{"schema_version":1,"research_id":"eoa_inverse_innovation_exp06_external_evaluation_20260803","source_assessment_id":"ritualized_meaning_and_commitment_enactment__human_computer_interaction:P2:v0","cell_id":"ritualized_meaning_and_commitment_enactment__human_computer_interaction","search_queries":["multi-user smart home privacy household members administrator control study CHI","smart home privacy bystanders guests residents consent study ambient devices","official smart home privacy multi-user consent guidance household IoT","smart home privacy controls multiple residents product official camera permissions","site:usenix.org multi-user smart home privacy administrator household study prototype 2019","site:dl.acm.org \"Who's in Control\" multi-user smart homes","site:nist.gov smart home privacy multi user household IoT privacy framework","site:csa-iot.org Matter multi-admin access control smart home official","smart home technology domestic abuse privacy control household primary research paper","site:ftc.gov smart home connected devices privacy household cameras consent","site:ico.org.uk smart home devices household privacy cameras guidance domestic","site:consumer.ftc.gov smart home privacy devices shared household","site:ico.org.uk \"Guidance for consumer Internet of Things products and services\"","\"Privacy Perceptions and Designs of Bystanders in Smart Homes\" pdf","\"Exploring the Negotiation Behaviors of Owners and Bystanders\" pdf","\"Anticipating Smart Home Security and Privacy Threats with Survivors\" pdf"],"sources":[{"source_id":"S1","title":"Research Report: User Perceptions of Smart Home Privacy and Security (NISTIR 8330)","publisher":"National Institute of Standards and Technology","url":"https://www.nist.gov/publications/research-report-user-perceptions-smart-home-privacy-and-security","source_class":"GOVERNMENT_OR_REGULATOR","publication_date":"2020-11-17","accessed_at":"2026-08-03","claims_supported":["An interview study of 40 smart-home users found privacy, security, and physical-safety concerns.","Users lacked understanding and meaningful mitigation options because devices provided limited transparency and configuration support.","Manufacturers and third parties are identifiable actors capable of empowering users to take protective action."]},{"source_id":"S2","title":"Understanding and Improving Security and Privacy in Multi-User Smart Homes: A Design Exploration and In-Home User Study","publisher":"USENIX Association","url":"https://www.usenix.org/conference/usenixsecurity19/presentation/zeng","source_class":"PRIMARY_RESEARCH","publication_date":"2019-08","accessed_at":"2026-08-03","claims_supported":["Multi-user, multi-device homes present privacy, security, and usability problems not adequately handled by current products.","A prototype combining location-based access control, supervisory controls, and activity notifications was technically implemented and studied for one month in seven households.","The study is close prior art for household-level multi-user control but did not establish the proposed recurring ritualized consent process."]},{"source_id":"S3","title":"Exploring the Privacy Concerns of Bystanders in Smart Homes from the Perspectives of Both Owners and Bystanders","publisher":"Proceedings on Privacy Enhancing Technologies","url":"https://petsymposium.org/popets/2022/popets-2022-0064.pdf","source_class":"PRIMARY_RESEARCH","publication_date":"2022","accessed_at":"2026-08-03","claims_supported":["Among 200 owners and 100 bystanders, 70% of owners had only partial or no understanding of their smart-home data practices and 72% of bystanders reported privacy concern.","Owners and bystanders expressed willingness to negotiate, but differed over collection, storage, and sharing preferences.","The analysis of 17 devices found that 15 did not mention bystander privacy and two merely asked owners to be considerate.","Device vendors are explicitly identified as prospective implementers of negotiation and privacy-protection tools."]},{"source_id":"S4","title":"Spy-oT: Understanding How Users Learn to Use Internet of Things Devices For Abusive Purposes","publisher":"USENIX Association","url":"https://www.usenix.org/conference/soups2025/presentation/turk","source_class":"PRIMARY_RESEARCH","publication_date":"2025-08","accessed_at":"2026-08-03","claims_supported":["Household IoT features can be repurposed for intimate-partner abuse by people with varied technical expertise.","Access control and logging require redesign to reduce abuse risk.","A visible household consent exercise is unsafe to presume effective where coercion or retaliation is possible."]},{"source_id":"S5","title":"Share control of your home","publisher":"Apple Support","url":"https://support.apple.com/en-us/102386","source_class":"OFFICIAL_PRODUCT_DOCUMENTATION","publication_date":"2026-03-31","accessed_at":"2026-08-03","claims_supported":["Apple Home provides resident and guest roles, remote-access permissions, accessory-edit permissions, removal, and voluntary departure.","Residents receive broad accessory access, while guests receive scheduled local access to selected security accessories.","Removing a person in Apple Home may not remove permissions retained in separate accessory applications, demonstrating cross-vendor fragmentation."]},{"source_id":"S6","title":"Matter 1.6 Enables More Intuitive Setup, Multi-Ecosystem Experiences, and Context-Driven Control","publisher":"Connectivity Standards Alliance","url":"https://csa-iot.org/newsroom/matter-1-6-enables-more-intuitive-setup-multi-ecosystem-experiences-and-context-driven-control/","source_class":"STANDARD","publication_date":"2026-06-17","accessed_at":"2026-08-03","claims_supported":["Matter 1.6 provides Joint Fabric, allowing multiple user-authorized controllers to co-administer a shared network through a central datastore.","The standard offers a technical foundation for coordinated multi-party device access across ecosystems.","Implementation timelines remain vendor-specific, and the standard does not itself govern affected-person consent, retention, inference, or interpersonal disagreement."]},{"source_id":"S7","title":"How should we tell people what we're doing? — Guidance for consumer Internet of Things products and services","publisher":"Information Commissioner's Office","url":"https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/online-tracking/guidance-for-consumer-internet-of-things-products-and-services/how-should-we-tell-people-what-we-re-doing/","source_class":"GOVERNMENT_OR_REGULATOR","publication_date":"2026-06-11","accessed_at":"2026-08-03","claims_supported":["Organizations must give privacy information to all potential users whose information an IoT product processes, not only primary account holders.","The guidance recommends multiple accounts where useful, alternative notice channels, accessible interfaces, activity records, integration indicators, and privacy controls.","Relevant moments include account creation, security or product updates, feature enablement, and collection, supporting event-triggered reconsideration.","The ICO authorizes provider-facing transparency obligations, but household enactment cannot manufacture a lawful basis or replace provider compliance."]},{"source_id":"S8","title":"Securing Your Internet-Connected Devices at Home","publisher":"Federal Trade Commission Consumer Advice","url":"https://consumer.ftc.gov/articles/securing-your-internet-connected-devices-home","source_class":"OFFICIAL_GUIDANCE","publication_date":"2022-08","accessed_at":"2026-08-03","claims_supported":["Established household practice includes inventorying connected devices, reviewing administrative settings and camera access logs, disabling unused remote management, and disconnecting obsolete devices.","Voice assistants may listen continuously and transmit recordings to manufacturers.","These controls are practical comparators but remain device- and administrator-centered."]}],"problem_evidence":{"support":"STRONG","rationale":"Independent studies and official guidance converge on a visible problem: smart homes are multi-user systems, owners frequently misunderstand data practices, bystanders report concern and lack control, product designs privilege primary administrators, and stale or fragmented access can survive in separate applications. The evidence directly supports opacity, unequal standing, and cross-device governance gaps, although it does not establish prevalence for every household type or quantify realized harm from stale consent specifically.","source_ids":["S1","S2","S3","S5","S7","S8"]},"stakeholder_evidence":{"support":"MODERATE","rationale":"The ICO identifies manufacturers, platform and application developers, sensor providers, cloud providers, and product/UX teams as responsible audiences and requires information for all potential users. Apple and the Connectivity Standards Alliance have already invested in multi-user and multi-admin controls. Survey participants expressed willingness to negotiate smart-home data practices. These facts establish credible authorizers and prospective adopters, but no named organization or household cohort has requested or committed to the Listening Boundary Walk itself.","source_ids":["S3","S5","S6","S7"]},"prior_art":{"proximity":"ADJACENT_PRIOR_ART","closest_analogues":[{"name":"Zeng and Roesner multi-user smart-home application","similarity":"A working unified application combined household-member access controls, supervisory controls, notifications, and location-sensitive policy, followed by a month-long seven-household study.","remaining_difference":"It did not test a quarterly or change-triggered, symbolically marked room-by-room re-consent process with passable turns, an unresolved-conflict rule, rotating stewardship, and configuration-verified closure.","source_ids":["S2"]},{"name":"Owner-bystander smart-home privacy negotiation","similarity":"The study explicitly framed collection, storage, and sharing as negotiable between owners and affected bystanders and documented conflicting preferences.","remaining_difference":"It measured survey preferences and proposed tools; it did not enact recurring household negotiation, compare ritualized versus ordinary workflow, or verify resulting device behavior.","source_ids":["S3"]},{"name":"Apple Home resident and guest permissions","similarity":"A commercial platform supports invitations, differentiated roles, remote-control permissions, scheduled guest access, removal, and voluntary exit.","remaining_difference":"Authority remains centered on the Home owner and authenticated accounts; it lacks recurring affected-party re-consent, private dissent capture, cross-vendor data-flow mapping, and conflict governance. Separate application permissions may persist after removal.","source_ids":["S5"]},{"name":"Matter 1.6 Joint Fabric and multi-admin practice","similarity":"The standard enables multiple user-authorized controllers to coordinate device administration across ecosystems using a shared fabric and datastore.","remaining_difference":"Controllers and ecosystems are not equivalent to all sensed people; Matter does not provide the proposed social standing process, recurring consent review, or comprehensive controls for cloud retention, inference, recording, and interpersonal conflict.","source_ids":["S6"]},{"name":"ICO multiple-user IoT transparency and control guidance","similarity":"The regulator requires information for all potential users and describes multiple accounts, accessible notices, indicators, activity records, integration visibility, and moments for renewed disclosure after changes.","remaining_difference":"This is provider-facing transparency and legal-compliance practice, not a household ritual that reconciles conflicting boundaries and translates them into verified cross-device obligations.","source_ids":["S7"]},{"name":"FTC household IoT inventory and settings review","similarity":"Official guidance already recommends finding connected devices, reviewing settings and access logs, matching tracking settings to preferences, and removing obsolete capabilities.","remaining_difference":"It is an individual administrator checklist without distributed standing, witnessed disagreement, recurring re-consent, or comparison of enacted boundaries to multi-platform behavior.","source_ids":["S8"]}],"distinctive_claim_remaining":"In generally cooperative multi-person households, a quarterly and change-triggered, room-by-room process that marks sensing as under review, gives each affected person an individually passable or private turn, records unresolved disagreement, and verifies configuration closure will outperform the same device inventory and controls delivered through an administrator dashboard plus ordinary notifications or an unstructured household meeting on stakeholder and data-flow identification, surfaced boundary conflicts, completed configuration actions, delayed boundary recall, and privately reported ability to refuse—without increasing pressure, retaliation signals, unsafe disclosure, or configuration error.","confidence":"MODERATE"},"implementation_evidence":{"support":"MODERATE","rationale":"Technical components are individually credible: a multi-user prototype survived a month-long household study; Apple exposes roles and access changes; Matter 1.6 supplies a multi-ecosystem administration foundation; and FTC/ICO guidance describes inventories, logs, indicators, multiple accounts, accessibility, and change-triggered information. Workflow demand is supported by observed negotiation willingness. Feasibility is nevertheless incomplete because vendor clouds, inference, retention, and separate applications remain fragmented; the ritual has not been tested; lawful processing cannot be created by household ceremony; minors and dependent adults require jurisdiction-specific authority; and visible refusal can be dangerous in coercive homes. Initial evidence must therefore be sandboxed, safety-screened, privately measured, and separated from production configuration.","source_ids":["S2","S3","S4","S5","S6","S7","S8"]},"scores":{"meaningful_impact":{"score":4,"rationale":"The intervention targets documented opacity, bystander concern, administrator asymmetry, and potentially abusive access in an intimate environment. Impact could be meaningful if decisions reach actual controls, but prevalence and realized effect remain unmeasured.","source_ids":["S1","S2","S3","S4"]},"stakeholder_pull":{"score":3,"rationale":"Regulatory guidance, commercial multi-user features, a multi-admin standard, and participant willingness to negotiate show real pull for the underlying capability. No actor has expressed demand for this particular ritualized workflow.","source_ids":["S3","S5","S6","S7"]},"incremental_advantage":{"score":3,"rationale":"The proposal adds recurring distributed standing, explicit disagreement, and configuration closure to established dashboards, access controls, notices, and negotiation concepts. Whether symbolic enactment adds value beyond a well-designed inventory and structured checklist is untested.","source_ids":["S2","S3","S5","S7","S8"]},"distinctiveness_plausibility":{"score":3,"rationale":"No close match to the complete governed ritual cycle was found in the bounded search, but most functional elements have adjacent precedents and may constitute a workflow composition rather than a categorically new method.","source_ids":["S2","S3","S5","S6","S7","S8"]},"technical_implementability":{"score":3,"rationale":"Prototype research and current platform standards show that inventories, permissions, notifications, logs, and multi-admin controls are buildable. Comprehensive cross-vendor mapping and enforcement for retention, cloud inference, and separate applications are not presently assured.","source_ids":["S2","S5","S6","S7","S8"]},"adoption_authority_feasibility":{"score":2,"rationale":"Households can authorize a sandbox discussion, while providers control many authenticated settings and regulators control legal interpretation. Conflicting property, caregiving, child-protection, safety, and data-subject interests prevent the ritual from serving as a universal authorization mechanism.","source_ids":["S4","S5","S7"]},"evidence_readiness":{"score":3,"rationale":"The claim has observable comparators, artifacts, safety outcomes, and falsifiers, and adjacent studies offer reusable methods. A prototype protocol, recruiting partner, safety review, and instrumentation are still absent.","source_ids":["S2","S3","S4"]},"safety_net_benefit":{"score":4,"rationale":"Inventory, activity records, disagreement capture, removal tasks, and change-triggered review could expose stale access and protect less-privileged residents or visitors. Benefit is conditional because a visible exercise may itself enable coercion or retaliation.","source_ids":["S3","S4","S5","S7","S8"]},"scalability":{"score":2,"rationale":"Paper or sandbox facilitation is inexpensive locally, but quarterly household coordination, accessibility, facilitator safeguards, and integration across heterogeneous vendor accounts create substantial scaling friction.","source_ids":["S5","S6","S7"]}},"score_confidence":"MODERATE","costs":{"first_evidence":{"band_2026_usd":"10K_TO_50K","scope":"Pre-registration, safety and consent review, accessible sandbox materials, recruitment and compensation for 12–18 generally cooperative volunteer households, two counterbalanced sessions per household, independent facilitation, private follow-up, and analysis. This is a resource-equivalent estimate, not a sourced vendor quote.","confidence":"MODERATE","assumptions":["No production account or live device changes","A paper or lightweight sandbox map rather than a production application","Approximately 400–800 researcher, facilitator, and engineering hours","Household compensation and accessibility support included"],"source_ids":["S2","S3","S4"]},"initial_deployment_startup":{"band_2026_usd":"50K_TO_250K","scope":"Build and security-test an accessible instrumented prototype, create a device/data-flow coverage matrix, implement simulated adapters for three to five ecosystems, establish safeguarding and escalation protocols, complete legal review, and train facilitators.","confidence":"LOW","assumptions":["One jurisdiction","No general consumer release","Limited ecosystem coverage","Existing research organization supplies governance and insurance"],"source_ids":["S2","S4","S5","S6","S7"]},"operational_launch":{"band_2026_usd":"250K_TO_1M","scope":"A partnered pilot for roughly 100–300 households with production-grade authentication boundaries, three to five supported ecosystems, facilitator training, participant support, accessibility, privacy/security testing, incident response, and independent evaluation.","confidence":"LOW","assumptions":["Provider cooperation for relevant APIs and test accounts","No custom hardware","High-risk or adversarial households excluded","External security and privacy assessment included"],"source_ids":["S4","S5","S6","S7"]},"annual_recurring":{"band_2026_usd":"250K_TO_1M","scope":"Maintain integrations and device inventories, update legal and safety protocols, operate participant support and incident response, train replacement facilitators, audit outcomes, and conduct recurring reviews for a bounded regional service.","confidence":"LOW","assumptions":["Hundreds to low thousands of participating households","One regional legal regime","Quarterly plus event-triggered cycles","Material human facilitation retained rather than fully automated"],"source_ids":["S4","S5","S6","S7"]}},"verified_pipeline_gates":{"externally_supported_problem":{"status":"YES","reason":"Primary and official evidence independently documents multi-user opacity, bystander concern, owner-bystander preference conflict, inadequate controls, and fragmented permissions.","source_ids":["S1","S2","S3","S5","S7"]},"externally_credible_adopter_or_authorizer":{"status":"UNCERTAIN","reason":"The ICO is a credible authorizer of provider obligations, and Apple, Matter ecosystem participants, and device vendors are credible implementers of adjacent controls. No named organization or household cohort has expressed intent to adopt the proposed enactment.","source_ids":["S3","S5","S6","S7"]},"distinct_testable_incremental_claim":{"status":"YES","reason":"The remaining claim isolates the ritualized, distributed, recurring workflow from dashboard, notification, inventory, and meeting comparators using observable effectiveness and harm outcomes.","source_ids":["S2","S3","S8"]},"bounded_next_evidence_step":{"status":"YES","reason":"A counterbalanced sandbox study can test the complete workflow without changing live sensing, with predetermined measures, stop rules, comparators, and falsifiers.","source_ids":["S2","S3","S4"]},"no_unresolved_safety_or_authority_stop":{"status":"UNCERTAIN","reason":"A sandbox rehearsal is authorizable and reversible, but household coercion may be hidden, refusal may trigger retaliation, and authority for minors, dependents, caregivers, and safety-critical monitoring is jurisdiction- and case-specific. Live deployment requires empirical safeguarding evidence and partner review.","source_ids":["S4","S7"]},"credible_cost_scope_and_range":{"status":"UNCERTAIN","reason":"Broad resource-equivalent scopes and bands can be bounded, but no engineering specification, staffing plan, API-access commitment, insurer review, or external quote validates them.","source_ids":["S2","S5","S6","S7"]}},"next_evidence_step":"Run a preregistered, counterbalanced sandbox study with 12–18 safety-screened, generally cooperative volunteer households. Each household completes two sessions using the same fictionalized but household-relevant device and data-flow inventory: (A) an accessible unified dashboard with standard notices, private preference entry, and an ordinary unstructured discussion; and (B) the Listening Boundary Walk with a marked pause, room-by-room passable/private turns, unresolved-conflict register, and configuration-closure checklist. Randomize order, use simulated controls only, and have an independent facilitator. Blindly verify resulting artifacts against the simulated ground truth. Primary outcomes are correctly identified stakeholders, sensors, inferences and remote viewers; surfaced preference conflicts; correct and completed configuration tasks; and seven-day recall. Safety outcomes are private reports of pressure, retaliation concern, unwanted disclosure, inability to pass, and facilitator stop events. Falsify the incremental claim if condition B does not materially outperform A on identification and configuration fidelity, if any gain disappears after controlling for added time or inventory exposure, or if B produces more pressure, unsafe disclosure, configuration error, or stop events. Halt immediately for coercion signals, disputed authority, inaccessible participation, or safety-plan conflict; do not advance to production accounts without an independent proceed verdict.","blocking_evidence":["No comparative test isolates the ritualized elements from a structured dashboard, inventory review, notifications, or an ordinary meeting.","No named smart-home platform, regulator-sponsored program, service provider, or household cohort has committed to adoption or integration.","No demonstrated method inventories vendor-cloud processing, inference, retention, remote viewers, and permissions across heterogeneous ecosystems with acceptable completeness.","No empirical safeguarding evidence shows that private opt-outs, facilitator holds, and nonretaliation rules work in real households, especially where coercion, children, dependent adults, or care monitoring are present.","No validated staffing, integration, insurance, legal-review, or recurring-support cost model exists."],"research_disposition":"PARTNERED_RESEARCH_PROGRAM","world_novelty_boundary":"This evaluation searched only the recorded queries and relied on exactly the eight listed sources through 2026-08-03. It found adjacent research, products, standards, and official practices but no verified complete match to the proposed recurring ritualized household workflow. World novelty, patentability, freedom to operate, market size, and realized impact were not measured; absence from this bounded source set is not evidence of worldwide novelty.","arm":"COMPLETE_PROPOSAL_PORTFOLIO","candidate_version":0,"controller_recommendation":{"action":"STOP_EMPIRICAL_RESEARCH_NEEDED","repairable":false,"material_progress_observed":true,"progress_targets":["Complete the preregistered counterbalanced sandbox study and show incremental benefit over the dashboard-plus-discussion comparator without worse private safety outcomes.","Obtain written participation from a named platform, IoT provider, safeguarding organization, or regulator-supported research program with authority to support the next stage.","Produce and validate a cross-ecosystem coverage matrix for sensors, inferences, retention, remote access, logs, and reversible controls; explicitly quantify unknown and unenforceable flows.","Demonstrate independent screening, private reporting, halt, escalation, and rollback procedures for household power asymmetry, minors, dependent adults, caregivers, and safety-critical monitoring.","Replace resource-equivalent cost assumptions with a staffed work breakdown, API and security requirements, legal/insurance review, and at least one external implementation estimate."],"reason":"Web evidence strongly supports the problem and establishes adjacent technical and regulatory foundations, but the incremental effect, real-household safety, adopter commitment, integration coverage, and cost model require fieldwork, proprietary access, or live testing. Those gaps cannot be closed by additional bounded web research."},"proposal_index":2}