Every company building agentic AI products says "trust." Launch posts, product pages, keynote decks. Trust, transparency, human oversight, control. The vocabulary has converged so completely that it functions like "design-led" on a careers page: everyone claims it, almost nobody ships it, and the ones who do ship it don't need to say it.
What tells you something is the interface.
I evaluated eight shipped agentic products: OpenAI Work and its cloud browser, GitHub Copilot Code Review, Cursor agent mode, Perplexity Computer (including Scheduled Tasks, Brain, and sub-agent features), NotebookLM, Gemini Deep Research, Replit, and Sierra Horizon. I was reading for one thing. Where the design decisions in the actual product match the philosophy in the blog post. Where they don't. Eight patterns emerged. Some products ship most of them. Some ship almost none. The gap between said and shipped is the most honest signal we have about where agentic design actually stands.
Intent Architecture. Before an agent acts, does the user get to shape what it does and confirm the agent understood? This is the surface that separates useful agents from expensive autocomplete. It sets the ceiling for every trust interaction that follows. Gemini Deep Research ships a real version: it generates a research plan, lets you edit it, waits for approval before executing. The API-level implementation goes further, supporting multi-turn collaborative planning where developers review, modify, or approve through iterative interactions before execution begins. Cursor takes a different path with explicit context attachment: you pin the files and context the agent should use, constraining scope before it runs. Both work because they make intent a structured input. Perplexity Computer's Scheduled Tasks propose a schedule for user confirmation before running, which is intent architecture applied to recurring work. If your agent accepts only natural language and then guesses what you meant, you skipped the surface that matters most.
Progressive Trust. The difference between a dial and a switch. Good implementations give you granularity. Bad ones give you a binary: delegate or don't. GitHub Copilot Code Review added severity labels on every AI-generated comment: High, Medium, Low. Small surface, large effect. It tells the reviewer where to spend attention and implicitly communicates the agent's own confidence gradient. It also groups similar comments to reduce noise on large PRs. NotebookLM offers a quieter version: source checkboxes let you include or exclude specific sources from any answer, so you can start narrow and widen scope as you build confidence in the agent's handling of your material. Replit's checkpoints function similarly. Verify a small result, then expand. Cursor's agent mode offers no equivalent. You grant access and hope. The products building progressive trust give you granularity, and granularity is what makes delegation feel like a decision rather than a leap.
Human Gate Design. Gate placement reveals what the product team actually believes about irreversibility. A gate at the wrong moment is theater. A gate at the point where the action becomes hard to undo is architecture. OpenAI's cloud browser pauses for confirmation and cannot sign in to websites or complete payments, surfacing screenshots and confirmation details for review. The actions the agent cannot undo are the actions it cannot take alone. Sierra's Horizon defines goals and guardrails where customers specify what the agent can do autonomously and where human sign-off is required. The language on the product page is precise. But I could not find a documented walkthrough of the actual operator interface during a live multi-day agent run. I cannot confirm from public sources whether the shipped surface matches the marketing surface. Cursor's agent mode lacks documented gate surfaces beyond the initial context-pinning step. The principle holds: place your gates where consequences become irreversible, and surface enough context at the gate that the human can actually make the decision rather than rubber-stamp it.
Visibility Over Opacity. Can you see what the agent is doing while it works, or do you get a loading state and a result? This is where the said-vs-shipped gap is widest across the entire set. Opacity is the default because it is cheaper to build. Visibility requires the product team to decide what the user needs to see, when, and at what resolution. Most teams defer that decision indefinitely. GitHub's cloud agent posts live session logs in the PR timeline. You can watch. Replit's checkpoint system gives you a timeline of agent states you can inspect and roll back to. These are real visibility surfaces. Gemini Deep Research splits in a way that tells you where Google's priorities actually sit. The consumer product lets you edit the plan, then runs in the background and notifies you when the report is ready. The enterprise version streams the topics being researched as it progresses. Same product, two tiers, visibility behind the paywall. They made a values decision and shipped it. OpenAI Work claims users can follow progress and change direction mid-task, but the documentation does not define what the progress surface actually looks like. If your agent works in the background, the visibility surface is the product. Build it first.
Attribution and Provenance. Attribution is what separates an answer from a claim. Without it, the user must either trust the output entirely or verify it from scratch. Both responses degrade the system's value over time. NotebookLM is the cleanest implementation in this set. Inline citations appear in every response. Hover to see the full quoted text. Click to navigate to the source location in context. The system answers only from your uploaded sources, and when a request falls outside that boundary, it refuses rather than fabricating. That refusal is the design choice most products will not make because it feels like failure. It is the highest-trust behavior an agent can exhibit. Perplexity Computer's Brain links memory entries back to their source conversations, letting users check or correct what the agent remembers. Gemini Deep Research's completed reports include citations, but the consumer version delivers them in a final Google Doc rather than surfacing provenance during the research process. Design the attribution into the output, not into the appendix.
Loop Feedback and Drift. Most agentic products treat every session as stateless. That works for one-shot tasks and fails for everything else. The ones handling real workflows need surfaces that make behavioral change visible before it compounds. Perplexity's Scheduled Tasks show run history, past results, and a "Needs attention" state when instructions are unclear. Its Brain feature stores memory entries linked back to their source, and users can check or correct them. These are early versions of drift monitoring. Sierra Horizon's multi-day agent runs spanning "weeks or months" make drift a structural inevitability, and their control section promises auditing and analysis. The actual drift-detection surface remains undocumented. NotebookLM sidesteps the problem entirely by grounding every response in static uploaded sources, which eliminates drift but also eliminates learning. If your agent runs more than once, treat drift monitoring as a safety surface. Build it accordingly.
Agent Correction UX. Correction cost determines the trust ceiling. If fixing an error takes longer than doing the work manually, users will restrict the agent to tasks where errors don't matter. Which means the agent never touches consequential work. Replit's checkpoints are the strongest correction surface in this set. Roll back to any prior state. Inspect what changed. Resume from a known-good point. GitHub's "Fix with Copilot" creates a draft comment where you instruct the agent to address specific feedback, then choose whether it commits to the same PR or creates a new one. Both treat correction as a first-class interaction. Perplexity Computer's correction story is weaker: no pause state exists for scheduled tasks. Stop a task and you rebuild it from scratch. Cursor's agent mode provides no documented rollback surface. The cost of fixing an error is the single best predictor of whether someone will trust the agent with consequential work.
Dual Audience Coherence. This is the hardest pattern in the set because it requires the product to maintain coherent state representations for audiences with different information needs, different permissions, and different interaction timelines. Sierra Horizon's product page shows a healthcare scenario where an agent coordinates across patient, provider, and payer over days, with channel labels, dialogue threads, and a timeline of actions. The control section promises that customers can understand what triggered every engagement, what the agent decided, and why. The timeline visualization suggests the team understands the problem. Whether the shipped operator UI delivers on that understanding remains unconfirmed from public sources. Perplexity Computer's enterprise documentation describes sub-agents for domain-specific tasks and coordination agents for handoffs between specialists, but the coordination surface itself is not documented. If your agent touches multiple stakeholders, design the operator's view first. That is the hard surface, and it is the one most teams defer.
What to build from here
Four principles for design teams working on agentic products now, drawn from what the strongest implementations above have in common.
Ship the gate before the capability. OpenAI's cloud browser cannot complete payments. NotebookLM refuses ungrounded answers. The products that earn trust fastest constrain the agent's authority at the interface level, not in the fine print.
Make visibility the default, not the upgrade. Gemini Deep Research streaming topics in enterprise but running silent in consumer is a decision that optimizes for the wrong thing. If your agent's process is worth showing to paying customers, show it to all of them.
Design correction as a primary surface. Replit and GitHub treat rollback and fix as core interactions. Perplexity makes you destroy and rebuild. That difference determines whether users escalate their trust over time or cap it permanently.
Separate what you said from what you shipped. Every product in this analysis has a blog post about trust. The ones that earned mine are the ones where I could verify the claim in the interface without reading the press release first.
I've written before about five handoffs that define where human authority should live in agentic systems: intent, visibility, evidence, gates, and correction. None of the eight products in this analysis ship all five. The best ship two or three exceptionally well. That gap is the brief for every design team in this space.
- Rubrik's reversibility principle: Rubrik's recently launched AI agent platform explicitly frames autonomous actions as auditable, attributable, and reversible, with human review required when an action cannot be undone — a Human Gate Design implementation in cybersecurity worth tracking against the patterns above.
- Gusto's AI-native design org: Gusto published a detailed account of shifting from a traditional design team to an AI-native one within a single quarter, including building MCP-connected design-system workflows so AI tools could use real components — a rare public case of Loop Feedback applied to the design process itself.
- Replit's evaluation-as-improvement-loop: Replit's engineering team argues that agent evaluation has moved from a launch gate to an improvement loop combining offline benchmarks, A/B tests, production traces, and human judgment — the strongest public articulation of why drift monitoring needs continuous infrastructure, not periodic audits.
- Sierra Horizon's operator surface: Sierra's Horizon product page shows multi-day agent coordination across patient, provider, and payer with timeline visualization and control language, but the actual operator UI during a live run remains undocumented — worth revisiting as design partners ship and public evidence catches up to the marketing.