Work in progress · updated 30 Sep 2026 · notes, not conclusions

The block page nobody designs

What should a person see at the moment security stops them, so they choose the safe path instead of a workaround?

Why it matters

A block page is shown far more often than any admin console, to people who didn't choose the security product. When it only says no, people route around it, and the risk moves somewhere nobody is watching.

What I'm trying

• Say what happened and why, in plain words, without leaking the rule itself.
• Offer the one safe way forward: the approved tool, or an exception request with a reason.
• Log the choice so the security team sees where rules and real work collide.

What would show it works

Fewer workaround attempts after a block, and exception requests that come with a reason.

Next step

Sketch three block pages (web, data, sign-in) and test them with five people outside security.

Related work

• Three per centa tiny detail on one button that quietly changed what people did
• The afternoon storythe block page the employee sees at +0.2 seconds