A Reusable Model for Designing Trust Between Strangers
Scope at a Glance
The Problem
Trust isn't a feature you add near launch — it's the substrate the product stands on.
Any system that asks two people who've never met to cooperate — share a car, a home, a payment, a workspace — has to manufacture in minutes what ordinarily takes months. Its absence shows up as low conversion, thin supply, and churn after the first bad experience — not as a missing feature, but as a shape the whole product is missing.
I kept re-deriving the same trust decisions from scratch on every concept project, so I wrote them down once as a domain-agnostic model — applications live in their own notes and link back to it.
The Six Questions
Every user asks these before committing — mostly without noticing.
A trust design answers each one, or explicitly admits it can't. Most products over-invest in the first two and neglect the last three — which is where the felt experience of trust actually lives.
| Layer | Question |
|---|---|
| 1. Identity | Who are you? |
| 2. Reputation | What have you done before? |
| 3. Predictability | What will this actually be like? |
| 4. Structural safeguards | What stops you if you're lying? |
| 5. Recourse | What happens if it goes wrong? |
| 6. Disclosure | What don't you know? |
Mechanisms
A pattern library, not a checklist — each one tied to what it costs and where it's proven.
Blind reciprocal review window
Neither party sees the other's rating until both have submitted. Solves retaliation and inflated scores without a coercive prompt. Seen in BlaBlaCar's 14-day window and Airbnb's simultaneous reveal.
Confidence-weighted composite score
Bayesian shrinkage blends a small sample toward a prior, so two five-star ratings don't display as "5.0". Shown with its count, not as a bare average. Seen in Trustpilot and IMDb's weighted rating.
State-backed identity assertion
Authenticate through a national eID scheme instead of building KYC from scratch. Proves identity, not character — never let the badge imply safety. Seen in Estonian ID-card/Smart-ID, recognised EU-wide under eIDAS.
Immutable terms after agreement
Lock the agreed terms at acceptance; any later change is self-evidently illegitimate. Structurally kills bait-and-switch rather than just providing a complaint form. Seen in Bolt's locked payment method after trip acceptance.
Cross-Cutting Principles
The rules that hold across all six layers.
- Trust is asymmetric — the party with more to lose needs more signal. Design for the vulnerable side, not the average user.
- Every trust signal is an attack surface — ratings get farmed, photos get stolen, vouches get traded. Assume it and design the failure mode.
- A verification tier with one door excludes everyone without a key — give every tier more than one independent route in.
- Don't average incommensurable signals — verification is a floor, reputation is an opinion, volume is confidence in that opinion.
- Trust compounds, distrust cascades — one badly handled failure poisons every signal you showed them.
Anti-Patterns
- Binary "verified" badges conflating weak and strong checks
- Averages shown without their denominator
- Ratings visible before you've written yours
- Opaque scores users can't decompose or contest
- Overclaiming safety a system can't actually back up
Applied: OpenRide
First tested against a real concept, not left as theory.
OpenRide's Trust & Safety System runs all six questions against a federated, volunteer-run ride-hailing network with no centralized vetting — dual identity routes so verification doesn't become a citizenship test, a confidence-weighted rating shown with its ride count, and an honest admission that it can't match Uber's background-check infrastructure.
That last part is the framework working as intended: disclosure isn't a fallback, it's the sixth question answered on purpose.
Reflection
What writing it down once actually changed.
Identity and reputation are the easy ones.
They're also the easy ones to fake. Predictability, recourse, and disclosure take more design effort and pay out more felt trust.
Admitting the gap builds more trust than hiding it.
Overselling safety is load-bearing — the first incident doesn't just cost one interaction, it collapses every signal shown.
A framework only proves itself against a real product.
OpenRide surfaced trade-offs — cash handling, mandatory ratings — that no abstract question would have forced into the open.