A user's trust is a belief that is updated by evidence. Whether the user hands over a task depends on whether that belief crosses a threshold proportionate to the stakes. A product cannot change the belief directly, but it can be designed around each term of the updating. The prior: borrow institutions such as custody, regulation and third-party audit, and begin with low-stakes tasks so that the first step is easy to take. The evidence: make sure the highly diagnostic process records are actually seen by the user rather than hidden in the back end. The likelihood ratio: have evidence verified by third parties, so that an unreliable party finds it hard to fake. Mistakes: disclose them before the user discovers them. The threshold: make leaving and withdrawing easy, and the threshold for starting falls. The aim of these designs is not to make users trust more, but to make their trust match how trustworthy the product actually is.
The condition for a user to hand over a task can be put in one sentence: the prior, updated by each piece of evidence that is seen, according to that evidence's diagnostic power, crosses a threshold proportionate to the stakes. Every design choice in a product acts on one term of this sentence. Institutional safeguards and small first steps act on the prior and the threshold. How process records are presented acts on how much evidence the user sees. Third-party verification acts on the diagnostic power of the evidence. Disclosing a mistake proactively acts on the weight of negative evidence. Easy exit acts on the threshold itself. Mapping designs onto these terms shows clearly what each investment actually changes.
A new agent has no record, and the user's prior is weak. If the user is asked at the outset to hand over full management, the threshold is far above the belief, and the user will simply refuse. A better path begins with tasks whose stakes are small and whose results are easy to check: looking up data, explaining something, reminding on time. These tasks have low thresholds, users are willing to try them, and each fulfilled task adds evidence. Once the belief has risen step by step, the relationship moves on to tasks with higher stakes, such as drafting a plan and approving a plan. The prior can also be borrowed: assets held by an independent custodian, business that is regulated, and code and processes audited by third parties all raise the user's starting point when there is no record at all.
Evidence changes belief only when the user sees it. An agent may complete every agreed check in every period and keep to every fee, but if these records exist only in the back end, the user sees only the occasional reminder and the year-end return, and the belief barely moves. Presenting evidence takes design: a brief account in each period, the relevant records shown proactively at key moments, and the basis available for the user to open at any time. More is not always better here either; a flood of irrelevant messages will be ignored. What should be presented is the part of the evidence that is highly diagnostic and relevant to what the user has at stake.
If evidence is supplied by the trustee itself, an unreliable party can also supply handsome records, and the diagnostic power of such evidence is discounted. Verification by an independent third party changes this. A statement issued by the custodian, an exchange's record of executions, an auditor's report: an unreliable party finds these hard to fake, so their likelihood ratio is much higher. DeAngelo (1981) argued that the value of an audit lies precisely in the auditor's own reputation and independence. A product can let users open the raw data and third-party records directly, rather than see only the product's own summary.
Tap a kind of evidence.
A mistake is itself negative evidence, but whether the user discovers it or the product discloses it makes a large difference to the belief. Research in law and crisis communication calls disclosing unfavourable information first "stealing thunder". Williams, Bourgeois and Croyle (1993) found that when a lawyer admitted the client's unfavourable facts before the other side raised them, mock jurors judged the client markedly less harshly; Arpan and Roskos-Ewoldsen (2005) found the same effect in corporate crises. Proactive disclosure is itself evidence of integrity. A product should have a procedure for handling mistakes: stop as soon as a mistake is found, notify affected users quickly, explain the cause, the impact and the remedy, and say how a recurrence will be prevented.
The threshold for handing over a task depends on how much a misjudgment would cost. If authority can be withdrawn at any time, all records exported, and assets and plans moved elsewhere, the cost of a misjudgment is much smaller, and the belief required falls with it. Hirschman (1970) argued that users' exit is the most direct check on an organization. Here, easy exit has a further effect: it lowers the threshold for starting. A product that is hard to leave is also hard to start.
The easier to leave, the easier to start
A thousand potential users hold different beliefs about an agent. Drag how hard it is to leave: whether withdrawing authority, exporting records, and moving assets and plans are convenient. See the threshold required and the share of users willing to start.
Borrow institutions and begin with small tasks; make highly diagnostic, hard-to-fake evidence visible; disclose mistakes first; and make leaving easy. The aim is proportionate trust.
Explain custody, regulation and audit; offer low-threshold tasks such as looking up data and reminders first, so that evidence builds up through use.
Do not hide records in the back end, and do not drown the user in messages.
Custodian statements, execution records and audit reports are far more diagnostic than the product's own word.
Set up a procedure to detect, stop, notify, explain and remedy; allow authority to be withdrawn, records exported and assets moved at any time.