Anonymity: identity modes and group reporting

Facilitation (Pronoia)

Principle

The core of the Delphi method is to reduce social-conformity pressure and dominance through (semi-)anonymity. In Pronoia, panelists are strictly anonymous to one another yet identifiable through a pseudonym, so that in dialogue a participant recognises the same conversation partner as the same person. Anonymity protects honest judgement; it must not break accidentally through small groups, AI participants, or comparisons.

Group-level reporting runs along the panel matrix — the expertise (primary) and stakeholder (secondary) axes — rather than a single legacy grouping. The same k≥3 protection applies to every axis and to the panel-pulse group dots.

Three identity modes (per-panel setting)

A. Pseudonymous (default)

A stable word handle per panelist (e.g. Aurora, Vega) — memorable and distinctive, giving no hint of identity or status, stable for the whole study. Real identity sits only behind the invite link (invite token). Full functionality: Home, dialogue, revisions, recognition, arena.

B. Role play (optional layer on top of A)

The panelist writes a role or perspective they answer from (e.g. Municipal finance director in 2035) and places it in a box of the panel matrix. Off by default. The division of work is clear: the facilitator owns the structure – the axes and categories of the panel matrix – and the panelist chooses the box their role fits best.

• The role is a name, the box is a group. Group comparison and analysis use the box the panelist chose, not the free role text. Freely written roles therefore do not break the panel into groups of one, and k≥3 protection stays in force.
• Others see the role next to the panelist's reasoning and comments, after the handle, marked self-selected. It is a claimed perspective, not verified expertise.
• AI role. The facilitator can commission a role for an AI panelist in the same matrix. It is shown marked AI role, and the AI answers from the role's perspective. A role a human chose and a role an AI plays are never confused.
• When role play is switched off, roles are shown to no one; the saved role and box are kept.

C. Fully anonymous one-shot poll

No identity, a single response – a seminar or mobile poll the facilitator shares as a QR code or link. No sign-in, own page, arena, revisions, recognition or persistent handle. Voters answer the theses and may write a short reason; the writer is never named. Each submission is stored as an anonymous participant who does not appear on the panel roster or in group comparison, and the answers go into the round's results and distribution like any other answers.

The duplicate-vote guard is per browser: the same browser answers once. It stops accidental repeats but not deliberate ones – another browser or a private window can answer again. The one-shot poll therefore suits taking the temperature of a room, not a vote whose outcome is binding.

Cross-cutting rules (always on, in every mode)

AI is always disclosed. Every AI panelist is marked with "AI" plus a short role description, 2–3 words (e.g. AI · Economist, AI · Labour Researcher). Shown everywhere an AI panelist appears: dialogue arguments and comments, panel lists, pulse group labels, reports. Never hidden, never presented as human.

k-anonymity (k = 3) across all group-level views. No sub-group with fewer than three people is reported at group level — comparisons, sentiment and panel-pulse group dots included — and the rule applies independently on each matrix axis. Complementary protection: when a group falls below the threshold it is folded (into an "Other" group) until every cell has at least three; if "Other" is still below three, the breakdown is not shown at all. Panelists with no value on an axis are excluded from that axis — they never form a residual bucket. The same threshold applies to cross-tabulations (group × thesis): a numeric cell is hidden when n < 3. On small panels the facilitator is steered to a 2–3 group split; anonymity wins. In the extreme, the pulse is shown at whole-panel level only.

Visibility & the after-submit reveal. Per-round phase policy controls when a panelist sees others. The default classic preset uses after-submit for the response phase: no anchoring before you commit your own answer, but once submitted the panelist sees others' anonymized responses and the aggregate graph. Strict blind remains available in the facilitator policy editor. All revealed material stays pseudonymous and k≥3-protected; the reveal changes timing, not the identity rules.

What is available in each mode

*Unless blind-facilitator mode is enabled.

By default the facilitator sees real identities (for reminders and quality control); a per-panel blind-facilitator mode hides them, so the facilitator also sees only pseudonyms (the invite mapping still exists in the database).

Group comparison — current behaviour

• Two axes, stacked. Both the panelist Home and the facilitator Community view show the expertise (primary) comparison and, beneath it, the stakeholder (secondary) comparison — each with its own roster, numeric matrix and sentiment.
• Numeric comparison where the question type allows. Group means and their deviation from the panel mean (plus a divergence figure) are computed for scale questions only; other question types do not produce a numeric matrix.
• Comment-based sentiment for every question type. Each group's tone (positive / cautious / critical / neutral, with a net figure) is derived from arguments and comments across all theses, so open, ranking and multiple-choice questions are covered too.
• Pulse group dots follow the primary (expertise) axis, matching the group-comparison default.
• All of the above remain under k≥3 with complementary suppression; no "Out" / "Other" buckets appear for a fully classified matrix panel.

In practice: role play and the one-shot poll

Each has its own working guide:

• Role play: a role in a box of the panel matrix: when role play suits a study, the facilitator's steps, a template for the panel, AI roles, and reading results by box.
• One-shot poll at a seminar: QR code and anonymous answers: preparation, the QR code and presentation view, what to tell the room, disruptions, results and limits.

Data model (implemented) — for the developer-partner

• Study: facilitator_blind, role_play_enabled, handle_theme, one-shot fields (oneshot_comment_window, oneshot_moderated), policy_preset + per-round phase_policy (visibility = blind | after_submit | open), panel_matrix (JSON: primary/secondary axis names and categories), matrix_type (expert | observer), language.
• Panelist: display_handle (themed, panel-unique, stable), self_selected_role, participant_type (human | ai_agent), matrix_primary / matrix_secondary, description, is_decision_maker, language.
• Axis grouping (_panelist_axis): primary → matrix_primary (AI perspective as fallback; in role play the box the panelist chose – the role is a name, not a group); secondary → matrix_secondary; returns empty when the axis is empty, so the panelist is excluded rather than bucketed.
• Shared group reporting (grouped_display): k = 3 + complementary suppression ("Other") + None-exclusion + small-panel fallback to whole-panel level. Used by /groups (Home) and /community (facilitator) with both axes stacked, and by the pulse group dots.
• AI label derived from participant_type = ai_agent plus the ai_profile role, rendered as "AI · {role}", role standardised to 2–3 words.
• Blind facilitator: when facilitator_blind = true the UI shows only handles (names/emails hidden), though the invite mapping still exists in the database.

Source: Pronoia — Anonymity Design (Metodix, June 2026, status: implemented).