In the cockpit of every jet fighter is a brightly painted
lever that, when pulled, fires a small rocket engine
underneath the pilot's seat, blowing the pilot, still in
his seat, out of the aircraft to parachute safely to
earth. Ejector seat levers can only be used once, and
their consequences are significant and irreversible.
Applications must have ejector seat levers so that users
can "occasionally" move persistent objects in the
interface, or dramatically (sometimes irreversibly)
alter the function or behavior of the application. The
one thing that must never happen is accidental
deployment of the ejector seat.
The interface design must assure that a user can never
inadvertently fire the ejector seat when all he wants to
do is make some minor adjustment to the program.
