Organization

The ceiling. The ladder is capped by how much an agent is allowed to do alone.

Visibility
See it
The agent declares its intent before it changes a line or a 3D element.
Intercept
Stop it
A person can step in and stop the agent before a spatial change commits.
Lineage
Own it
The human professional remains the sole author of record.

The Autonomy Ladder. An organization caps the agent. Under that ceiling, trust stands on three pillars: Visibility (see it), Intercept (stop it), and Lineage (own it).

Challenge

Designing Trust for AI Agents in Spatial Workflows

I led the design strategy for Autodesk Assistant’s agentic core—establishing how engineers and architects audit, intercept, and retain absolute ownership of automated actions across chat and the canvas.

Role: Associate Design Director; owned the interaction architecture for agentic control across chat and canvas workflows.
Timeline: 4 months; embedded with the product organization to lead strategy from inception to live stage showcase.
Team: Cross-functional agency and client core (Myself, fellow designers, and Autodesk product leads) collaborating with engineering and PM stakeholders.
Constraints: Designing a unified interaction layer across a suite of legacy desktop and cloud products, under a fixed public deadline for Autodesk University.
Outcomes: Delivered three foundational control frameworks for agentic automation, successfully debuting as the core Autodesk Assistant keynote demo at AU 2026.

Impact

AU 2026

Keynote demo. The core UX patterns were orchestrated for the Autodesk University stage.

Foundational control frameworks for agentic autonomy: visibility, interceptability, and lineage.

4 months

Embedded with Autodesk’s product organization to design the interaction framework.

How we got there: one interaction layer for a legacy suite, built so a person can see what the agent intends, stop it, and remain the author of record.

The Paradigm Shift

Autodesk Assistant is moving from a passive chatbot to an active agent. From a single prompt, it can rename complex directory structures, modify parametric models, and update dozens of spatial objects simultaneously.

For architects and engineers, this scale of automation is terrifying. Handing work to an AI can feel like relinquishing control, especially when critical changes happen out of sight. The core design challenge wasn’t expanding the agent’s capabilities; it was building an interface where humans feel safe letting it execute.

I spent four months embedding with Autodesk’s product organization to design the interaction framework debuted on stage at Autodesk University (AU) 2026.

Operationalizing Trust

I broke trust down into three distinct interaction guardrails: visibility of intent, absolute interceptability, and a clear lineage of ownership. Every component and state change I designed served this triad. Above them sat an overarching product question: How much should an agent be allowed to do alone?

That question is the Autonomy Ladder at the top of this page. The organization caps it. Under the cap, the three pillars are Visibility (see it), Intercept (stop it), and Lineage (own it).

Screenshot held until launch. Dual-state highlight: the chat card summarizes the change, and the canvas isolates, highlights, and color-codes the affected geometry before commitment.

Screenshot held until launch. A ledger stays on the modified object. A canceled approval folds into a one-line receipt.

Screenshot held until launch. While the agent runs, Stop is the one prominent option. Active prompts offer Copy, Edit, and Save. Completed responses offer Copy, Retry, and feedback.

Screenshot held until launch. Save sits next to Copy and Edit on the response card — the anchor for the permissions pitch.

Visibility: Seeing What It Does

Before Autodesk Assistant modifies a single line or 3D element, it must declare its intent. Staging state shows exactly what the agent plans to do, pausing execution for Accept, Deny, or Redirect.

The canvas vs. chat dilemma. Split attention. If the AI changes 40 plumbing objects in a 3D model via a sidebar, the user loses situational awareness. The dual-state highlight system answers that: the chat card summarizes the change logic, while the canvas dynamically isolates, highlights, and color-codes the affected geometry before commitment.

The Canvas vs. the Chat

Goal: Keep situational awareness when an agent changes many objects at once.
Change: The chat card summarizes the logic. The canvas isolates, highlights, and color-codes the affected geometry before commitment.
Outcome: Accept, Deny, or Redirect happens against the model, not against a sidebar summary alone.

Persistent micro-confirmations. Once a change runs, it leaves a plain, contextual ledger tied directly to the modified object. If a pending change is canceled, the approval card folds into a clean, one-line receipt. Nothing disappears from the canvas or the chat history without a trace.

Persistent Micro-Confirmations

Goal: Nothing leaves the canvas or the chat history without a trace.
Change: A plain ledger stays tied to the modified object. A canceled approval folds into a one-line receipt.
Outcome: Every committed or canceled change leaves a contextual record.

Interceptability: Stepping In

Fixing a typo is trivial in standard chat. In a CAD environment, a misinterpreted prompt can damage a production-grade spatial model. Correcting the agent had to be low-friction and entirely safe.

Three prompt-correction paradigms, and what each one did in practice:

Append

FailAdding a new message to correct the last one cluttered the history and confused the model.

Branching

FailMulti-version prompt trees created massive mental overhead and hid what the person meant.

Edit in Place

SuccessThe person updates the prompt. The original system response stays, so lineage is intact, and the agent runs the revision as a fresh execution.

Managing the Edge Cases

Edit works exclusively on the final prompt step — a first-version cap — because fixing words cannot unfix a spatial change already committed to the model’s history. The action bar is persistent, not a transient hover. Active prompts get Copy, Edit, and Save. Completed agent responses get Copy, Retry, and standard feedback logs. While the agent runs, a single prominent option: Stop.

Goal: Correct the agent without corrupting historical model data.
Change: Edit is limited to the final prompt. A persistent action bar replaces hover. Stop is the one control while the agent runs.
Outcome: People can intercept an active process without pretending a committed spatial change never happened.

Lineage: Owning the Outcome

Four principles decide who the work belongs to once an agent has touched it.

Preserve Human Input: Never overwrite or erase human-authored geometry without explicit consent.
Co-Pilot, Not Autopilot: AI is an extension of the professional, never under its own independent authority.
Absolute Accountability: The human professional remains the sole author of record.
Correction is Workflow: Adjusting, redirecting, or stopping the agent is how complex spatial design gets done, not a failure state.

How Far It Can Go Alone

Custom workflows make an approval card on every step a tax on the work. The permission model is nested, and no individual can grant more freedom than the layer above.

Strict Oversight. Ask and pause for approval on every step.
Conditional Autonomy. Ask once per session or batch, then execute.
Full Automation. Runs headlessly in the background.

The company ceiling sets the maximum allowable freedom. Team defaults configure project-specific baselines. An individual adjusts boundaries safely inside those caps.

Company: Sets the maximum allowable freedom. Nothing below this ceiling can raise it.
Team: Configures the project baseline inside the company cap.
Individual: Adjusts boundaries safely inside both caps.

Anchoring Permissions to the Response Card

Goal: Let custom workflows run without an approval card every time, without letting anyone outrun the company ceiling.
Change: Three nested modes — strict oversight, conditional autonomy, full automation — capped Company, then Team, then Individual. Save sits beside Copy and Edit.
Outcome: Individuals set independence inside the caps. No one grants the agent more freedom than the layer above.

Meta-Process: How I Used AI

I used AI models as sparring partners to stress-test edge cases, generate rapid wireframe variants, and iterate on interface copy. Human governance made the decisive calls: which layout won, what stayed out of scope for the AU demo, and the product tone.

One example: an AI-generated layout drafted an approval state for assets that would be deleted by the upcoming change — an execution paradox caught in internal review and fixed before client alignment.

Recruiter Cheat Sheet

UX for complex AI systems. Moved a legacy suite beyond chatbot text bars into multi-object execution that bridges chat and 3D space.

Cross-functional orchestration. Embedded with Autodesk product leadership, a core PM, and an internal design director.

Interaction innovation. Edit-in-place that intercepts active AI processes without corrupting historical model data.

System safeguards. A permissions hierarchy that protects corporate standards while letting individuals set independence.

Strategic leadership. Final creative direction, clearer review cycles via early recommendations, and a UX vision under a fixed AU timeline.