Research Lab: Running a Study End to End

Running an experiment outside a laboratory means assembling the apparatus yourself. The intake form is easy. The export is easy. What is neither is the middle: knowing which participant is in which condition, how far through they are, and whether they finished, across hundreds of sessions that start and stop at the participant’s convenience.

A spreadsheet loses exactly that middle.

A participant completes an intake form: name, age, gender, education level, household income. The name identifies who responded while data is being collected, and is dropped from the analysis file. The final data is used in anonymised form.

From there the application holds a session for each participant, carries it through the study, and marks it complete at the end. Sessions can be reviewed, and the set exported.

171 people have been through it.

One failure is worth recording because it was silent. Row-level security correctly stopped anonymous participants from updating rows, which also stopped the call that marks a session complete at the end of the study. It failed without raising anything. Finished sessions looked abandoned. The fix was to route that one write through a backend function running with elevated privileges rather than as the participant.

A permission model strict enough to protect participant data will also, quietly, break a write you forgot you were making anonymously. The lesson is not to loosen the rule. It is that every write a participant triggers needs a test that runs as a participant, not as the owner of the database.