Challenge · 01
Density alerts that never became action.
Design response
Make the route order — not the alert — the unit of governance, and count the loop closed only when movement is verified on the ground.
← All case files
Exercise / 2026.09 · Public Sector · Crowd Operations
One Fact
Crowd operations doctrine for a Kumbh-scale gathering, 2027
Proposal-stage doctrine: one authorised operating fact per route order, a closed loop from field signal to verified closure, guidance that survives without the network.
/State-Gov-India/ · Proposal
Proposal stage — no measured results. Acceptance targets only.
Proposal-stage file. This file is a consulting exercise: operating doctrine and service design prepared at proposal stage. Nothing here has shipped. Every number is a proposed acceptance target or an illustrative operating concept.
/ 01 · Stakes
What was on the line.
A Kumbh at Haridwar is a temporary city that runs for a 97-day season with ten major bathing festivals, routes that change by the hour, and peak days measured in lakhs of simultaneous sessions.
The Prayagraj cycle in January 2025 showed the limit of sensing on its own: control rooms, cameras and digital lost-and-found all worked, and a crush still happened — density alerts did not prevent closed exits and stagnant crowds. The brief was not another information app, but one State capability for movement, safety and verified action.
/ 02 · Approach
The proposed design, in five moves.
- 01
One authorised operating fact per route order
Sensors and users disagree, so none of them publishes. A versioned route order — with an owner, an effective time, an expiry and its evidence — is the only thing that does.
- 02
Close the loop, don’t add a dashboard
Field signal → common picture → authorised by a named officer → communicated to the affected zone → acted on → verified by movement on the ground.
- 03
Forecast 15–30 minutes ahead, intervene reversibly
A forecast says what changed, how certain it is, which reversible intervention it suggests and who must approve it.
- 04
Keep guidance alive when the network dies
A four-layer degradation ladder: the device, fixed help points, public low-bandwidth channels (SMS, IVR, PA, VMD) and the official local network.
- 05
Aggregate the crowd, protect the person
Aggregated cells with suppression thresholds for the operating map; personal data opens only for a named role, an active case and a minimum set of fields.
/ 03 · Challenges
Hard problems, and the design response.
Challenge · 02
Rumour outruns the official fact.
Design response
Repeated questions become a verification task: three checks produce one authorised fact, published only to the affected people and places, with an expiry.
Challenge · 03
Cellular collapse inside the geofence.
Design response
Signed, cached route orders on the device, printed location codes at help pillars, and offline-ready beat tablets — with declared freshness on every screen.
/ 04 · What the State decides
Scope and targets, not results.
- 97
- Day season
- 10
- Major bathing festivals
- 15
- Day joint discovery proposed
- 1
- Controlled pilot corridor
- Approve a 15-day joint discovery and one controlled pilot corridor
- Name the officers who own routes and incidents
- Scale only after field proof against agreed acceptance targets
- No promise of zero stampede, perfect prediction or AI final authority — officers remain accountable
/ 05 · Evidence
Proposal-stage exercise. No measured results; the acceptance and SLA matrix is written as contract language, with targets in place of outcomes.
- App / PWA with low-data safety mode
- SMS, IVR, PA and VMD channels
- Offline-ready beat tablets
- QR help points
- India-only hosting
Next case file · Insurance · AgritechHide Nothing — Cattle-claim insurance, biometric identityOpen file
