Preview draft. Copy and visuals are pending review and may change before launch.

Concept

Authorization for anonymous one-person-one-vote systems

The usual authorization question is 'who is this, and what are they allowed to do.' A genuinely anonymous vote needs an answer to a narrower, different question entirely: has this specific person already voted, without the system ever learning who they are.

← Back to the library

Data, Access Models, and Boundaries · Published 2026-09-07

A narrower question than full identification

A uniqueness proof demonstrates that a specific principal hasn't already participated in something — cast a vote, claimed a limited offer — without necessarily revealing who that principal actually is. This is a narrower and often more appropriate requirement than full identification: for many uniqueness-sensitive actions, what genuinely matters is that no one participates twice, not that the system knows exactly who each participant was.

This is a different authorization shape from most of what typically gets designed for, which usually starts from verifying identity and then checking that identity's specific permissions. A uniqueness proof instead asks whether a specific token, credential, or proof has been used before — a question that can be answered without ever needing to know or record who's actually behind it, which is precisely the property that makes genuinely anonymous voting or genuinely anonymous limited-offer claims possible at all.

Why this is genuinely harder than it sounds

Building a system that can reliably prevent double participation while giving up the usual tool of identity-based tracking is a real technical challenge, not a minor variation on ordinary authorization — the mechanisms that make this possible (cryptographic tokens issued once per eligible participant, for instance) have to be carefully designed so that the uniqueness check itself doesn't inadvertently leak identifying information through some other channel, which would undo the anonymity the whole design was meant to provide in the first place.