Event that is hardly enough. There should be a physical (well virtual physical) obstacle towards launching a high stakes command. The system should be able to

Event that is hardly enough. There should be a physical (well virtual physical) obstacle towards launching a high stakes command. The system should be able to assess the scope of a task, and ask you to confirm 10 times if it has to, in blinking red dialogs, to make sure you really want to do what you are doing. Of course, it's crucial that "clicking 10 times" is not the default behavior for any trivial action. Or boredom and the subsequently formed mechanical 10-click habit of the operator will kill the effectiveness of this approach...