Designing for trust
When an agent should reason, and when to be certain
The Reality
Nobody opens an IT agent in a good mood.
Every design decision starts with that reality.
Like a pharmacy: people only show up when something isn’t working.
When an agent should reason, and when to be certain
About the project
ESS, or Employee Self-Service, is the AI agent Microsoft employees use for HR, IT, or Facilities questions. I led the IT experience design, end to end.
It’s the front door tens of thousands of Microsoft employees walk through when tech issues disrupt their day.
The core challenge was balancing AI reasoning with deterministic answers: deciding when the AI agent can explore, and when a user simply needs certainty.
Built on Microsoft Copilot Studio and shipped as part of the M365 Copilot agent adoption ecosystem. Its story is told in Microsoft’s Inside Track — but the tension it surfaced is universal to any experience built on a probabilistic model.
The Reality
Every design decision starts with that reality.
Like a pharmacy: people only show up when something isn’t working.
Under pressure, no one writes a detailed prompt; they type “VPN not working” at 8:59 AM.
To fix a complex issue, the agent needs context. But the worst thing it can do is demand it with a blank slate: “Please clarify your request.”
This is all they give you…
Which raises the real question:
Why not just make it smarter?
Because intelligence isn’t a dial you just turn up.
At the wrong moment, higher autonomy leads to guesswork, longer wait times, and endless follow‑up questions.
The Learning
Neither end is free. The work is placing each moment deliberately, and designing the seams where the slider moves.
vague intent:
reason first
Hi Mandy,
Sorry you’re dealing with this, that’s a rough way to start the day.
There are quite a few things that could be going on here. It might be your network connection, your VPN client, a certificate issue, or something on your device.
Could you tell me a bit more about what’s happening?
The more detail you share, the better I can help.
Hi Mandy, based on your registered device, a Surface Laptop, this looks like a device compliance issue, and there’s an automated fix you can try.
Device compliance quick fix
Use this if:
Your device shows as non-compliant, and VPN or internal tools are blocked.
What it does:
Updates your operating system to the version compliance requires, so access is restored.
Still not working, or on a different device? Let me know.
Please complete this form so I can pass you along.
How would you like to connect?
Wait times last checked at 1:30 PM PT.
Prefer to call directly? Visit this page.
The clearer the intent, the more certain the response can afford to be.
The strategy
High autonomyGuessing confidently is worse than not guessing.
Instead of asking the user to clarify, the agent grounds itself in device, location, and profile data to narrow down likely causes. Working alongside content design, I shaped how the system translates this contextual knowledge into an empathetic response, ensuring a stressed user feels met, not interrogated.
Hi Mandy, sorry you’re dealing with this, VPN trouble is the worst when you’re trying to start your day.
I can help with that. Based on your Surface Laptop and your location in Redmond, WA, here are the two most likely causes:
If neither fixes it, tell me which VPN you’re connecting to (Microsoft or Azure) and I’ll go deeper.
Or I can connect you with a support person.
When an issue requires more context, open-ended questions push the cognitive burden back onto a stressed user.
Instead of handing the problem back, the system acts as a guide. It generates a narrow, targeted question with high-confidence text choices, removing the guesswork entirely.
I might have an automated fix for you. But first, could you tell me which VPN you are trying to connect to?
Or, let me know if you are trying to connect to VPN not listed above.
The seam is where the slider moves from probabilistic to deterministic, especially when a user asks to speak to a human.
A harsh cut from a warm chat to a cold form quietly breaks trust at the worst moment. Instead, bridge the gap: maintain a human tone to set clear expectations before locking into a fixed path.
the format matters too!
Are you team “Type to answer” or “Click to act”?
Let me know how you want to connect with a support person:
Wait times last checked at 1:30 PM PT.
Please complete this form so I can pass you along.
Choose how you want to connect:
Wait times last checked at 1:30 PM PT.
I’d rather
I’d rather
Thanks for voting!
When options are absolute, users shouldn’t have to type. In collaboration with the research team, we learned a structured UI at the handoff moment brings instant relief: a clear promise of resolution.
Typing is probabilistic. Clicking is deterministic.
ESS Agent became the agent Microsoft leans on to support their employees’ work lives.
2× target
self-help success: issues solved without a ticket
18 pts higher
NSAT vs. the legacy support bot it replaced
22% → 49%
employees try self-help before calling support
These metrics are specifically for the IT experiences within ESS Agent.
“Nanda brings strong user empathy into ESS design, ensuring experiences reflect how employees actually think and feel, not system constraints. She pushes for emotion-aware responses in escalation scenarios, to reduce frustration and build trust.”
“Nanda has developed some of the strongest conversational UX in the studio; tone, sequencing, response structure, intent, and interaction flow, in ways that elevate the quality of the experience.”
Principles that transfer
Design for the user’s stress level
Meeting users at three-word prompts (“VPN not working”) means designing for immediate grounding rather than expecting detailed input.
Constraints build confidence
Adding intentional UI guardrails doesn’t limit the experience. At the right moment, rigid structure gives users the exact certainty and momentum they need.
Handoffs make or break trust
The highest-value moments are the handoffs, where a probabilistic AI reply becomes a concrete system action. Get that transition right and the agent feels trustworthy instead of fragile.