What is a Glass Wall?

Why "glass," and why "wall"?

Most privacy walls in workplace software are opaque: the employee is told what managers can see and has to take the description on faith. From the employee's side of an opaque wall, a policy and its absence look the same.

A Glass Wall is transparent about exactly one thing: what crosses. The group surface is the same artifact for everyone, so each member watches what the group sees, in the same render the most senior person gets. There is no separate description of the manager view to trust, because there is no separate manager view. The wall part is what does not cross: conversations, profiles, per-person anything. Transparency of the aggregate is what makes privacy of the individual believable.

How is a Glass Wall different from an anonymity promise?

An anonymity promise says: we could connect this input to you, and we pledge not to show anyone. Anonymity as a property says: the system cannot connect input to a person at all. Most workplace tools offer the promise, since their features need identity, and employees have learned to treat the promise as decoration. On a team of eight, a minimum group of three is a curtain, and everyone has done the math on who is behind it. The full argument is on are engagement surveys really anonymous.

A Glass Wall takes a third route. It does not claim the system has no identities, and it does not promise anonymity, which on a small team is not a promise anyone can keep. It claims something narrower that is always true: what crosses has no names attached, and beyond that only what a person raises themselves. Then it makes those verifiable: what crosses, on what test, with whose consent. The trust request shrinks from "believe our policy" to "look at your screen."

What does a Glass Wall require in practice?

The pattern is two lines. What crosses to the group has no names attached. Beyond that, only what a person raises themselves, with their name on it if they choose. Four tests decide whether a product delivers those lines or merely says them:

1. Symmetry. Is the group surface the same artifact for every role? If a manager, admin, or HR analyst has any additional individual-level view, the pattern is absent, whatever the marketing says.
2. Eligibility decided by subject, in code. Is the rule about what can cross rather than about how many people said it? An observation that is a property of the shared work can travel, with no name attached. An observation that is a property of a person cannot travel at all, at any group size. A rule an admin can loosen is a preference.
3. Contribution preview with pull rights. Can each person see, item by item, what of theirs is about to feed the aggregate, and remove any item beforehand, with removal meaning gone everywhere?
4. No individual egress. Is there any exportable, queryable, or renderable path from one person's input to another person's eyes in individual form? One such path, however gated, ends the pattern.

A product can pass some tests and fail others. Passing all four is what earns the name.

Why is there no minimum group size?

The second test used to be a number, and we shipped one before replacing it. A contributor threshold is the obvious first design, and it has to clear two bars at once. Set it low enough for a small team to reach and you get the curtain described above, with everyone doing the math on who is behind it. Set it high enough to actually hide a person and small teams can never form a group at all, which puts the pattern out of reach of exactly the teams with the least other infrastructure.

Underneath that, the count was doing the wrong job. A single integer was standing in for identifiability, and it is a poor proxy in both directions: it throws away what three people saw clearly, which is often the most useful thing a team knows, while four people on a distinctive topic stay perfectly identifiable. So the test moved from how many to about what. An observation that is a property of the work has nobody in the sentence to hunt for. An observation that is a property of a person is not eligible to travel at any count.

How does Teams by Activated Human implement the Glass Wall?

Teams is built as those four tests, passed on purpose, and the two lines they hold up are these: what crosses to the team has no names attached, and beyond that only what a member raises themselves, with their name on it if they choose. Every member gets Teal, a private work companion; the team gets the Team Mirror. The subject rule runs in code on both sides of the model: person-shaped material is withheld before the model ever sees it and checked again after, the model never sees a user id, and a move the lead's companion suggests on the strength of withheld material is dropped. The render is symmetric: every member and the lead receive the identical Mirror, and no manager surface exists anywhere in the product. Each member holds a contribution preview with the right to pull any item, and pulled items never appear. And the egress list is short by design: the only individual thing that ever travels upward is a raised signal the member wrote, endorsed word for word, and chose to send.

Four things are permanently outside the wall because we refuse to build them: individual dashboards for managers, sentiment scores on people, flight-risk flags, and productivity tracking. Each would be an egress path, and one egress path ends the pattern.

What can a Glass Wall not do?

Limits:

• It cannot make a lead forget what a lead already knows. On a team of three, a lead can often work out where an observation came from whatever grammar it uses. Nothing about a person crosses, so this is not a leak, and members on a small team are told so plainly rather than left to work it out.
• It only governs the channel it wraps. A Glass Wall cannot stop a lead from asking people things directly, or from guessing based on what someone says out loud in a meeting. It guarantees the system will never be the leak.
• It cannot generate honesty on its own. It removes the structural reason to answer carefully. Whether people then say true things depends on what the private side gives them; in Teams, that is the companion, and the design bet is that daily private value is what earns real use.
• It shrinks what the org can know, by design. A buyer who wants per-person insight is buying the wrong pattern, and no configuration of a genuine Glass Wall will provide it.

Questions people ask

Is a Glass Wall the same as k-anonymity?

No, and deliberately not. K-anonymity was the obvious first design here and we shipped past it, because a contributor count is a poor proxy for identifiability in both directions: it discards what three people saw clearly, and it still leaves four people on a distinctive topic identifiable. A Glass Wall decides eligibility by subject instead. An observation that is a property of the work can cross with one person behind it, and an observation that is a property of a person cannot cross at any count. Two further commitments k-anonymity does not make: the symmetric render, so there is no privileged view to trust, and the per-item preview with pull rights, so contribution is consented rather than assumed.

Who coined the term Glass Wall?

Glass Wall is the name Activated Human gave the pattern while building Teams in 2026. The ingredients are older. Information symmetry has a long history in organizational design, and the privacy literature has argued about aggregation thresholds for decades, including the argument that talked us out of using one. The name is ours. None of the thinking that got us here is.

Can other products build a Glass Wall?

Yes, and the four tests above are the spec. Any product that passes all four has one, whatever it calls the pattern. Most workplace tools fail the first test immediately, because manager dashboards are what they sell.

Why is there no minimum number of people behind a theme?

Because a count never protected anyone. A threshold small enough for a small team to clear is a curtain, and one large enough to be real makes small teams unservable. What decides eligibility instead is the subject: an observation that is a property of the work can travel, and an observation that is a property of a person cannot, at any number. One person who sees something clearly is often the most useful thing a team knows, and a threshold would have thrown it away.

Does the Glass Wall mean the lead learns nothing?

The lead learns what the team learns, plus whatever members chose to tell them directly: the Mirror, identical for everyone, and any raised signals sent up. A raised signal reaching the lead alone is not a back room, because a back room is somewhere a lead can look without you. That is less than a dashboard vendor offers and more than a survey produces, because the input behind it was said somewhere safe.

---

Teams runs the Glass Wall in production with every Team Mirror: see how it works. Related: how Teams works and is Teams legit.