, because undo keeps momentum while still catching mistakes. If no, the only protection left is to stop them before they commit, which is what a confirmation is for. The default should lean toward undo, with confirmation held in reserve for the cases where there is nothing to undo to.

The reasoning is that confirmation and undo solve the same problem, the accidental action, but they spend the user’s time very differently. A confirmation pays its cost up front, on every action, including the overwhelming majority that were intentional, by stopping the person to ask whether they meant it. Undo pays nothing up front and charges only the rare user who actually erred, by offering a quick way back. So for any reversible action, undo is the better trade: it protects against the same mistake without taxing the people who made no mistake at all, and it lets the interface stay quick and fluid instead of nagging. Confirmation only becomes the better pattern when there is no “after the fact” to recover in, when the action genuinely cannot be reversed, and the single moment before commitment is the last chance to prevent harm. The “always confirm before any change” habit ignores this, interrupting flow constantly to guard against errors that undo would have caught more gracefully.

Think of archiving an email versus permanently deleting every message in an account. Archiving should never throw a dialog. The user swipes or clicks, the message moves, and a small “Undo” appears for a few seconds, so flow stays instant and the rare misfire is one tap from recovery. Permanently wiping an account, by contrast, has no undo to offer, because the data is gone, so here a confirmation, even a typed acknowledgment, is exactly right, since stopping the user beforehand is the only protection that exists. Same family of action, opposite pattern, and the only thing that decides it is whether recovery is possible afterward.

One case sits outside this: undo only substitutes for confirmation when the recovery is real, immediate, and obvious to the user. An action that is technically reversible but only through a buried, slow, or unknown path does not feel undoable in the moment, so it cannot carry the same trust as a clear “Undo” sitting right where the action happened. There is also a window question: undo that vanishes before the user notices their mistake, or that cannot reach an effect that has already propagated outward, has quietly stopped being a safety net. Prefer undo, but only count it as protection when it is fast, visible, and within the user’s reach.

When you design an action, ask first whether it can be reversed and how easily the user can get back. If recovery is genuine and quick, skip the dialog and ship a clear, immediate undo so the flow stays fast and mistakes stay cheap. If the action is truly irreversible or dangerous, drop undo and require a deliberate confirmation, because that moment is the only guard you have. Default to undo, reserve confirmation for the unrecoverable, and stop interrupting people for changes they can simply take back.