If you spend any time listening to corporate PR decks or Silicon Valley keynotes, you will notice that "trust" is treated as a sort of ambient, spiritual byproduct of good intentions. Companies talk about building trust the way they talk about building culture — as an ethereal mist that will simply manifest if enough smart people sit in an open-plan office.
It does not work that way. In product, trust has to be an engineered mechanical property. It is either built into the system from day one, or it does not exist at all.
I have spent a decade building products where trust is the core mechanism that determines survival. At Grab, this meant overseeing the personalisation engines where machine learning decided what hundreds of millions of users saw at different points across a six-country matrix. At Intellect, the stakes escalate to clinical GenAI, where LLMs assist in routing individuals through mental health crises — an environment where an erratic recommendation is a clinical failure and a bad experience.
Though these domains span different generations of artificial intelligence, the human psychology governing them remains identical. Trust, as I see it, relies on a three-tier architecture. When we get all three layers right, users will delegate high-stakes decisions to your product feature. Miss one, and the relationship collapses, as users slip away — sometimes even without bothering to file a complaint.
One: transparency (the alibi)
Transparency does not mean forcing a user to read a research paper on attention heads or gradient boosting. The end-user does not care about the maths. What they require is a clean, human-readable alibi: why this specific output, for me, right now?
At Grab, the personalisation engine was a formidable piece of engineering and data science — handling real-time behavioural segmentation and contextual ranking over hundreds of features. In aggregate, the metrics were beautiful. Yet, individual users would occasionally suffer from algorithmic hiccups.
The standard engineering temptation is to treat these anomalies as acceptable statistical noise. But to the user, a single glaringly irrelevant recommendation brings the integrity of the entire machine into question. They begin to assume that your good recommendations are merely lucky guesses or worse, transparent cash grabs.
Opaque: "Here is a discount." — User thinks: "Why? Is this a glitch?"
Transparent: "Here is a discount because you ordered from X last Tuesday." — User thinks: "Logical."
The remedy was deceptively simple: we began surfacing the machine's reasoning. We introduced explicit copy and micro-animations explaining the causal link: "Because you ordered from this neighbourhood last week," or "Popular near your office right now."
We applied the same principle at Intellect for clinical content recommendations. When the AI suggests a specific care pathway, it surfaces its reasoning in terms the user can instantly evaluate: "Based on what you shared about your sleep patterns this week, this module might help." Transparency is simply providing the user with just enough context to determine whether the machine has misunderstood their situation.
Two: control (the steering wheel)
Control is the right to override, correct, or outright reject the machine's conclusion. Product managers frequently resist this layer because it feels like a concession. If our algorithms are so brilliant, why should we let a human mess with the dials?
The answer is psychological: human beings fundamentally distrust any autonomous system they are powerless to influence. Sitting in an app with no control is like being strapped into a vehicle steered by an invisible, highly erratic chauffeur. Though the self-driving industry is working diligently to render this metaphor obsolete.
At Grab, our major breakthrough in personalisation wasn't achieved by tuning the parameters of the model; it was achieved by building satisfying feedback loops. We introduced lightweight UI mechanisms — thumbs up, thumbs down, and explicit "not interested in this" selectors. Crucially, we animated these actions with crisp, responsive micro-interactions.
When a user dismissed an irrelevant offer, the app acknowledged the rejection instantly. This minor dopamine hit transformed the user's relationship with the machine. The AI ceased to be an opaque force acting upon them, and became a digital assistant working with them.
User rejection → Satisfying UI acknowledgment → Explicit data signal → Model update
In clinical software, this is non-negotiable. Our tools never make unilateral, unmapped decisions about an individual's mental health care. The machine proposes; the human clinician (or the user themselves) disposes. Even when the AI's diagnostic hypothesis is mathematically perfect, the clinical act of choosing gives the patient agency over their own trajectory — which is, in itself, a therapeutic outcome.
Three: recourse (the safety net)
Recourse is the protocol that triggers when the machine inevitably stumbles. It is the layer that separates products that are genuinely trusted from those that are merely tolerated until a better alternative arrives.
Every probabilistic system will eventually fail. The defining metric of your brand is not your average uptime, but how you handle the tail-end disasters.
At Intellect, our clinical AI operates within a strict, tiered risk taxonomy. Level 1 covers standard behavioural wellbeing; Level 3 denotes high-risk clinical needs; Level 3A indicates an acute, immediate psychological crisis.
The AI is never permitted to be the final line of defence. If the triage system misclassifies an acute Level 3A crisis as a minor Level 1 stress event, a series of deterministic, hard-coded guardrails — keyword triggers, behavioural thresholds, and clinical escalation rules — override the model entirely. The system immediately bypasses the artificial intelligence and connects the user to a live, human clinician on standby.
This infrastructure is undeniably expensive. Maintaining 24/7 clinical coverage across multiple time zones does not scale with the elegant, zero-marginal-cost efficiency of an API. But this un-scalable human recourse is precisely what allows the scalable AI to exist. Without a reliable safety net, users will always calibrate their trust to your system's worst possible failure, rather than its average performance.
Users don't need AI to be perfect. They need to know that when AI is wrong, someone will make it right.
The three layers work together
Transparency without control is frustrating — users can see what the AI decided but can't change it. Control without transparency is confusing — users can adjust settings they don't understand. Either without recourse is fragile — everything works until it doesn't, and when it doesn't, trust evaporates.
The three layers also build on each other temporally. Transparency is how you earn initial trust. Control is how you deepen trust over time. Recourse is how you maintain trust through failure.
Recourse: the safety net (when the model fails)
Control: the steering wheel (the right to override)
Transparency: the alibi (surfacing the "why")
We are entering an era where software will make increasingly consequential interventions in human lives — determining medical treatment paths, allocating capital, and filtering information. The product teams that win the next decade will not necessarily be those with access to the largest cluster of GPUs or the most parameter-heavy models.
The ultimate market advantage belongs to those who design the most robust trust architectures. Model capabilities are rapidly commoditising; human trust remains the scarcest asset in the ecosystem. You cannot buy it via API, and you cannot hallucinate it through clever marketing. You have to build it into the code.