Mechanism Design for Marketplaces: Incentive Compatibility as a Product Requirement

TL;DR: A rating field, a review prompt, a ranking algorithm, a fee schedule, and a dispute button are not neutral instruments. Each is a mechanism, and the people on both sides play it strategically whether or not the product team modeled that. Mechanism design, the branch of game theory that won Hurwicz, Maskin, and Myerson the 2007 Nobel, supplies the test that separates data about preferences from data about strategy: incentive compatibility. The reputation literature shows what its absence costs. On eBay the public score averaged 99.3 percent positive while 3.39 percent of sales were bad experiences the mechanism never recorded (Nosko and Tadelis 2015). On an online labor market the share of perfect five-star ratings climbed from 33 to 85 percent in six years with no matching rise in private satisfaction, and 28.4 percent of workers an employer privately would not rehire still collected four or more public stars (Filippas, Horton, and Golden 2022). On Airbnb, hiding each review until both sides submitted cut the guest-host rating correlation by 48 percent (Fradkin, Grewal, and Holtz 2021). The fixes are concrete: simultaneous reveal, private feedback channels, verified-purchase gating, relative scales, rating the transaction rather than the person, fees as screening, and disputes with skin in the game. Treat incentive compatibility as a requirement that sits in the spec next to latency and accessibility, because a mechanism that rewards misreporting produces a database of strategy, and every downstream model inherits the distortion.

---

The Five-Star Marketplace That Knows Nothing

A marketplace I was asked to look at had a number its leadership was proud of: an average rating of 4.8 out of 5 across hundreds of thousands of completed transactions. The number appeared on the investor deck, on the supply-side recruiting page, and at the top of the internal quality dashboard. It was also, on inspection, close to worthless. Almost every rating was a five. The handful that were not clustered at one star, left by users so angry they overcame the friction of complaining. Between the mode at five and the small spike at one there was almost nothing, and the buyers who quietly had a mediocre experience and never came back had left no trace in the rating data at all. The 4.8 was not a measurement of quality. It was an artifact of who bothered to speak and what it cost them to speak honestly.

This is the ordinary condition of marketplace data, not a pathology of one company. The rating field looks like a thermometer, an instrument that passively records a temperature independent of the measuring. A rating field is nothing of the kind; it is a move in a game. The user deciding whether to leave one star, five stars, or nothing is choosing a strategy, and that strategy responds to the payoffs the platform built into the surrounding rules: whether the counterparty will see the rating, whether they can retaliate, whether a low rating triggers an argument, whether anyone reads it, whether leaving it costs thirty seconds the user would rather spend elsewhere. Change those payoffs and the data changes, even though the quality of the service has not moved.

The thesis of this essay is that the discipline built to reason about exactly this situation already exists, has a Nobel Prize attached to it, and is almost never invoked by the teams who most need it. Mechanism design is game theory run backwards. Ordinary game theory takes the rules as given and predicts how self-interested players will behave. Mechanism design takes the desired behavior as given and asks which rules produce it. Ratings, reviews, rankings, referral bonuses, fee structures, and dispute flows are all mechanisms in this precise sense, and the central design criterion, the one that tells you whether your data records preferences or records strategy, is incentive compatibility. My claim is narrow and practical: incentive compatibility belongs in the product requirements document, written down and tested for, in the same place a team writes down a latency budget or an accessibility standard.

Game Theory, Run Backwards

The formal question mechanism design asks is unusual, and it is worth stating carefully because the whole field falls out of it. A designer wants a certain outcome, an efficient allocation, a truthful ranking, an honest reputation score. The participants hold private information the designer cannot see: how much a bidder values an item, how good a seller really is, how satisfied a buyer really was. The participants will act to serve their own interests, not the designer's. The designer's only lever is the rules of the game. So the question is: which outcomes can a designer implement, given that the players will strategize inside whatever rules are set?

Leonid Hurwicz posed this in a form general enough to be a foundation. His 1972 framing introduced incentive compatibility as the property a mechanism needs when participants cannot be trusted to act against their own interest, and it reframed the design of economic institutions as a formal optimization problem rather than a matter of taste. Hurwicz, Eric Maskin, and Roger Myerson shared the 2007 Sveriges Riksbank Prize in Economic Sciences in Memory of Alfred Nobel for laying the foundations of the field. Maskin's contribution was implementation theory, the study of when a designer can rule out the bad equilibria as well as produce a good one; Myerson's included the two results a product team actually uses, the revelation principle and the characterization of optimal auctions.

The posture is what matters before any theorem. Most product teams treat their ratings and fees and dispute rules as user-interface decisions, to be settled by copywriting, visual hierarchy, and A/B testing on click-through. Mechanism design says these are the rules of a game that sophisticated players will exploit, and that the exploit is not a bug in the user, it is a property of the rules. The correct question about a rating prompt is not "is this pleasant to use" but "what is a rational user's best-response report, and does that report coincide with the truth I am trying to collect." When it does not, no amount of interface polish will save the data.

The revelation principle, without the algebra

The space of possible mechanisms is vast and strange. A designer could run a sealed-bid auction, an ascending auction, a lottery weighted by some elaborate function of what people say, a multi-round negotiation with side payments. Searching that space directly is hopeless. Myerson's revelation principle (1979, Econometrica 47(1), 61-73) collapses the search to something manageable, and the intuition is cleaner than its reputation suggests.

Take any mechanism you like and any equilibrium of it. In that equilibrium, each participant, holding their private information, has already worked out the best thing to do, submit this bid, click this rating, make this offer. Now imagine inserting a trusted intermediary between the participants and the mechanism. Each participant simply tells the intermediary their private information, and the intermediary plays, on their behalf, exactly the equilibrium action they would have chosen themselves. Nothing about the outcome changes. But notice what the intermediary has built: a new mechanism in which the only thing a participant does is report their private type, and in which reporting truthfully is optimal, because the intermediary will then take the action the participant would have wanted to take anyway. Lying to the intermediary can only make it act on wrong information and produce a worse result for the liar.

So any outcome achievable by any mechanism, however baroque, is achievable by a direct mechanism in which participants report their private information and truth-telling is an equilibrium. That is the revelation principle, and its consequence is liberating: a designer never has to invent clever indirect games, only to ask which honest outcomes are reachable. If honesty cannot be made optimal for the outcome you want, no clever interface will get you there either, because the direct mechanism is the most favorable case.

Incentive compatibility comes in two strengths, and the difference decides how much a designer can promise. The stronger form is dominant-strategy incentive compatibility, also called strategy-proofness: truthful reporting is optimal for each participant no matter what everyone else does. Writing θᵢ for participant i's private type, θᵢ' for any false report they might send, and f for the outcome the mechanism produces, the condition is

$u_i\big(f(\theta_i,\theta_{-i}),\,\theta_i\big)\;\ge\;u_i\big(f(\theta_i',\theta_{-i}),\,\theta_i\big)\qquad\text{for all }\theta_i,\ \theta_i',\ \theta_{-i}.$

Read it slowly. The left side is the participant's payoff from telling the truth; the right side is the payoff from any lie; and the inequality must hold for every combination of others' reports θ₋ᵢ. Because it holds for every θ₋ᵢ, the participant does not need to predict what others will do, guess their beliefs, or model their sophistication. Truth is a dominant strategy. That robustness is why designers prize it and why so few mechanisms have it.

The weaker form, Bayesian incentive compatibility, requires only that truth be optimal in expectation, given a participant's beliefs about the distribution of others' types. It asks the participant to average over the possibilities rather than to be safe against all of them. Much of real market design settles for the Bayesian version because the dominant-strategy version is unattainable, and one of the recurring judgment calls in practice is knowing which one your setting can actually support.

Vickrey, Clarke, Groves, and Why Nobody Ships It Raw

The celebrated existence result, the proof that strategy-proofness is not a fantasy, is the Vickrey-Clarke-Groves mechanism. William Vickrey (1961, Journal of Finance 16(1), 8-37) noticed that a sealed-bid auction in which the highest bidder wins but pays the second-highest bid makes truthful bidding a dominant strategy. Since what you pay is set by someone else's bid, shading your own can only cost you an item you wanted at a price you would have been happy to pay. Edward Clarke (1971, Public Choice 11, 17-33) and Theodore Groves (1973, Econometrica 41(4), 617-631) generalized the idea from a single item to the allocation of many goods or public projects.

The generalization has one beautiful idea at its center. To make each participant report their value honestly, charge them not for what they receive but for the harm their presence imposes on everyone else, the externality. Let a*(θ) be the allocation that maximizes total reported value and vⱼ be participant j's value. Participant i's payment is the difference between what everyone else could have gotten without i in the room and what they actually get with i present:

$t_i(\theta)\;=\;\max_{a}\sum_{j\ne i} v_j(a,\theta_j)\;-\;\sum_{j\ne i} v_j\big(a^*(\theta),\theta_j\big).$

Because your payment depends only on others' values, not on your own report, you can never improve your terms by lying about what you want. Truthful revelation becomes a dominant strategy, and the mechanism selects the allocation that maximizes total value. The Vickrey auction is the two-participant, single-item case of it.

And yet marketplaces almost never run the raw mechanism, which is the instructive part. Vickrey-Clarke-Groves is, in Ausubel and Milgrom's phrase, the lovely but lonely auction. Their 2006 analysis, and Michael Rothkopf's list the following year of reasons the process is not practical (2007, Operations Research 55(2), 191-197), catalog the failures. The revenue it raises can be low, even zero, when goods are complements. It is not budget-balanced: the payments do not sum to anything the designer can predict or rely on. It invites collusion and false-name bidding, where a single participant registers as several to manipulate the externality calculation, a vulnerability that is lethal online where identities are cheap. It requires participants to report full valuations over possibly enormous option sets, which is a cognitive and computational burden. And it exposes the winners' true values, which they hate. The theory proves strategy-proofness is possible; the practice shows it is one desideratum among several, and buying it at full price usually costs more than it is worth. Real mechanisms keep most of the incentive compatibility while trading a little away for revenue, simplicity, and robustness to manipulation. That compromise, not the pure theorem, is the craft.

The Economist as Engineer

The move from theorem to working market is a discipline in itself, and Alvin Roth named it. His 2002 essay "The Economist as Engineer" (Econometrica 70(4), 1341-1378) argued that designing a real market is closer to engineering than to physics: you cannot assume away the frictions, you have to build something that survives contact with the participants, and the test is whether the thing works, not whether it is elegant. Roth had earned the right to the analogy by redesigning the market that matches medical residents to hospitals and, later, the mechanisms that run kidney exchange and public-school choice in several American cities.

His 2008 survey of deferred-acceptance algorithms (International Journal of Game Theory 36(3-4), 537-569) drew out what the practical work had taught, and the lessons transfer directly to product. A mechanism has to be strategy-proof enough that participants do not need a consultant to play it well, because a game only experts can play safely is one most people play badly, and their bad play is the data you are stuck with. It has to resist congestion and unraveling, the tendency of participants to jump the official process, make offers early, or transact off-platform to escape rules they dislike. And stability matters: if two parties would both rather deal with each other than accept what the mechanism gave them, they route around it and the market frays. A marketplace whose rules are clever but gameable, or that push good actors elsewhere, unravels the way Roth's markets did before he redesigned them.

A rating field is not a thermometer. It is a move in a game the platform started, and the user always gets to move second.

Roth's framing is the bridge from auctions, the part of mechanism design everyone knows, to reputation, the part that governs most consumer marketplaces. An auction elicits one number, a willingness to pay, under conditions the designer largely controls. A reputation system tries to elicit an honest assessment of a completed interaction from a participant who has an ongoing relationship with the person being assessed, who fears retaliation, who may feel social pressure, and who gets nothing personally from telling the truth. As an incentive problem it is harder than any auction, and the empirical record of the last two decades reads as a slow, expensive rediscovery of that fact.

Reputation Systems, In Order

Chrysanthos Dellarocas set the terms in 2003. His paper "The Digitization of Word of Mouth" (Management Science 49(10), 1407-1424) argued that online feedback systems should be understood as mechanism-design problems, not as neutral conduits for opinion, and it named the threats a designer has to engineer against: getting participants to report at all when reporting is costly and unrewarded, getting them to report honestly when they have reasons to shade, and defending against manipulation by parties who can create identities cheaply. That last threat, which Dellarocas and others called whitewashing, is specific to the online setting: a seller who accumulates a bad reputation can often shed it by re-registering under a new name, so the system's memory is only as good as its identity layer. Every design pattern in the second half of this essay is a response to one of the threats Dellarocas listed.

What the numbers looked like at the start

Paul Resnick and Richard Zeckhauser gave the field its first hard look at real data (2002, "Trust Among Strangers in Internet Transactions," in The Economics of the Internet and E-Commerce, ed. Michael R. Baye, 127-157). Studying eBay in 1999, they found two things that should have been contradictory and were not. Feedback was provided more than half the time, which was surprising given that leaving it cost effort and returned nothing. And it was almost always positive, far beyond what any plausible distribution of actual experiences could justify. The system worked well enough to support trade among strangers, which was the headline and a genuine achievement. But the positivity was a warning that the field spent a decade failing to hear: a score that is almost always the maximum is not measuring quality, it is measuring something else.

That something else was reciprocity. On the old eBay, both parties could leave negative feedback, and each could see what the other had left. The result was a standoff. A buyer who had a mediocre experience hesitated to say so, because the seller could retaliate with a negative that would stain the buyer's own profile. Sellers timed their feedback to punish or reward. The visible outcome was a strong correlation between what buyers said about sellers and what sellers said about buyers, and a near-total absence of negatives, not because interactions were near-perfect but because honesty was individually costly.

Gary Bolton, Ben Greiner, and Axel Ockenfels named and measured the mechanism (2013, "Engineering Trust," Management Science 59(2), 265-285). Combining eBay data with controlled experiments, they showed that reciprocity distorts the production of reputation information at every stage, whether feedback is given, when it is given, and what it says, and that the distortion hampers trust and the efficiency of trade. Crucially, they framed the fix as an engineering problem: change how information flows through the system so that a rater's report cannot be used against them. The specific proposal, hiding each side's feedback until both have submitted, is the pattern a later Airbnb experiment would test at scale.

The measure that showed how little the score said

Chris Nosko and Steven Tadelis delivered the sharpest empirical blow (2015, "The Limits of Reputation in Platform Markets," NBER Working Paper 20830). Their starting observation was that eBay's standard "percent positive" score, the fraction of left feedback that is positive, was useless as a discriminator. Across sellers it averaged 99.3 percent with a median of exactly 100, which means almost every seller looked almost perfect and the score could not tell a good seller from a bad one. The reason is that dissatisfied buyers mostly stay silent rather than leave a negative, so the denominator, feedback that gets left at all, is a filtered and flattering sample. Roughly 65 percent of buyers left any feedback, and the ones who had a bad time were disproportionately in the silent 35 percent.

Their fix was a different denominator. Where percent positive is positive feedback divided by the sum of positive and negative feedback, they defined effective percent positive as positive feedback divided by all transactions, treating a transaction that generated no feedback as informative rather than as missing data. Because silence correlates with dissatisfaction, EPP recovers the signal the standard score threw away. Its distribution had the property a useful measure needs and the old one lacked: real spread. EPP averaged about 64 percent with a median of 67, and it varied enough across sellers to rank them.

The clinching figure is the one about silence. Only 0.39 percent of transactions received negative feedback, a number so small it suggests near-universal satisfaction. Yet 3.39 percent of transactions were bad buyer experiences by the platform's own record of disputes and messages, nearly nine times the negative-feedback rate. The score admitted about one bad experience in eleven that actually happened. A team steering supply on percent positive was flying on an instrument that had been calibrated by the people with the most reason to misreport.

Nosko and Tadelis then did what the framing implies. Because EPP is not visible to buyers and cannot be gamed by sellers, the platform can use it internally to rank supply. In a field experiment they changed search results for a random subset of buyers to promote higher-EPP sellers, and they report that the treated buyers had better transactions and were more likely to return and purchase again on eBay than the control group. The point is the direction, not the magnitude: the platform improved its own retention by ranking on a strategy-proof signal rather than on one users could manipulate. Steven Tadelis's later survey of the field (2016, "Reputation and Feedback Systems in Online Platform Markets," Annual Review of Economics 8, 321-340) makes the general case that platforms should treat feedback as a designed input to their own quality-control systems, not as a public scoreboard to be displayed and trusted at face value.

The Airbnb experiment that tested the fix

Andrey Fradkin, Elena Grewal, and David Holtz ran the cleanest test of the reciprocity fix (2021, "Reciprocity and Unveiling in Two-Sided Reputation Systems," Marketing Science 40(6), 1013-1029). Airbnb's baseline was already a heavily positive system: in the control group, 68 percent of trips produced a guest review and 72 percent a host review, and among guests who reviewed, 74 percent left a five-star overall rating and 48 percent gave the maximum on every category. Into this the authors introduced a simultaneous-reveal treatment. Each side's review was hidden until both had submitted, or until fourteen days had passed, after which reviews could not be changed. A reviewer could no longer read the counterparty's verdict before writing, and could no longer retaliate against a negative after seeing it.

The mechanism diagram below shows why the two regimes produce different data from the same underlying experiences.

Loading diagram...

The effects were exactly what the reciprocity theory predicts. Hiding the reviews barely moved participation, review rates rose 1.7 percent for guests and 9.8 percent for hosts, and it barely moved the average, the mean guest rating changed by only 0.25 percent. What it moved sharply was the strategic coupling between the two sides. The correlation between guest and host ratings fell by 48 percent, and the correlation of positive text between them fell by 50 percent. Nearly half of the apparent agreement between what a guest and a host said about each other was not shared reality; it was reciprocation, and removing the ability to see the other side's review before writing your own removed it.

The positive bars are increases in participation; the negative bars are reductions in reciprocity. The pattern is the signature of a mechanism fix that works: the volume of data went up a little, its honesty went up a lot, and the average, the number leadership tends to watch, hardly moved at all. A team looking only at the headline rating would have concluded the change did nothing. A team that understood it had removed a strategic distortion would have known its data had just become worth substantially more.

Reputation inflation, and why anonymity did not save it

The most disquieting result came from an online labor market, studied by Apostolos Filippas, John Horton, and Joseph Golden (2022, "Reputation Inflation," Marketing Science 41(4), 733-745; an earlier version appeared at the 2018 ACM Conference on Economics and Computation). Over six years, the share of transactions that received a perfect five-star rating rose from 33 percent to 85 percent. Nothing about the market's fundamentals improved enough to justify that climb, and the authors could show it directly because the platform also collected private feedback that the rated worker never saw. Private assessments did not inflate the way public ones did, and the wedge between the two grew over time. Modeling the two series against each other, the authors attribute more than half of the six-year rise in public scores to inflation rather than to genuine improvement.

The mechanism behind the inflation is the cost of honesty, again, in a new form. Leaving a low public rating harms the person you are rating, and the rater feels that harm, either through guilt or through fear of a reciprocal hit or a confrontation. Leaving a low private rating carries no such cost, because the rated party never learns of it. So the public score drifts up toward the ceiling while the private one stays put, and the gap between them is a direct measure of how much the mechanism is taxing the truth. The single most damning statistic is the divergence at the individual level: 28.4 percent of the workers an employer privately said they would not hire again nonetheless received four or more public stars from that same employer. The reverse case, a good private report paired with a bad public one, essentially never happened. Dishonesty ran in one direction only, the direction that avoided hurting someone.

The ceiling is not peculiar to labor markets. As the figure records, gig-platform ratings sit just as high: nearly 90 percent of UberX trips in one city in early 2017 carried a perfect five stars, and eBay's median seller shows 100 percent positive with even the tenth percentile at 98.21, both figures reported in Filippas, Horton, and Golden. When a five-point scale collapses to a binary of "five stars or a punishment," the four points below the top stop carrying information, and the mechanism has quietly discarded most of the resolution it appears to offer.

The experiment buried inside the same paper is the part product teams should tape to the wall. Reasoning that anonymity was the source of candor, the platform began releasing batched, anonymized aggregates of the once-private feedback to future employers, making it consequential to workers for the first time. The private feedback promptly began to inflate too. The moment the anonymous channel started to matter to the person being rated, the cost of honesty reappeared and honesty retreated. Anonymity, on its own, does not buy truthful feedback. What buys truthful feedback is making the report costless to the rater, and a report stops being costless the instant it can affect the person rated. That is a general law with uncomfortable design consequences, and the section on limits returns to it.

Manipulation, revenue, and the value of a verified transaction

Two more results complete the empirical picture. Dina Mayzlin, Yaniv Dover, and Judith Chevalier measured outright fakery by comparing the same hotels across two sites (2014, "Promotional Reviews," American Economic Review 104(8), 2421-2455). On Expedia, only a customer who booked through the site could review; on TripAdvisor, anyone could post. Comparing 350,485 TripAdvisor reviews with 123,569 Expedia reviews for the same properties, they found the signature of manipulation exactly where the theory said to look. Hotels with the most to gain from faking, independent properties with single-unit owners, had relatively more five-star reviews on the open site, and their nearby competitors had relatively more one-star reviews there. The gating rule, whether a reviewer had to have transacted, was the difference between a channel that mostly recorded experience and one that partly recorded sabotage.

Xiang Hui, Maryam Saeedi, Zeqian Shen, and Neel Sundaresan showed that the platform's own rules, not just its scores, shape seller quality (2016, "Reputation and Regulations: Evidence from eBay," Management Science 62(12), 3604-3616). When eBay strengthened buyer protection, the change reduced the premium that a reputation badge commanded, because buyers no longer had to lean on reputation alone, and it improved the market on two margins at once. Sellers raised their quality, a reduction in moral hazard, and low-quality sellers exited at a higher rate, a reduction in adverse selection. The authors estimate the buyer-protection change raised total welfare by about 2.9 percent. A guarantee is a mechanism too, and a well-designed one improves the pool of participants rather than merely insuring against the bad ones.

Finally, the money. Michael Luca established that these scores, gamed as they are, still move revenue (2016, "Reviews, Reputation, and Revenue: The Case of Yelp.com," Harvard Business School working paper 12-016). Using a regression-discontinuity design around Yelp's rounding thresholds to isolate the causal effect, he found that a one-star increase in a restaurant's rating raised revenue by 5 to 9 percent. The effect was concentrated among independent restaurants and absent for chains, whose brands already told customers what to expect. That asymmetry is itself a mechanism-design point: reputation systems substitute for the reputational capital that established brands carry internally, so they matter most exactly where quality is hardest to observe, which is also where the incentive to manipulate them runs highest.

The Patterns That Restore Incentive Compatibility

The literature does not just diagnose; it prescribes. Every failure above traces to one of a small number of design choices, and each has a known correction. None of the corrections is exotic. What they share is a common logic: make an honest report cheaper for the reporter, and cut the link between what a participant says and what it costs them.

Simultaneous reveal. Hide each side's review until both have submitted or a deadline passes, then freeze them. This is the Bolton-Greiner-Ockenfels proposal that the Airbnb experiment validated. It removes retaliation by removing the information a retaliator would act on, and the Airbnb result, a 48 percent cut in reciprocal correlation with almost no loss of participation, is the strongest single piece of evidence that a reputation mechanism can be repaired without being abandoned.

Private feedback channels. Collect an assessment the rated party never sees. Filippas, Horton, and Golden showed private feedback stays honest exactly as long as it stays inconsequential to the person rated, so a private channel is the platform's most truthful instrument for internal ranking, the way Nosko and Tadelis used EPP. The catch, which the same paper proved, is that the honesty evaporates the moment you make the private signal matter to the ratee. Keep it for your own decisions; do not turn it into a public score.

Verified-purchase gating. Accept reviews only from participants who provably transacted. Mayzlin, Dover, and Chevalier measured the cost of not doing this in fake positives and fake negatives. Gating is also the first line of defense against Dellarocas's whitewashing threat, since it ties a review to a real transaction and a real identity rather than to a disposable account.

Relative rather than absolute scales. A five-point scale on which four is treated as a failing grade has thrown away four-fifths of its resolution. Asking a rater to compare this transaction to alternatives, or to place it against a specific reference, recovers information that an absolute "rate from one to five" prompt suppresses once inflation has set in.

Rate the transaction, not the person. Much reciprocity and guilt attaches to judging a human counterparty you may deal with again. Framing the report as an assessment of a specific transaction, and one that is aggregated rather than pinned to the counterparty's visible profile, lowers the social cost of honesty.

Fees as screening devices. A fee is not only a revenue lever; it is a filter that separates committed participants from speculative ones, provided its cost differs across the types you want to separate. This is the single-crossing logic from signaling theory applied to entry: a listing fee or a refundable deposit is cheap for a seller who expects to fulfill and expensive for one who does not, so it screens even before any transaction generates a rating.

Disputes with skin in the game. A dispute process in which complaining is free and costless invites the loudest, most practiced complainer to win. Requiring both sides to post something at risk, a bond, a documented claim, a reputational stake, aligns the incentive to invoke the process with actually having been wronged.

Where Incentive Compatibility Runs Out

An essay that only sold the fixes would be dishonest, because incentive compatibility is not free, not always attainable, and not always legal. The theory that provides the design criterion also proves its own limits, and a serious product team should know where the wall is before it runs into it.

The first limit is an impossibility theorem. Roger Myerson and Mark Satterthwaite proved (1983, "Efficient Mechanisms for Bilateral Trading," Journal of Economic Theory 29(2), 265-281) that when a buyer and a seller each hold private information about value and cost, no mechanism can be simultaneously efficient, individually rational, budget-balanced, and incentive-compatible. Something has to give. In a dispute between two parties who each know things the platform does not, you cannot design a resolution process that is at once always fair, always voluntary, self-funding, and honesty-inducing. The practical consequence is that dispute mechanisms are necessarily compromises, and a team that promises all four properties to its users is promising something the mathematics forbids.

The second limit is the Gibbard-Satterthwaite theorem (Gibbard 1973, Econometrica 41(4), 587-601; Satterthwaite 1975, Journal of Economic Theory 10(2), 187-217). For a broad class of choice problems with more than two options and no money changing hands, the only strategy-proof mechanisms are dictatorial, meaning one participant's preference decides everything. Strategy-proofness without a price to work with is close to unattainable in the general case, which is why so many working mechanisms either introduce payments or settle for the weaker Bayesian form of incentive compatibility. When someone proposes a perfectly game-proof voting or ranking feature with no money in it, this theorem is the reason to be skeptical.

The third limit is legal, and it has grown sharper. A platform cannot always choose its disclosure rules freely: consumer-protection regulators in several jurisdictions now police fake and incentivized reviews, constrain how ratings may be aggregated and displayed, and in some cases require that certain information be shown. A mechanism that would be incentive-compatible in the abstract, say, suppressing a category of low ratings to reduce a known bias, can be unlawful in practice. The theory tells you what would elicit truth; the law tells you what you are permitted to do with it, and the two do not always agree.

Finally, some mechanisms that would improve the market are simply too unpleasant to ship. Vickrey-Clarke-Groves is strategy-proof and efficient and almost nobody runs it raw, partly because exposing every participant's true valuation and charging opaque externality-based prices is a miserable experience that invites collusion. The lesson generalizes: incentive compatibility is one property a mechanism can have, and it trades against revenue, simplicity, participation, perceived fairness, and legality. The job is not to maximize it. The job is to know how much of it you have, decide how much you need, and buy exactly that much on purpose rather than discovering after launch that you had none.

A Product Requirement, Not a Research Topic

The distance between the theory and most product practice is not a knowledge gap. It is a workflow gap. Latency has a budget because someone decided it was a requirement, wrote a number in a document, and built a test that fails the build when the number is exceeded. Accessibility has a checklist for the same reason. Incentive compatibility has neither, in most organizations, despite governing whether the marketplace's core data means anything, and the remedy is to give it the same standing.

Concretely, that means adding a short section to the specification of any feature that collects a rating, a review, a ranking input, a self-reported preference, or a reason for a decision. The section answers four questions. What is the participant's best-response report under these rules. Does that report coincide with the truth we are trying to collect. If not, what specifically makes honesty costly, and which of the known patterns removes that cost. And what will we measure after launch to detect that the mechanism has been gamed. The fourth question is the one teams skip and the one that catches the failure early: the diagnostics are cheap and known, the correlation between the two sides of a two-sided review, the gap between public and private signals, the ratio of reviews to verified transactions, the collapse of variance as the mean climbs, the rate of silent churn among users who never rated.

This posture connects marketplace reputation to a family of adjacent problems that share the same skeleton. The auction mechanics that decide which advertiser wins a slot are a mechanism-design problem in which the shift from second-price to first-price formats moved the strategic burden back onto buyers, treated at length in a sibling essay on the first-price shift. The question of how much of your review and price information to disclose, and when partial disclosure beats full transparency, is information design in the Bayesian-persuasion sense rather than reputation design, and a sibling essay takes it up on its own terms. What unites all three with the reputation literature is the refusal to treat the interface as neutral. The rules are a game, the participants will play it, and the only question is whether the team designed the game on purpose or by accident.

The marketplaces that will still be trustworthy in a decade are the ones that treated their reputation mechanics as mechanism design from the start, measured strategy as ruthlessly as they measured satisfaction, and were willing to ship the less popular, more honest mechanism when the two conflicted. The evidence that this pays is now two decades deep and unusually consistent for a social science. What remains scarce is not the knowledge. It is the willingness to write incentive compatibility into the requirements and to defend it against the metrics that will always, given the chance, vote for the comfortable lie.

Key Takeaways

1. A rating, review, ranking, fee, or dispute flow is a mechanism, not a measurement. Users choose their reports strategically in response to the payoffs the rules create, so the design question is "what is the best-response report," not "is this feature pleasant."
2. Incentive compatibility, the property that a participant's best move is to report truthfully, is the test that separates data about preferences from data about strategy. The revelation principle (Myerson 1979) lets designers restrict attention to rules under which honesty is optimal, because if honesty cannot be made optimal there, no cleverer game will do better.
3. Public reputation scores collapse toward the ceiling under reciprocity and the cost of honest negatives. On eBay, percent positive averaged 99.3 while 3.39 percent of transactions were bad experiences (Nosko and Tadelis 2015); on an online labor market, perfect five-star ratings rose from 33 to 85 percent in six years while private feedback did not (Filippas, Horton, and Golden 2022).
4. The fixes are known and cheap: simultaneous reveal cut Airbnb's reciprocal rating correlation by 48 percent with almost no loss of participation (Fradkin, Grewal, and Holtz 2021); verified gating suppresses the fake reviews that open sites carry (Mayzlin, Dover, and Chevalier 2014); private channels ranked internally recover the signal public scores throw away.
5. Anonymity does not keep feedback honest; costlessness does. A private signal stays candid only while it is inconsequential to the person rated, and it inflates as soon as the platform makes it matter (Filippas, Horton, and Golden 2022).
6. Incentive compatibility is bounded by impossibility results (Myerson-Satterthwaite for disputes, Gibbard-Satterthwaite for moneyless choice), by user tolerance, and by law. The goal is not to maximize it but to know how much you have, decide how much you need, and buy that much deliberately.
7. Put incentive compatibility in the spec next to latency and accessibility, with a best-response analysis before launch and gaming diagnostics after: two-sided correlation, public-versus-private gaps, reviews-to-verified-transactions ratios, and silent-churn rates.

Further Reading

• Two-Sided Network Effects Are Dead: The Rise of Multi-Sided Algorithmic Marketplaces, where the ranking algorithm, not the price, allocates attention, which is the mechanism this essay's reputation signals feed into.
• Platform Cannibalization Dynamics, the governance game a platform plays with its own complementors, a mechanism-design problem one layer up from reputation.
• Trust Signals and Their Measurable Lift: A Field-Test Compendium, the conversion-side complement, what reputation signals are worth once they reach a buyer deciding whether to transact.