● Fogo · on building trustworthy AI

How do you know that?

It is the question every person asks an AI eventually. The answer a product gives — and whether it can give one at all — is the whole of whether it deserves to be believed.

The short version

An AI's conclusion is a claim. A claim you cannot open is something you either believe or you don't — and that is a coin flip, not trust. Progressive disclosure is not decoration on an AI product. It is the mechanism that turns a statement into something a person can inspect, and inspection is where both the trust and the pleasure come from.

The problem with a good answer

Ask a financial assistant how much you spent on dining last month and it says $847. Now what?

You have exactly two moves. Believe it, or don't. There is no third option, because the number arrived as a finished thing. And the uncomfortable truth is that the more fluent the answer sounds, the harder that choice gets — confident prose is not evidence, but it reads like it.

This is the trap every AI product walks into. It gets very good at producing answers and never asks what a person is supposed to do with one. The result is a system that feels impressive for a week and untrustworthy by the second month, when a number is wrong once and there was never any way to tell.

A synthesis you cannot open is a claim you must take on faith. A synthesis you can open is a conversation.

Trust is a ladder, not a switch

Fogo's answer is that every claim it makes has depth beneath it, arranged so that a person meets exactly as much as they asked for. Three levels, always in the same order.

At rest You spent about $847 on dining in July. plain language · one claim · nothing to decode

One open Posted transactions only, 1–31 July, across two connected accounts. Your Amex is not connected, so anything on that card is not counted. the basis, the window, and — critically — what is missing

The floor recipe: canonical spend · positive amounts · excludes transfers, refunds
coverage: 2 of 3 known accounts · source rows: 34

The person who wanted a number gets a number. The person who wanted to know whether to believe it can find out in one motion. The person rebuilding the calculation gets the recipe. Nobody is made to read the level below the one they needed.

The middle rung is the one that matters most, and it is the one most products skip. It is where a system admits what it cannot see. A dining figure that quietly omits an unconnected card is not a small error — it is a confident answer to a question the product could not actually answer, and there was no seam where it could say so.

What this looks like when it is working

The principle shows up wherever Fogo has to be honest about something:

Early in the month, a projection says "Too early." Not a smaller number with a caveat attached — a refusal, until there is enough of a month to project from.
A recurring charge is not called recurring until the history is long enough to support the word. Below that threshold Fogo says it is still reading, which is a different statement from finding nothing.
A figure you told Fogo is labelled as yours. "You told me" is a different kind of fact from "I saw this in your account," and collapsing the two is how a system starts believing its own guesses.
A failed read looks like a failed read. Not an empty state, not a clean zero. The most dangerous number in any financial product is a zero that means "I could not check."

A zero that means nothing happened and a zero that means I could not look render identically unless someone designs the difference. Almost nobody does.

The affordance that disappeared

The clearest version of this idea arrived by being wrong four times first. Fogo's dashboard needed a way to move from a short narrative read into the dense evidence beneath it. The design record of that problem is a small essay in restraint:

1A “Focus” button beneath the narrative. It worked, and it read as a utility control guarding another screen — the depth felt like a different place rather than more of this one.

2A resting excerpt, a couple of rows of real evidence shown before any click. Better: the depth was now visible. But the actual reasoning still sat behind the button.

3A two-level pair — a complete visualization at rest, and a second, differently-framed one on opening. Both useful alone. The transition was still a button.

4Remove the control. The composition continues into its own depth — a visible threshold with an evidence label and directional language, where the whole threshold is the thing you touch.

The final answer has no button in it. The affordance dissolved into the composition, because the composition was already saying there is more of this below and a button was only repeating it in a duller voice.

That is the test we now apply. If depth needs a generic control to announce it, the design has not finished. When a page is composed correctly, the depth is legible as depth and the invitation is the shape itself.

Why this is the AI part, not the UI part

It would be easy to file all of this under interface polish. It is not.

A model that generates conclusions is doing something categorically different from software that displays records. A spreadsheet does not need to explain itself, because you can see the cells. A synthesis is the explanation — it is a compression of many facts into one sentence, and compression always discards something.

So the question is never whether the system compressed. It is whether a person can get back what was dropped. Progressive disclosure is the decompression path. Without it, an AI product is asking for faith and calling it a feature.

And the pleasure lives in exactly the same place. The delight in a good synthesis is not the sentence — sentences are cheap now, and getting cheaper. It is pulling the thread and finding that the thing underneath is real, and specific, and about you. A claim that survives being opened is worth more than ten that were never openable.

Design the ladder before the wording. The wording is only what the ladder makes possible.

The principle

In any product where a model states conclusions, depth is not a feature of the interface. It is the trust model.

Every claim gets three readings: what it says at rest, what it admits when opened, and what it rests on underneath. Build the ladder first and the sentence writes itself. Write the sentence first and you will find, eventually and publicly, that there was nothing under it.