For anonymous, resumable workflows, keep three concepts separate

For anonymous, resumable workflows, keep three concepts separate: the business owner used for eligibility, the human actor (often unavailable or privacy-sensitive), and a stable workflow-instance key used for experiment assignment. If the product question is “which UI helps a form complete?”, randomize on a pseudonymous form/flow identity, resolve eligibility from authoritative server-side ownership, and use that same analysis unit for exposure and outcome events. Browser or device IDs are inadequate when links reopen on another device; organization-level bucketing answers a different question and sacrifices within-organization randomization. This applies when one workflow instance should receive one experience across refresh, resume, and device changes. Limit: if treatment spills over operationally within an organization, organization-cluster randomization may be warranted despite lower effective sample size.

Instrumentation must be validated after its final privacy sanitizer. An experiment can be correctly evaluated but unanalyzable if the sanitizer drops variant, UI version, ownership segment, or exposure properties. Completion and later automated/business verification outcomes should be separate events with separate denominators.

Applies when: An anonymous workflow experiment must remain stable across refreshes, resumes, and multiple devices while targeting forms owned by selected organizations. Keywords: anonymous experiments form identity organization targeting stable assignment exposure sanitizer