> Just do it, but allow it to be un-done.
No matter what the action. This might mean rearchitecting that interactive flow. It might even need deeper rearchitecting for other tasks. But “allow undo” should definitely be an option for “action on press” flows.
We should prefer (and in software this will almost always be possible) to undo the regrettable action instead of demanding consent.
In some cases we can do even better and prevent the regret itself with "Brick wall UI". Brick wall UI is a design where the thing that you definitely don't want to do isn't possible. As designers we have to put more effort in to ensure that this only arises where it's genuinely never what you wanted to do, otherwise it's just incredibly annoying.
The idea in Brick wall UI is that the user's experience is potentially, especially initially, the same frustration as if it was broken. Why won't the barrier open so I can drive my truck under the bridge? Why can't I use my login token to access this banking site and see my transfer details?
And maybe, eventually, sat at the Brick wall UI, the user realises why and is glad. "Oh! My truck won't actually fit under the bridge, I just avoided an expensive mistake" or "Wait, this isn't my bank it's fakebank.example, it's a bloody phishing scam". Or maybe they don't, for hours, or days, or weeks, but since it was never correct that's actually fine.
The Brick Wall I was particularly thinking about is WebAuthn. There could (but shouldn't) be a UI where I can say Oops, silly site has used the wrong URL, lets provide my real site credentials anyway. I can give the scammers my real credentials, they can steal all my money everybody is happy. Oh except me, I guess I'm miserable - but only after I realise what happened. Instead there's a brick wall here, WebAuthn can't authenticate to the bad guys. I'm sat there until I either realise that it's a scam or I give up and maybe phone the bank about their apparently atrocious UI (and then maybe realise it's a scam).
Well, there are ways to do this (for an easy example, just edit your hosts file). But the barrier of entry is high enough that a non technical person will give up even if they're completely oblivious.
(The main exception I can think of being games were not having an undo can often be integral to the experience. Eg Counterstrike should definitely shoot on press, and not allow you to undo bullets.)