Which actions deserve two steps
- Destructive: deletions, voids, cancellations, status reversals.
- Financial: invoices, payments, credits, refunds, price overrides.
- External sends: anything that reaches a customer by message or email.
- Bulk: operations touching many records at once.
- Overrides: anything that bypasses a normal business rule.
Why a signed token and not a flag
A boolean 'confirmed: true' argument is something the model can set on its own. A signed token can only come from a preview the server produced, which means the confirmation refers to a specific, unmodified plan. Change the parameters and the token no longer matches.
Keeping the pattern credible
Confirmation loses its meaning when everything requires it. Reads should be immediate. Reserve the second step for the categories above, describe the consequence in plain language, and make refusal as easy as approval.