Conversational Design Systems is a book about the experience control plane: the architecture that lets an AI product adapt its language, interface, and flow while the commitments it must defend stay stable, inspectable, and provable. This is the argument in 13 slides.
A chatbot invented an airline's bereavement policy and a tribunal made the airline pay. When software generates its own sentences, screens, and actions, the product owns the consequences whether or not it owns the decision.
A prompt can instruct a model; it cannot create ownership, review boundaries, testable commitments, or traceable action history. The missing layer is an experience control plane: the product owns meaning and commitments, the model owns expression, and the boundary is a governed artifact.
Most products should not build the full architecture. The minimum viable control plane governs one risky workflow with eight artifacts, and each further layer must earn its cost in measured incidents and time-to-repair.
| Incident | What happened | The missing artifact |
|---|---|---|
| Air Canada, 2024 | Website chatbot invented a bereavement-fare policy; tribunal held the airline liable for negligent misrepresentation | A commitment with an owner: no artifact owned the sentence, no review covered it, no test could catch it |
| Chevrolet dealer, 2023 | Chatbot agreed to sell a $76,000 Tahoe for $1, "legally binding, no takesies backsies" | An action contract and authority graph between "the model said yes" and "the product committed" |
| NYC MyCity, 2024 | Official government bot told businesses to take workers' tips and refuse housing vouchers, all illegal | A context compiler: ingested knowledge with no provenance, currency, or authority to state it |
| DPD, 2024 | Courier's support bot swore at a customer and wrote a poem about its own company's demise | A constraint tier: expression running with no bounds at all |
Internally the same disease looks like prompt sprawl: hundreds of fragments scattered across code and consoles, where a compliance fix lands in two copies and misses the third. Nobody decides to build that layer. It accretes.
What the person and the product are trying to accomplish together. Changes when strategy changes, a few times a year. Owned by product and design.
What must remain true while that happens: verified facts, required disclosures, permissions, side effects. Each has an owner, a version, a review path, and a test. Changes through review.
The words, screens, voice, and generated interfaces. Free to change on every request, with every model version, in every locale, inside the frame the other two layers set.
The middle layer exists because meaning and obligation are not the same thing. That verification is required is a fact. That it must be disclosed before a customer confirms is a commitment. Facts describe the world. Commitments bind the product. Tone can quietly convert one into the other, which is why the boundary is designed and tested, not discovered in the language.
| Artifact | Question it answers |
|---|---|
| Semantic component | What reusable behavior is this? Explain, Confirm, Compare, Repair, Warn: behaviors, not prompts |
| Experience graph | How do behaviors compose? What is required, optional, skippable, and repairable, before any channel is chosen |
| Conversation contract | What may the model say? Verified facts in, required claims enforced, forbidden claims blocked |
| Action contract + authority | What may the system do, and who may do it? Preconditions, approvals, reversibility, audit |
| Context compiler | Which facts are admitted into this task, from which source, with what freshness? |
| Conversation profile | How does behavior localize? Terminology, reading level, pacing, with contracts always winning conflicts |
| Renderer contract | What must survive every surface? Salience, disabled states, accessibility, across chat, voice, and generated UI |
| Eval pack + trace | Did the behavior hold, and can you prove it later? Release gates and replayable evidence |
Straight into a prompt assembled from fragments
Facts, tone, disclosures, and available actions, implicitly
Nobody can say later which rule applied or why
Intent classified; context compiled with provenance; stale facts excluded
Authority and policy decide what this task may do, before anything renders
Model judgment enters twice: adapt optional steps, write the words, under contract
Salience rules hold; validators check; the whole turn lands in one replayable trace
Nothing depends on the model being good. A better model writes better Spanish; it does not change what was disclosed, permitted, or recorded. That separation is the whole book.
What does a wrong sentence cost?
Minor confusion and support tickets, or money, safety, rights, compliance, and irreversible action. A prototype with one assistant response needs a prompt file and good judgment, nothing more.
How many places can it appear?
One flow, one channel, one team, or many flows, markets, channels, and teams. Surface area multiplies both the value of shared artifacts and the blast radius of a drifting one.
| Level | Product state | Adopt next |
|---|---|---|
| 0. Prompt fragments | Prompts hidden in code, consoles, docs | Name the risky flows; collect prompt ownership |
| 1. Reusable prompts | Shared templates and examples | Semantic component ids and required commitments |
| 2. Semantic components | Reusable Explain, Confirm, Repair behaviors | Contracts, profiles, fixture-based evals |
| 3. Contracts & evals | Boundaries explicit and tested | Context compiler, authority graph, policy-as-code |
| 4–5. Control plane | Everything coordinates at runtime with replay | Governance registry; then continuously prune |
Context compilation, authority, and policy sit ahead of rendering. Cached policy runs in single-digit milliseconds; a cold compile does not. Heavy gates belong only where actions are consequential.
A registry, a policy engine, and a trace store are systems someone must run, upgrade, and page for.
Review paths create queues. A queue in front of every copy change teaches teams to route around the system, which is worse than not having one.
The mitigations are proportionality and measurement: adopt on one risky workflow, instrument whether incidents and time-to-repair actually drop, and let those numbers argue for the second workflow. A control plane that cannot show its own value in its own traces is overhead wearing a governance costume.
| Objection | The answer |
|---|---|
| Models will make this obsolete | Partly right: shrink the planner, thin the renderers as capability improves. But a better model cannot make itself auditable or hand compliance an artifact to review. A perfect answer with no contract is still unauditable. The Air Canada tribunal did not ask how fluent the chatbot was. |
| This is a rules engine reinvented | Rules engines governed deterministic flows. The new part is the governed boundary around a nondeterministic layer: contracts on generated language, salience on generated interfaces, replay across model judgment. |
| Policy-before-render adds latency | Milliseconds, where the product risks money, rights, or safety. The alternative is post-hoc guardrails, which pay the same cost in incidents. |
| The control plane is the new lock-in | The artifacts are declarative files in version control; the runtime that executes them is replaceable. The portability test: commitments move to a new orchestrator without rewriting. |
| Small teams cannot staff this | The ownership table names responsibilities, not headcount. One person holds several rows; the maturity ladder means adopting one workflow's worth of architecture, not an org chart. |
Clone it, run npm run demo and npm run evals, break the validators, and the architecture stops being a diagram. github.com/kyle-c/corredor-control-plane
Pick the riskiest workflow. The one where a wrong sentence costs money, rights, or compliance. Name the intent, consequence, channels, owners, and failure modes.
Write the commitments and one component. What must be said, what must never be implied, which actions need approval, with an owner for each.
Bound speech and action. One conversation contract with validators and a degrade template; one action contract behind an authority gate.
Gate the release and keep the evidence. One eval pack that blocks on required failures; one trace schema that makes every turn reconstructable.
Measure, then expand. Watch incidents and time-to-repair. Let the numbers argue for the second workflow, and sunset any layer that stops earning its cost.