Join our Newsletter — 33% off our NHI Course
Home› FAQ› Cyber Security› What breaks when a generated component looks correct…
Cyber Security

What breaks when a generated component looks correct but the interaction model is wrong?

← Back to all FAQ
By NHI Mgmt Group Editorial Team Updated October 7, 2026 Domain: Cyber Security

The usual failure points are nested state, focus management, keyboard navigation, and accessibility semantics. A component can render cleanly and still fail users if its event handling, hierarchy, or screen-reader roles do not match the intended behaviour.

When a component looks right but behaves wrong

A generated component can pass visual review and still fail at the interaction layer. The break usually appears when the markup, event handling, and accessibility semantics describe one thing while the component behaves like another. That mismatch is why a clean render is not enough to prove the component is usable, testable, or safe to ship.

The practical question is whether the component’s interaction model matches the user’s mental model and the assistive-technology contract. If the hierarchy, state ownership, or keyboard affordances are wrong, the implementation may look polished while still breaking core actions such as selection, dismissal, navigation, or state changes.

Where the failure shows up first

The earliest break is often nested state, where a child appears interactive but its behaviour is actually controlled by a parent. That can produce double updates, stale state, or controls that seem enabled but do nothing when activated. In generated UI, this is common when the visual structure is inferred more reliably than the interaction hierarchy.

Focus management is the next weak point. A dialog, menu, popover, or combobox may open correctly but leave focus behind, trap it incorrectly, or fail to restore it when closed. Keyboard navigation can then become unreliable because tab order, arrow-key movement, and escape behaviour are treated as styling details instead of functional requirements.

Accessibility semantics are the third failure mode. A component may use the right colors and spacing but still expose the wrong role, name, or state to screen readers. When the semantic contract is wrong, users of assistive technology experience a different component from the one sighted users see, and that is a functional defect rather than a cosmetic one.

Why visual correctness is not interaction correctness

Generated components often inherit their failure from overfitting to appearance. The model may reproduce spacing, borders, and layout patterns while missing the state machine that makes the pattern usable. That matters most for composite widgets, where the “correct” outcome depends on coordinated states across trigger, panel, item, and dismissal behaviour.

Event handling is where this gap becomes visible. A click handler, key handler, and focus handler can all be individually reasonable while still conflicting in combination. If the event model does not match the intended hierarchy, users encounter broken toggles, duplicate actions, unexpected propagation, or controls that announce one state but behave like another.

This is also why NIST Cybersecurity Framework 2.0 is a useful lens here: the issue is not only whether something renders, but whether the component is reliably governed, protected, and recoverable as part of a larger system. The same logic applies to CIS Benchmarks style hardening thinking, where the control is only real if the effective behaviour matches the expected one.

How to test the interaction model, not just the screenshot

Start by testing the component as a user would, not as a designer would. Keyboard-only operation should reveal whether focus moves predictably, whether the active element is obvious, and whether every action can be completed without a pointer. If a component cannot be opened, navigated, selected, and dismissed from the keyboard, its interaction model is incomplete.

Then verify the semantics against the rendered behaviour. The accessible name, role, and state should describe the control the user is actually operating, and the announced changes should line up with visible changes. For a generated component, this check is often more valuable than an additional visual pass because semantic drift is easier to miss than a broken layout.

For teams building generated UI at scale, NIST AI Risk Management Framework and OWASP API Security Top 10 both reinforce a useful pattern: interface quality has to be checked at the interaction boundary, not inferred from successful construction. If the component contract is wrong, downstream users and automation will experience the defect even when the code compiles and the UI looks finished.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0 and OWASP ASVS set the governance and control requirements practitioners need to meet.

FrameworkControl / ReferenceRelevance
NIST CSF 2.0PR.AA-05 — Identity Management, Authentication and Access ControlInteraction correctness depends on consistent user access and control behaviour.
PR.PS-01 — Configuration ManagementGenerated components fail when implementation details drift from the intended component contract.
PR.DS-01 — Data-at-Rest is ProtectedAccessible state and control data must remain consistent across interaction paths.
Recommendation — Verify that control behavior matches the intended access and interaction model. Review component configuration and state handling against the intended behavior. Validate that component state is preserved and exposed correctly across user actions.
OWASP ASVSV3 — Web Frontend SecurityFrontend components must behave correctly under user interaction and browser events.
V4 — API and Web ServiceComponent behavior often depends on event-driven service responses and state transitions.
Recommendation — Test front-end components for interaction correctness, not just visual output. Verify that client interaction paths align with the supported service behavior.

Practitioner Guidance

What to verify: Treat every generated component as suspect until keyboard path, focus order, and accessible state changes have been exercised end to end. The fastest reliable check is whether the component still works when styling is ignored and only interaction remains.

Common mistake: Teams validate the screenshot and assume the component is done. That misses the class of defects where the visual shell is correct but the interaction contract is wrong, which is especially common in menus, dialogs, tabs, and form controls.

What good looks like: The component exposes a clear state model, responds consistently to pointer and keyboard input, and presents the same meaning to sighted users and assistive technology. When that alignment is present, the interaction model is usually trustworthy.

Practitioner takeaway: In generated UI, polish is not proof. The component is only correct when its behaviour, semantics, and focus handling describe the same thing as its visual appearance.

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 7, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org