Agentic risk management

Redefining how Meta respond to new laws, policies, and emerging risks at scale.

Role

Lead Product Designer

Timeline

February — March 2026
2 months

Team

1 PD, 1 PM, 1 UXR, 4 engineers

Skills

Agentic Interaction Design · Product Strategy · Systems Design

Overview

What changes when AI becomes part of a high-stakes workflow?

I redesigned how Meta's risk teams create and update compliance requirements, replacing a rigid, multi-page wizard with an agent that clarifies intent conversationally and routes each change to the surface its complexity requires.

At a glance

Challenge

Risk compliance changes at Meta took 5.8 days on average, needed dedicated support 56% of the time, and caused 18 downstream misconfigurations, because every request followed the same rigid workflow.

My approach

I redefined how changes move through the system, replacing a rigid wizard with an experience that adapts based on the type of change and its downstream impact.

Impact

Within 14 days of GA, 67% of published requests used the agentic workflow, with 5× faster median completion and no reported increase in downstream misconfigurations.

Why this mattered

The system treated every change the same.

Every change, from a one-line tweak to a company-wide policy shift, went through the same rigid process, so the system's inflexibility became the real bottleneck as compliance pressure grew. The experience needed to match the impact of the change.

Types of changes
One-line edits
Control updates
Policy-wide changes
Same rigid wizard
‹Create a new requirement
Assigned by: Tony Bridges  ·  Due date: 2025-03-06  ·  In progress
Safety checks
Create requirement
Initial details
Meeting the requirement
Controls
Control verifiers
Implementation guidance
Review
Create a new requirement
If you need help, check out the change management user guide, or post in the Requirements and Controls Manager
Feedback & Support group and one of our engineers will get back to you.
Requirement text
Use advanced settings
Requirement text
Enter the requirement text that will be surfaced in Risk Review, telling users what needs to be done to mitigate a risk. Guidance for
writing requirements
Unlicensed 3PUD will be stored less than 90 days from creation.
Scope
Requirement bar
What the requirement applies to. This should be specific to, and match the DP documentation. For example, "Applies to the following
asset types: X, Y".
Enter the requirement bar
Scope type
Select the type of data that the requirement applies to. The most common type is "Taxonomy query", where you can specify Actor,
Jurisdiction, Semantic Type, etc.
Select type▼
Requirement applies to
In Risk Review, which projects should the requirement apply to. If you need a new concept made, post in the Requirements and
Controls Manager Feedback & Support group and one of our engineers will get back to you.
All projects
This requirement should apply globally to all Risk Review projects.
Just projects relating to my risk area
Only projects tagged with your risk area will surface this requirement in Risk Review.
Step 1 of 8 · Draft saved automatically
Save draft
Continue

What's at stake

Safety

Manual workflows increase the likelihood of misconfigurations and inconsistent enforcement.

Speed

High-friction workflows slow policy execution and consume specialized engineering capacity for routine work.

Scale

When teams bypass the platform, governance moves into spreadsheets and tribal knowledge, weakening the system as the source of truth.

Solution

01 · Interaction model

An experience that adapts to what's changing.

Flow: describe the change, AI clarifies intent and evaluates impact, then a contained change stays in a widget while downstream impact expands to canvas, both ending in human review

02

Architecting the agentic experience

Part of my work was stepping back from this one system and aligning with Meta's broader risk org on the standards that would govern AI use across teams.

03

Full-screen conversation

Every task starts as a conversation that clarifies intent before deciding where it needs to go.

04

Widget injection

Self-contained changes resolve directly inside the conversation, giving users only the controls necessary to review, modify, and submit the proposed change.

05

Canvas mode

When a change carries downstream implications, the experience expands into Canvas Mode, exposing dependencies, affected objects, and the context required to understand the consequences before submission.

Reflection

The system outgrew the problem

Build reusable components and primitives that other teams could extend without rebuilding from scratch.

Autonomy needs clear boundaries

Be explicit about where the agent acts and where human judgment remains.