Zero trust in 5 steps
Most breaches start with one stolen password. Here is how to stop that.
ShareEdit
For Oz · design
How the AI helps an account share a social post
This is the "Share a social post" goal from AI partner onboarding, shown as the account user sees it. Each screen is one moment in the chat. Under it, a short note says what the AI looks at, what it does, and what it shows.
What Maya types
What the AI says
A card the AI shows (you design these)
Short note after a click
1 Start→2 One question→3 Pick a post→4 Edit (optional)→5 Connect LinkedIn→6 Schedule→7 Done→Same cards, other features
Grey dashed boxes marked "For devs" are optional. You can skip them. Source: the goal spec draft (share-social-post-agent-native.md, v2).
Step 1 of 7
Maya starts the goal
Maya sees "Share a social post" in her onboarding list. She taps it. She could also type the same thing into Ask AI at any time.
Northwind IT portal · Home
Get started
Set up your profile
Share a social postStart
Connect your CRM
or, in Ask AI
I want to share a social post
What happens
- 👀AI looks atWho Maya is, her company (Northwind IT), and what her plan allows.
- ⚙️AI doesStarts the same steps either way. Tapping the goal and typing the request lead to the same flow.
- 🖼️AI showsNothing yet. It moves straight to step 2.
For design: the start point already exists (the Ask box and the onboarding list). No new screen needed here.
For devs
Typing in Ask AI with no active goal runs the same actions and UI blocks. An action is one thing the system can do. A UI block is a card that shows its result.Step 2 of 7
The AI asks one quick question (only if it needs to)
The AI first checks if it already knows what Northwind IT sells. If it does, it skips this step. If not, it asks once, with tap-to-answer options.
Ask AI
I want to share a social post
Happy to help. What do you mostly sell?
CARD: QUESTION + CHIPS
SecurityCloudNetworking
Or type your answer...
You picked Security.
What happens
- 👀AI looks atWhat it knows about Northwind IT. Then the solution list the vendor set up (Security, Cloud, Networking).
- ⚙️AI doesAsks one question at most. Never two before showing posts.
- 🖼️AI showsA question card with chips. If there is no list, just a text box.
For design: chip labels are 3 words max. After a tap, show the picked chip and hide the rest. Add a short note line ("You picked Security."), not a fake message from Maya.
For devs
Actions: get_account_interest, then list_solution_options. Inputs are what the AI reads first (here: tenant, account). Output is what comes back (the chip options).Step 3 of 7
The AI shows three posts that fit
The AI picks three ready-made posts from the vendor's content library about Security. Maya can share one as is, edit it, or ask for different ones.
Ask AI
Here are 3 security posts you can share.
CARD: POST LIST
Show different posts
Phishing season
Three signs an email isn't what it says it is.
ShareEdit
Backup myths
"We back up nightly" is not a recovery plan.
ShareEdit
You chose: Zero trust in 5 steps.
What happens
- 👀AI looks at"Security", the content library, and posts already shown (so it never repeats).
- ⚙️AI doesFinds the three best matching posts.
- 🖼️AI showsThree post cards with Share and Edit, plus "Show different posts".
For design: preview text is 2 lines, then cut off. States to draw: loading ("Finding posts for you..."), no posts, couldn't load, fewer than 3, and "Social posting isn't on your plan." Close match today: the campaign recommendation card.
For devs
Action: recommend_posts. The AI only "reads" titles and ids. The card gets the full preview and images.Step 4 of 7 · optional
Maya tweaks the post (optional)
If Maya taps Edit, the social post editor opens full screen. The chat stays on the left, so she can ask the AI to change the post or type changes herself.
Social post editor
Make it shorter and mention Northwind IT
Done. I cut it to 2 lines and added your company name.
Preview · LinkedIn
Zero trust in 5 steps. Most breaches start with one stolen password. Northwind IT can help you close that door.
CloseShare
What happens
- 👀AI looks atThe chosen post and every edit Maya makes, as she makes it.
- ⚙️AI doesRewrites on request. Keeps track of the latest version.
- 🖼️AI showsThe existing editor, with chat on the left and a live preview.
For design: reuse the existing AI social editor. Only new bits: the Share button here, and the error "This post isn't available."
For devs
Action: open_post_editor. Edits flow back to the AI as events (a note that the user did something), so the AI never has to ask.Step 5 of 7 · only if needed
Maya connects LinkedIn (only if she hasn't yet)
Before posting, the AI checks which social accounts are ready. If none are, it shows a connect card. Maya always starts the connection herself.
Ask AI
First, connect where you want to post.
CARD: CONNECT ACCOUNTS
in LinkedInConnect
XNeeds reconnect · Reconnect
FacebookConnect
Pop-up window
Sign in to LinkedIn and allow Northwind IT portal to post for you.
Sign in to LinkedIn and allow Northwind IT portal to post for you.
CancelAllow
LinkedIn connected.
What happens
- 👀AI looks atMaya's connected networks, and which ones the vendor allows.
- ⚙️AI doesSuggests connecting. It can't connect for her. She clicks.
- 🖼️AI showsOne row per allowed network: connected, needs reconnect, or Connect.
For design: sign-in opens in a pop-up, never inside the chat. Cancel returns to this card with no error. Use plain words: "Needs reconnect", not "token expired". Close match today: Connect social account in Campaign Builder.
For devs
Actions: list_social_connections, then connect_social_account (needs a user click). This also completes the "Connect a social account" goal.Step 6 of 7
Maya picks when, then clicks Schedule
The AI fills in what it can (LinkedIn, tomorrow 9:00 AM). Maya checks it and clicks. Even if she types "just post it", the AI waits for her click.
Ask AI
Post it tomorrow morning
Here's the plan. Check it and click Schedule.
CARD: SCHEDULE
Zero trust in 5 steps
Post to:LinkedInX (reconnect)
When:Sat, Oct 179:00 AM CT
Post nowSchedule for Oct 17, 9:00 AM
Scheduled on LinkedIn for Oct 17, 9:00 AM. Undo
What happens
- 👀AI looks atThe final post (with edits), connected networks, vendor rules, and "tomorrow morning".
- ⚙️AI doesPrefills the card. Never posts on its own.
- 🖼️AI showsA schedule card. After the click, a short confirmation with Undo.
For design: show networks and time on the button itself. Post now gets one confirm ("Post to LinkedIn now?"). Undo lasts 10 seconds. If one network fails, show it per network with Retry.
For devs
Action: schedule_post. Needs a user click. Safe to retry, so a double click never posts twice.Step 7 of 7
Done, and here's what's next
Once a post is scheduled or posted, the goal is ticked off. The AI suggests the next goal. This also happens if Maya shares a post outside onboarding.
Ask AI
Scheduled on LinkedIn for Oct 17, 9:00 AM.
Nice work. Your first post is on its way.
CARD: DONE + NEXT GOAL
Share a social post
Next: Connect your CRMStart
What happens
- 👀AI looks atThat the post went out (or is scheduled), and which goals are left.
- ⚙️AI doesMarks the goal done. If it was already done, nothing changes.
- 🖼️AI showsA done card with the next goal. If none is left, just "Done."
For design: this card is new. It can be reused at the end of every onboarding goal.
For devs
Action: complete_goal. Run by the system, not the AI.Why this matters
One card, many places
The post card Maya saw in "Pick a post" is not a one-off. The same card, and the same connect and schedule cards, appear wherever an AI feature needs them.
Post card
Connect card
Schedule card
1Onboarding goal"Share a social post" in AI partner onboarding
Share a social post
Here are 3 security posts you can share.
SAME POST CARD
Zero trust in 5 steps
Most breaches start with one stolen password. Here is how to stop that.
ShareEdit
First, connect where you want to post.
SAME CONNECT CARD
in LinkedInConnect
2Ask AI: post recommendationsMaya asks any time, no goal running
Any good security posts I can share this week?
This one fits your audience well.
SAME POST CARD
Zero trust in 5 steps
Most breaches start with one stolen password. Here is how to stop that.
ShareEdit
Want to schedule it?
SAME SCHEDULE CARD
LinkedInOct 179:00 AM
Schedule
3AI Campaign BuilderChat on the left, campaign canvas on the right
BriefContentAudienceSchedule
Add a LinkedIn post
Added. Pick a time below.
SAME POST CARD
Zero trust in 5 steps
Most breaches start with one stolen password. Here is how to stop that.
ShareEdit
SAME CONNECT CARD
in LinkedInConnect
SAME SCHEDULE CARD
LinkedInOct 179:00 AM
Schedule
Design and build onceEach card is designed and built one time.
Use it anywhereAny AI feature that needs it uses the same card.
Change once, update everywhereFix or improve a card, and every place that uses it gets the change.
For design: design each card once, with all its states. Make it fit a narrow chat column and a wider canvas. No fixed widths.
For devs
This is a shared block library. The current list of blocks, and where each one is used, is in ui-block-inventory.md. We can render them as MCP apps, or hard-code them first and move later.Variations
When things go differently
Same steps, different paths. These are the cases to cover in mocks.
⚡Maya says it all at once
"Post about security on LinkedIn tomorrow 9am." No question. Security posts appear. Schedule card is prefilled.
✍️No solution list
The vendor hasn't set one up. The AI asks one open question with a text box, no chips.
🔁X needs reconnect
X shows "Needs reconnect". Maya can still post to LinkedIn.
🛑"Just post it"
The AI shows the schedule card and waits. Nothing goes out without a click.
🚫Not on her plan
"Social posting isn't on your plan." No post cards.
🔍No posts found
"No posts for this solution yet." Offer other solutions.
Copy rules: one or two short sentences around each card. Say "account", never "partner". No tech words like "OAuth" or "token". Use FORM design library parts. Flag anything missing to Ben before building it custom.
For devs (optional)
The words in the spec, in one line each
You don't need these to design. They help when reading the full spec or talking with dev.
| Word | Plain meaning | In this example |
|---|---|---|
| Goal | Something the account wants to get done. | Share a social post |
| Action | One thing the system can do. Screens and the AI both use the same ones. | Find posts, connect LinkedIn, schedule |
| Inputs | What the AI reads before doing an action. | "Security", posts already shown |
| Output | What comes back after the action. | Three posts |
| UI block | A card that shows an output and lets the user act. Reusable across goals. | Post list card |
| Plain text | When the AI just answers in words, with no card. | "Here are 3 security posts." |
| Event | A note to the AI that the user clicked something. | "You chose: Zero trust in 5 steps." |
| Recipe | The usual order of steps for a goal. | Steps 1 to 7 in this walkthrough |
| Needs confirm | The AI can suggest it, but only the user's click makes it happen. | Connect, Schedule, Post now |
| MCP app | A way to show these same cards inside other AI tools later. | Later. V1 is still being checked with dev |
Screen 1 of 11