Authenticated Anonymous Q&A: Honest Questions Without a Public Troll Board
A public anonymous URL is not an employee Q&A
Authenticated anonymous questions from employees fail when “anonymous” means a public link anyone can spam. The projector becomes a troll board. The CEO spends the hour on HR. The next town hall goes back to named mics and silence. We have watched that swing. Honesty dies on both ends.
| Setup | Who can submit | What the room sees |
|---|---|---|
| Open public form | Anyone with the URL, including people not in the meeting | A firehose, including abuse from outside the session |
| Named mic or named chat | Only people willing to attach a career to the sentence | Polite questions and a quiet back row |
| Session-gated anonymous | People who joined this live session; names off | Random IDs or no names, questions from the room |
Session-gated is the mechanic we actually ship. Attendees join with a PIN or QR. If the poll is anonymous, they skip the name field. The system uses a random ID instead of a display name. That is not SSO against the HR directory. Do not brief legal as if it were. It is still a gate: you had to be in the session. A pastebin in Slack is not a gate.
Google’s research on psychological safety is about whether people can take a risk. Anonymous display is that risk. Gallup’s workplace research keeps showing that voice and trust move together. A public troll board trains the opposite: the loudest outsider owns the wall.
Reddit threads on “anonymous” Microsoft Forms repeat a useful split. Org-only plus “record name” off is a different product than a public link. People still ask how they can know it is anonymous. Your job is to say what the room will see, before the first submit.
What we tell the room before anyone types
Say the rule in one breath. “You join with today’s code. Names are off. The wall shows questions, not people. Abuse and private HR items will not be read. Hard business questions will.” If you skip the sentence, every later skip looks political.
Use anonymous live Q&A in the poll workspace. Keep the join on phones. We live-host. We do not embed a board in a slide the AV laptop cannot pause.
Names off is not a promise of forensic invisibility
Be precise. Display anonymity means the projector and the default host view are not a roll call. It does not mean a novel writing style can never be guessed in a 12-person team. It does not mean you should advertise “the company cannot ever tell.” Reddit operators who tried to reverse Forms submissions via audit logs are the warning. If your counsel needs true untraceability, that is a third-party survey with a contract, not a live town hall board.
For a 200-person all-hands, session join plus names off is the practical pair. Outsiders without the PIN are not in the lobby. Employees in the lobby are not wearing name tags on the LED wall. That is enough to stop the classic troll pattern: a public URL posted on social, filled by people who are not in the meeting.
RiLiFi’s free tier allows 100 participants per session, so a mid-size town hall is not cut off by an arbitrary paywall while you test this format. Larger rooms need a plan that matches your licensed cap. We do not invent a stadium number.
How trolls actually get in
They get in when the join is a guessable word, when the URL is public on the website, or when last quarter’s PIN is still printed on a recording. They also get in when you leave named chat and anonymous Q&A unlabeled on the same wall. The room then blames the person in row three for a line that came from a phone.
Rotate the PIN. Do not reuse the all-hands code from April. Do not put the join on an unauthenticated marketing page. Put it on the invite, the lobby slide, and the badge if you printed one.
If someone is in the session and still posts abuse, that is a conduct problem, not a URL problem. Remove the item. Apply the workplace rule you already have. The board should not be the only enforcement.
A pending list that never hits the wall is a different job. Here the job is membership: only the session, names off.
After the hour, close the lobby
End the session. A leftover live board with yesterday’s PIN is how weekend trolls arrive. Export what leadership promised to answer. Send the themes. If you ghost the hard questions, people will test the next board with worse faith.
Keep a shared folder for the Q&A asset so a backup host can open the same board if the primary laptop dies. View access by email is enough. Do not email a public link around “so the intern can help.” The intern should join as a host account, not as a forwarded URL.
Hybrid rooms need the same gate. Remote staff join with the PIN from the calendar invite, not from a tweeted screenshot. If you stream the town hall publicly, do not superimpose a working join code on the YouTube overlay. That overlay is a public URL with extra steps. Put a “employees use the invite PIN” line on the stream instead.
Authenticated anonymous questions are a session plus hidden names. They are not a public pastebin. Gate the join. Say what the wall will show. Then let the hard questions through.
Small companies still get trolled, just by fewer people. A 40-person all-hands with a public Google Form will collect jokes from someone’s roommate. The PIN still matters. Named chat still silences the intern. Use the session gate anyway. The archive from a 40-person room is easier to read. It is not easier to recover if the first line on the wall is abuse.
Do not add a spinning wheel to this hour. The wheel is a giveaway tool. This is a trust event. Keep the board boring and the questions sharp.