Surfaces
T1

Provenance & Intent

1.1
Interaction design

Cryptographic content provenance

Because the agency has no way to control what happens to a document before it arrives, the response signs each document where it does control it, at intake, recording the time of receipt and the submitter's identity. It records that the submission arrived and was unaltered after that point, and makes no claim about who originally authored it.

User submitting
City Digital ServicesConsultation: Foreshore managed retreat plan

Submission received

Reference FMR-2026-00090.

We’ve signed and timestamped your files.

Receipt signature
Received14 Jun 2026, 09:42Signed byCity Digital Services platformSubmitterL. Nguyen · government digital ID verifiedStateBoth files unaltered since receipt

This records when we received your files and that no one has altered them since. It does not verify who originally wrote them.

Your documents
lot-elevation-survey.pdf
214 KB
Content Credentials
Captured in Acme Scanner 4.2 · 11 Jun 2026
Cropped and exported — 2 edits, no content added
Signed by City on receipt · 14 Jun 2026, 09:42
submission-letter.docx
38 KB · no embedded credentials
Signed at intake
System shows signal
lot-elevation-survey.pdf
Intact since 09:42. Full creation chain present: captured, lightly edited, no content added.
submission-letter.docx
Intact since 09:42. No pre-receipt history.

Most files that arrive this way never carried a credential. The unsigned file is weighted no lower for lacking one.

1.2
Interaction design

Verifiable credentials and decentralized identity

Because a verified credential proves who is submitting but says nothing about how the submission was prepared, the response keeps the two claims plainly apart: an independently attested identity sits beside a preparation-method declaration the submitter makes themselves, cryptographically bound to that identity but not separately verified. The reader can see at a glance which claim is vouched for and which is the submitter's own word.

User sharing credentials
City Digital ServicesStep 3 of 4 · Strengthen your submission

Strengthen your submission

Both parts below are optional. You can prove who you are, and tell us how you prepared this. Your submission is accepted either way.

Verified
Verified identity

From your digital wallet. Only what this consultation needs is shared.

Ready to sharedigital ID wallet
Over 18
Resident of the City
Registered engineer · professional licensing board
Name and address · not shared
Self-declared
How you prepared this

Bound to your verified identity, but not separately checked. It is accepted as stated.

Your declaration
Drafted by me, from my own experience
Translated with AI translation software from Vietnamese
Submitted on my own behalf, not an organization
Prefer not to identify yourself?
No identity or declaration will be attached.
System shows claims
Verified: registered engineer, City resident, over 18.
Issuer-verified · name withheld
Self-declared: drafted personally, AI-translated.
Declared by the submitter · bound to identity

Verified input and self-declared input are shown as two labeled signals. Anonymous input is never discounted without the user being told.

1.3
Interaction design

Self-attestation and disclosure

Because a structured account of tool, version, task, and extent tells a decision-maker far more than a yes-or-no checkbox, the response opens with a single default for the common case and reveals the specific fields only once a submitter says they used AI assistance. Most people finish in one tap, and the detail appears only for the submissions where it informs how the entry should be read.

04 / 05How you prepared this

Did you use any tools to prepare your submission?

No further detail needed. You can continue.
1.4
Interaction design

Proof of personhood at submission

Because personhood is treated as a gradient rather than a single gate, the response attaches a visible assurance signal to each submission (email-verified, phone-verified, or ID-verified) for the analysts who read it, instead of forcing one submit-or-don't checkpoint. A submission that clears only a lower tier still goes through, carrying a signal that tells the analyst how much weight its personhood claim can bear.

User confirming personhood
City Digital Services

Confirm a person is behind this

This consultation asks for at least phone verification. Pick any method that meets or exceeds it, or submit without one.

EmailPhone · required minimumGovernment ID

Your submission will carry the signal “Phone-verified” to the analysts who read it.

System shows signal
Submissions · Foreshore managed retreat plan4,213 received
FMR-2026-0090L. NguyenID-verified
FMR-2026-0187AnonymousPhone-verified
FMR-2026-0203AnonymousEmail-verified
FMR-2026-0561AnonymousNot established

Every submission carries its signal, including “not established”, which means accepted and weighted for review, never dropped. The weighting applied to each tier is published, and the signal is never color alone.

1.5
Interaction design

Structured intake with process metadata

The response is a guided intake that records timing and paste patterns as the submitter works. When it detects a paste, it offers a prompt ('Looks like you pasted from another source. Want to note where it came from?') the submitter can answer or skip. The information is gathered as a byproduct of building the submission, never as a gate the submitter must clear.

User submitting
City Digital ServicesWrite your response

We record how this form is filled in: timing and paste events, not what your words say.

Your situation

I’ve lived on Riverside Terrace for eleven years and use the sidewalk daily with a mobility scooter.

Your views on the proposalWriting now

The levy is fair in principle, but the proposed flat rate ignores that some streets were resurfaced only last year. A tiered charge based on the age of each segment would…

This text was pasted from another source. Note where it came from?
Your recommendationsUp next
Prefer to write freely? Switch to a single box. It counts the same, with less detail captured about how you wrote it.
System logs audit trail
Process metadata
session23 min, returned twicetyped : pasted78% typed · 22% pastedsectionscompleted in orderedits41 revisionspaste_events1source un-noted

No content is analyzed, only how the submission was built. A free-text submission carries less of this.

1.6
Interaction design

Linking a person's input to the final text

Because disclosure works here as a norm rather than as enforcement, the response is a voluntary 'Add a source to this part' control and a provenance note in the submitter's own words, never recorded by the system. The plain declaration ('I wrote this myself, based on my own experience') is the one affirmative act — Submit stays inactive until it is selected — and stays the fastest route to submit. Choosing not to show your working costs no extra steps.

Preview the submission with or without annotations
City Digital Services · Consultation submission05 / 05

Review and submit

Check your submission below. Showing your working is optional. You can submit as soon as you’re ready.

Your submission · Coastal Precinct Plan

The proposed levy will fall hardest on long-term residents on fixed incomes. My pension has not moved in two years, and an added charge of this size is not something I can absorb.

Source: Riverside Tenants' position paper

I would support the plan if the foreshore path were kept step-free the whole way. As a wheelchair user, the current route is the only one I can take to the shops.

How this was written, in your words
3 sessions
Drafted over the week
Some pasted
From my own notes
One rewrite
After the second section

Described by you, not recorded by the system. Included with your submission only if you choose to share it.

The plain declaration sits first, and selecting it is an affirmative act: Submit stays inactive until a declaration is made. Showing your working is never required to submit.

‘Add a source’ and the provenance notes work with a keyboard and a screen reader, and skipping them adds no extra steps. Nothing in the interface suggests that a missing note is suspicious.

1.7
Interaction design

The attestation-verification gap

Because an attestation only carries weight when it can be checked later or is backed by consequence, the response makes the declaration binding without verifying it up front. It ties each submission to an identity, where even a pseudonym is enough to catch a pattern of false attestation after the fact, and scales the consequence to what the process decides: informal reputational discounting for an ordinary comment, formal sanction for a royal-commission or planning submission. The request is framed as a norm ('most people tell us how their submission was prepared'), not a penalty under threat, and a verified-identity slot sits ready for the same form to switch on as a verified government digital ID becomes available.

Preview the declaration at a different stakes level
City Digital Services · Submission declaration
This is a public comment on a minor change. Only a short declaration is needed.

How was this prepared?

Most people tell us how their submission was prepared.

Sign as
Your name
Sign with the name you give us.

The two ways to sign are drawn as peers: same size, same weight, no badge or check marking the verified path as better.

The verified-identity slot appears only in the formal proceeding, where it is wired but inactive: labeled for a verified government digital ID and marked unavailable. There the binding declaration must be checked before signing. The control above previews that version.