Disambiguation: when unsure, lean into it

When an advertiser types "Valentine's Day under $120," the AI needs to decide what "Valentine's Day" means. Seasonal availability? A product category? A custom label? In most AI systems, the model picks one interpretation silently and returns results. I saw this as an opportunity to solve for system rigidity and the custom labels problem by laying it all out in the open.

The disambiguation card surfaces when the AI detects multiple valid interpretations. It shows each interpretation as a selectable option with a brief explanation and the estimated number of matching products. The advertiser chooses, and the AI learns from that input.

For example, if a previous employee created the custom label "cupid" for Valentine's Day and didn't pass that knowledge on, the card resurfaces that lost context alongside Meta's recommendation, building trust through what feels like genuine co-creation.

The cost calculation is asymmetric: one extra interaction costs seconds, but a silently wrong product set can waste thousands in ad spend before anyone notices. Instead of expanding the system's opacity and worsening operational rigidity, transparency here resolves both.

Two co-equal creation modes

Rather than separating filtering from AI, I designed a single creation flow combining manual and filtered sets, aiming for greater experimentation and broader product selection. This drives toward Catalog's north star: to shift the advertiser mental model toward trusting Meta's guidance, so they lean into automation and focus on growing their businesses instead of wrangling operational tasks.

This is a deliberate strategic choice. The data shows that roughly a third of sets with ad revenue still originate from the manual UI. These aren't confused advertisers, they're power users with large catalogs who think in precise filter combinations. Deprecating their workflow would alienate them while AI matures. The transition here should feel like a continuum, not a cliff.

Progressive disclosure of AI complexity

The full creation flow offers maximum transparency: AI reasoning visible, every filter editable, full undo/redo stack, manual override always one click away.

Automation mode on the overview page goes further: sets self-manage, while the advertiser reviews exceptions only.

These levels shift the advertiser from manual control toward automation, gradually across five milestones. No advertiser is pushed further than their trust allows.

Outcome-led hierarchy

The previous overview page listed sets flatly. I restructured it around business outcomes: revenue contribution, ROAS, conversion rate. Set health signals flag underperforming or drifting sets.

From monitoring to automation

AI-generated optimization recommendations surface with opt-in actions, until the AI is trusted enough for full automation (still with comprehensive controls on how it operates). This reframe shifts the advertiser's mental model from "what rules did I set?" to "is this set performing?" to "what's been recently optimized?"

Fixing the permission problem wasn't one design. It was a sequenced campaign of three moves, each solving a different part of the problem, each enabling the next.

Flipping the default without a migration plan leaves every existing locked catalog locked forever. Running a migration without the default flip drains a reservoir that keeps refilling. Building request flows before either of those asks users to work around a broken system rather than fixing it.

Move 1: Stop the bleed

The first priority was to stop making the problem worse.

Every new catalog created under the old system entered the world locked-by-default and joined the backlog of invisible catalogs. So the first move was to flip the default at creation: new catalogs auto-grant access to everyone in the business, with a clear toggle for the minority that wants to restrict.

This was cheap to ship, low-risk (it affected only new catalogs going forward), and it proved the thesis.

The proof. When the default-on toggle shipped with explicit opt-out, 97.5% of advertisers left auto-access on. The old default wasn't protecting users, it was ignoring them.

Why other UI fixes alone wouldn't work. A better "request access" flow helps after the failure has already happened. The dominant failure mode was the creation default itself, producing locked catalogs that became invisible. A system that designs around the symptom leaves the cause intact.

Terms of Service as the activation mechanism. Rather than building permission toggles into every surface, I designed the auto-permission behaviour to activate when advertisers accept the updated Catalog Terms of Service, the legal agreement they already accept when creating catalogs.

This was legally sound, technically elegant (one behaviour change rather than many UI changes), and user-respectful. The Legal coordination wasn't wrangling around the design. It was part of the design.

Usability validation: Meta Flow 56. Using Meta's Monetization Usability Program scoring, the Permissions flow (Flow 56) in Commerce Manager graduated at 88/100, a +54 point improvement from baseline. One of the largest single-flow improvements the program has recorded, and external validation that the default change resolved the underlying usability problem rather than just moving the toggle.

Move 2: Drain the backlog

Fixing the default only helps catalogs created after the fix. The much larger problem was the reservoir of legacy catalogs already locked: years of accumulated invisibility sitting inside businesses that had never been given the option to change.

The design question. How do you flip the default retroactively for millions of existing catalogs without breaking trust?

The answer: a staged opt-out migration. Businesses get advance notice, a 30-day window to opt out, and a one-click opt-out affordance if they want to maintain restricted access. If they do nothing, auto-access turns on.

Why waves rather than a single switch. Different business types have different complexity profiles. Starting with simpler cohorts (small businesses with single owners, clean permission structures) let us validate the migration design and surface edge cases on populations where the cost of error was lowest. Each wave informed the next.

The result. To date, 8+ waves have shipped, each progressively larger and more complex. The opt-out rate across the backfill migration has been 0.13%, two orders of magnitude below what a cautious planner would have predicted, and the clearest possible signal that the locked default had been serving almost no one.

The agency wave. The most recent cohorts include agencies, where access is genuinely more complex: client density (agencies manage catalogs across many unrelated businesses), cross-business access relationships, and inherited trust models that don't map cleanly to a single-business permission frame. This is early-stage work and we're still learning. The waves structure is what makes it safe to tackle: the model gets refined on each cohort before being expanded to the next.

Post-launch refinements. After initial launch, we identified 8 specific UX adjustments through monitoring and feedback, from confusing button labels ("Manage" → "Review") to over-emphasised opt-out affordances (button demoted to link). Small individually, but together they reflect the craft of shipping: the language on a notification card is the difference between a clean migration and a support-ticket spike.

Move 3: Make access visible

Moves 1 and 2 solve the majority case. They don't solve it for everyone.

There are legitimate cases where someone needs access to a catalog they don't own: third-party agencies, cross-business partnerships, security-sensitive businesses that have opted out. For those cases, the circular trap still had to be broken.

The solution shipped in two sub-moves, prioritised by intent.

Move 3a: Catalog selection

Every advertiser running product ads interacts with the Universal Catalog Selector. It's the moment of highest intent in the entire ecosystem: the advertiser is about to spend money and just needs the right catalog. Move 3 began here because this is where the friction was most expensive.

The problem. The existing selector was underperforming across every metric. Advertisers were opting out of catalogs at alarming rates; the component crashed frequently; load times were frustrating; recommendations were generic. At the exact moment the selector should have been converting, it was pushing advertisers away.

The redesign, around four decisions:

• Personalized recommendations. Catalogs surfaced in priority order based on the advertiser's business and ad objective, rather than a generic recent-first list.
• Permission-aware selection. Integrated the Move 3 request patterns directly into the selector. No-access catalogs are visible with an inline "Request access" CTA, turning the highest-intent surface into the highest-conversion request surface.
• Component architecture. Partnered with engineering to rebuild the underlying component, eliminating crashes and reducing latency. Performance is a design problem: a component that crashes or loads slowly teaches users to avoid it, and that lesson doesn't unlearn. The latency fix came from my design proposal: large advertisers and agencies often had dozens of catalogs across multiple businesses, and the old component fetched all of them at once. Grouping catalogs by business, with each business as an expandable row, let the system fetch each group only when opened. Faster loads, and a structure that matched how those advertisers actually think about their catalogs.
• Hierarchy and cognitive load. Simplified the selection flow so the most common path is also the shortest path. Catalog status, eligibility, and recent activity surface where the decision is being made, not one click deeper.

The results

One component, one surface, moved the program's revenue numbers measurably. Even with Moves 1 and 2 solving the majority, the remaining population was large enough, and high-intent enough, that a well-designed request and selection experience moved billions.

Move 3b: Self-serve

Move 3a solved the high-intent moment inside Ads Manager. But the broader circular trap, the one advertisers hit in Business Settings and in the catalog-management surfaces, needed its own answer.

Unlike 3a, these were net-new features rather than component redesigns. There's no meaningful "before" state. The "before" was the absence of any flow at all.

Self-serve access requests in Meta Business Suite. Redesigned the catalog list to show all catalogs in the business, regardless of permission status. No-access catalogs are now visible with clear access-state indicators and an inline "Request access" affordance. Users can discover, request, and track access without leaving the surface they were already working in.

Admin confirmation flow. For the admin receiving a request, designed a clear approval surface that surfaces who is asking, for which catalog, and with what context. Approve or deny is one click. Approval fatigue is real in businesses with many active catalogs, so the flow prioritises speed over ceremony.

Business Settings as the management home. Consolidated the permission-management experience in Business Settings as the primary surface for businesses that want to manage access actively. Admins oversee all catalogs and access relationships here, alongside the opt-out controls from Moves 1 and 2.