Keywords: Market design; affirmative action; reserve system; verifiability; transparency

JEL Classification: C78, D47, I28, I38

1 Introduction↩︎

In 2025, a family in Shenzhen, China, reportedly discovered that a reserved high-school seat that they believed should have been assigned to their daughter had instead been given to an ineligible student from the same middle school, prompting public calls for greater transparency.⁴ The episode reflects a broader challenge in the operation of modern admission clearinghouses. In China and many other countries, governments implement affirmative action policies in public school and university admissions through reserve systems that set aside quotas for targeted groups. Because the allocation is executed by a procedure the public cannot directly observe, these clearinghouses sustain trust by disclosing category-specific admission cutoffs and inviting participants to check that reserved seats are correctly assigned. This paper studies how to design such a clearinghouse so that this check is conclusive: every participant should be able to confirm both her assigned school and her seat type using only her own score and the disclosed cutoffs. We formalize this property, which we call verifiability, as a transparency requirement on the design of the clearinghouse, and we characterize which allocation mechanisms satisfy it together with individual rationality and strategy-proofness.

Public disclosure of this kind is a common governance device in reserve-based affirmative action. In Brazil, the government discloses category-specific cutoff scores for public university admissions through the nationwide SISU platform, and some universities additionally publish the profiles of admitted students [1], [2]. In India, affirmative action in public university admissions and government recruitment is similarly accompanied by disclosure of category-specific cutoffs and the names of admitted applicants [3], [4]. In China’s high school admissions, policymakers must disclose cutoff scores for each seat category at each high school, and some cities further publish the profiles of students admitted through reserve quotas. These disclosure practices make participants’ ability to verify outcomes a first-order design consideration. We conduct our analysis within the standard controlled school choice model (Section 2), in which students have multiple types and each school has type-specific reserve quotas, so that the framework applies to any admission clearinghouse where seat-type assignments must be verifiable.

Verifiability arises as a substantive design constraint specifically because affirmative action creates multiple seat categories within each school. Seat-type assignments record how reserve quotas are used: a student assigned to a reserved seat is a beneficiary of affirmative action, so verifying seat types is equivalent to verifying that the policy has been applied correctly in her case. If all seats were identical, students could verify their assigned schools by comparing their scores against publicly disclosed school-level cutoffs, a well-known property of stable mechanisms. However, when schools reserve seats for specific groups, each student faces two relevant cutoffs at any given school: one for open seats and one for her group’s reserved seats. When her score meets both cutoffs, her seat type is not determined by the cutoffs alone, and additional rules are required. Without a publicly known and consistent rule for resolving this ambiguity, students cannot consistently verify their seat-type assignments from disclosed information, potentially undermining public trust in the clearinghouse.

We study this problem using China’s high school admissions as our leading application, an unusually rich setting for our analysis. Unlike elementary and middle school admissions, which are largely residency-based, high school admissions in China are test-based and selective: each year, within each city, middle school graduates participate in a centralized test, and access to prestigious high schools is highly competitive. Middle schools differ in quality, and students from lower-performing middle schools are at a disadvantage in this competition. To address this concern, the central government mandates local policymakers to exogenously allocate a substantial share, typically 50% or more, of high school seats to graduating middle schools in proportion to their enrollments, creating a reserve system in which each student’s type corresponds to her middle school.⁵ Admission outcomes are reported together with seat types (reserved or open), and policymakers disclose cutoff scores for both seat categories, exactly the disclosed information on which our verifiability concept rests.

A striking feature of this institutional landscape is that Chinese cities operate a wide variety of mechanisms, differing in whether reserved and open seats are allocated sequentially or simultaneously and in the order in which the two seat types are processed, yet policymakers rarely provide formal justification for these choices. To document this variation, we compile the admission mechanisms used by 35 major Chinese cities (2). This diversity is the empirical puzzle that motivates our analysis: we show that verifiability provides a unifying lens that organizes observed designs in practice and yields concrete guidance for policymakers who must choose among them. The richness of this institutional context makes it an ideal setting for examining verifiability’s implications for clearinghouse design.

We motivate our concept through the class of sequential mechanisms, which are prevalent in Chinese cities despite their known strategic drawbacks. Sequential mechanisms allocate reserved and open seats in two separate stages, each employing the student-proposing deferred acceptance (DA) algorithm; only students not admitted in stage 1 participate in stage 2. There are two variants, distinguished by the order in which seat types are allocated: one allocates reserved seats in stage 1 and open seats in stage 2, while the other reverses this order. Because each stage produces a stable outcome independently, students can verify their assigned schools within each stage by comparing their scores against the stage-specific cutoffs disclosed by policymakers. Crucially, the separation of the two stages automatically resolves the seat-type assignment: once a student confirms admission in a given stage, she knows the corresponding seat type without any additional information. Section 3 formalizes this cutoff-based reasoning and shows that these properties together imply a natural verifiability property of sequential mechanisms (Proposition 1). However, sequential mechanisms have well-documented strategic flaws [7]–[9]: students may face a trade-off between securing a safer assignment in stage 1 and pursuing a more preferred one in stage 2, which can force nontrivial strategic behavior. This motivates the search for simultaneous mechanisms that preserve verifiability while providing stronger incentive properties.

The challenge for simultaneous mechanisms is that the joint allocation of reserved and open seats creates an ambiguity in seat-type assignment that sequential mechanisms avoid by design. When a student’s score meets both the open-seat cutoff and her type’s reserved-seat cutoff at her assigned school, her seat type cannot be inferred from the cutoffs alone. We address this by introducing two verification protocols for students under simultaneous mechanisms, each implementable using only a student’s own score and the publicly disclosed cutoffs and analogous to one of the two stage orderings of the sequential mechanisms. This restriction reflects the practical limits of both the information students can reasonably acquire and the computation they can reasonably perform, and is grounded in the verification procedures under sequential mechanisms already familiar in practice. Under the first reserve-first order, a student infers that she is assigned to a reserved seat whenever her score meets the cutoff for her type’s reserved seats; otherwise, she is assigned to an open seat. Under the second open-first order, a student infers that she is assigned to an open seat whenever her score meets the open-seat cutoff; otherwise, she is assigned to a reserved seat. A mechanism is then verifiable if every student can verify her own assignment consistently using one of these two orders; any outcome inconsistent with both orders is deemed unverifiable.

Verifiability is best understood as a governance property of the admission clearinghouse, with two complementary implications. First, it provides individual-level accountability: whenever the mechanism deviates from the announced rules, at least one student whose assignment is inconsistent will detect it. Any discrepancy can be expressed as a violation of the public cutoff-based rule, rather than as an opaque dispute over the internal allocation procedure. Second, verifiability is robust to heterogeneous information environments. In China, cities differ substantially in their disclosure practices: some disclose only cutoffs, others publish full profiles of students admitted through reserve quotas, and students sometimes privately collect information about peers. A verifiable mechanism provides consistent guarantees across all these environments: each student can verify her own assignment from the publicly disclosed cutoffs alone, and any student who acquires additional information about peers can apply the same verification rule to those peers’ assignments and reach the same conclusion. In this sense, verifiability ensures individual verification under minimal disclosure and broader consistency under richer disclosure.

Section 4 presents the main results. We first show that verifiability essentially characterizes two school choice rules, \(\mathcal{C}^{SimRO}\) and \(\mathcal{C}^{SimOR}\) (Theorem 1). We then show that the DA mechanisms induced by these two rules are essentially the only simultaneous mechanisms satisfying individual rationality, strategy-proofness, and verifiability (Theorem 2). The first rule, \(\mathcal{C}^{SimRO}\), assigns students to reserved seats before open seats, and is the unique verifiable rule consistent with the reserve-first order. It is not new: in the two-type setting with a single targeted group, it reduces to the choice rule of [10], and in more general environments with multiple types, it coincides with the reserves rule of [11]. The second rule, \(\mathcal{C}^{SimOR}\), is novel. It assigns seats as open seats first and uses reserved seats only when necessary, implemented through a within-school DA sub-procedure that treats applicants as preferring open seats to reserved seats. In the two-type setting, this construction is equivalent to filling open seats before reserved seats as studied by [12], who show that this rule maximizes the number of targeted students admitted within a broad class of choice rules. When there are multiple student types, however, \(\mathcal{C}^{SimOR}\) is not equivalent to any known rule in the literature.

The characterization of verifiable rules is nontrivial, and the difficulty lies in the multi-type case. In the two-type setting, verifiable rules correspond exactly to the two natural precedence orders of seat types. With multiple student types, however, every choice rule based on a fixed precedence order of seats is unverifiable (Section 6.1). This failure encompasses the broad class of slot-specific priority rules introduced by [13] and its generalization with capacity transfers by [14], both of which contain all fixed precedence orderings as special cases and have been applied to a wide range of allocation problems. The novel content of the characterization is therefore \(\mathcal{C}^{SimOR}\): its construction requires a DA sub-procedure that does not reduce to any fixed ordering of seat types, and establishing that it is, up to outcome equivalence, the unique verifiable rule consistent with the open-first verification order requires analysis specific to the multi-type case. Among outcome-equivalent rules, \(\mathcal{C}^{SimOR}\) always minimizes the use of reserved seats; it assigns seats as reserved seats only when necessary.

The mechanism characterization builds on the approach of [15], who show that if a choice rule axiom is punctual and satisfies path independence and size monotonicity, then the corresponding DA mechanism is the unique mechanism satisfying individual rationality, strategy-proofness, and the mechanism-level extension of that axiom.⁶ We extend their framework to accommodate seat types and verify that the required conditions hold in the extended setting; in particular, verifiability, formulated as a property of school choice rules, is punctual.

Among the two verifiable choice rules, we identify \(\mathcal{C}^{SimOR}\) as particularly appealing: it minimizes the use of reserved seats and, in the two-type setting, maximizes the number of students who benefit from affirmative action. We view reserve quotas as a budget that permits schools to admit targeted students ahead of higher-ranked peers: \(\mathcal{C}^{SimOR}\) spends this budget only when necessary, assigning reserved seats exclusively to students who cannot secure an open seat on merit, so that every reserved-seat assignment represents genuine affirmative action. Section 5 applies these results to interpret mechanism choices across Chinese cities and to discuss implications for other countries. Section 6 examines the relationship between \(\mathcal{C}^{SimOR}\) and related choice rules in the literature, including the de-reserve approach of [16] and the framework of [17]. Section 7 concludes. The appendix contains proofs and additional results.

1.0.0.1 Related Literature

Our paper contributes to the growing agenda on transparency, trust, and governance in the design and operation of marketplaces and allocation systems. Within this agenda, we study how the policymaker in a centralized admission clearinghouse can make affirmative action verifiable to its participants from minimal disclosed information. We organize the related work into three strands: the design of affirmative action through reserve systems, concepts of verification and transparency in mechanism design, and the role of processing orders in shaping admission outcomes.

Since the seminal work of [18], a rich literature has studied the design of affirmative action through reserve systems [10], [19], [20]; see [4], [16], and [17] for comprehensive surveys. We contribute to this literature by introducing verifiability as a mechanism design criterion. Our concept requires that students be able to verify both their assigned schools and their seat types using only their private scores and the publicly disclosed cutoffs. Seat-type verification is the key new element: without it, our concept reduces to a stability condition, which is too permissive to yield a meaningful characterization (Example 1).

The closest concept in the literature is the “verifiability problem” of [21]. Their paper takes the mechanism as given and asks which communication protocols allow students to verify their school assignments; verifiability is a property of the protocol. Our paper inverts the question: we fix the protocol (that is, policymakers disclose only seat-specific cutoffs) and ask which mechanisms are verifiable; verifiability is a property of mechanisms. Moreover, students must verify both assigned schools and seat types.

Other related concepts, including credibility [22], auditability [23], and transparency [21], [24], study whether policymakers’ deviations from announced mechanisms can be detected from participants’ observations, and therefore treat verification as a commitment or monitoring device at the mechanism level. Our concept differs in two respects. First, we do not ask whether policymakers manipulate disclosed cutoffs; we take disclosed cutoffs as truthful and ask whether assignments are consistent with them. Second, we assume specific verification protocols; any outcome inconsistent with them is deemed unverifiable, even if a more elaborate investigation with more information might reveal consistency. This restriction reflects the practical limits of both the information students can reasonably acquire and the computations they can reasonably perform.

The auditability condition of [25] also differs. It is used to characterize when certain desirable properties of a social choice or allocation rule can be certified from limited ordinal information. Our concern is not whether an outcome satisfies a welfare or efficiency benchmark, but whether an individual participant can verify her own school and seat-type assignment under a reserve system.

[26] introduce explainability for priority-based problems, focusing on justifying priority violations relative to feasible allocations; our concept concerns direct verification of assignments from disclosed information.

Our results are related to the reserves literature, but the connection is more nuanced than it may first appear. \(\mathcal{C}^{SimRO}\) is equivalent to the reserve rule of [11] in the multi-type setting and reduces to the rule of [10] in the two-type setting. However, seat-type verification under \(\mathcal{C}^{SimRO}\) does not follow immediately from this equivalence and requires additional analysis. \(\mathcal{C}^{SimOR}\) is more fundamentally novel: in the two-type setting it coincides with the open-first processing order of [12], who show it maximizes the number of targeted students within a broad class of rules, but in the multi-type setting it cannot be represented as a fixed seat priority ordering. We prove that all choice rules based on fixed precedence orderings of seats, including the slot-specific priority rules of [13] and the more general capacity-transfer rules of [14], fail verifiability when there are more than two student types. The de-reserve approach of [16], applied to one unverifiable rule we study, yields a rule outcome-equivalent to \(\mathcal{C}^{SimOR}\) but differs in construction.

The role of processing orders in shaping admission outcomes has been further analyzed by [27], [28], and [29], [30]. Most of the literature, including [18], [10], and [20], does not introduce seat types in outcomes, since students are indifferent over seats within a school; [31], [32] introduce seat types because participants have preferences over them. We introduce seat types to accommodate policy requirements even when students are indifferent, and show that this structure facilitates the analysis of affirmative action more broadly.

In concurrent work, [33] and [34] study the score floor constraints imposed on reserved-seat students in Chinese cities.⁷ [33] classify mechanisms by whether the constraint is fixed or dynamic and show that fixed constraints yield substitutable choice rules while dynamic constraints do not. [34] analyze the optimal allocation of score bonuses to eligible students and document the opacity and corruption vulnerability of China’s early mechanisms, which allowed middle schools to allocate reserved seats through pre-test procedures. The subsequent reform toward the centralized, test-based mechanisms we study underscores the importance of transparency in the implementation of affirmative action.

2 The Model↩︎

We define the controlled school choice model [11], [20] extended to incorporate seat types in outcomes. The model consists of the following elements:

• A finite set of students \(\mathcal{I}=\{i_1,\cdots,i_N\}\), with a typical student denoted by \(i\) or \(j\);

• A finite set of schools \(\mathcal{S}=\{s_1,\cdots,s_K\}\), with a typical school denoted by \(s\) or \(s'\);

• A profile of school capacities \(q=\{q_s\}_{s\in \mathcal{S}}\), where \(q_s \in \mathbb{N}\cup \{0\}\) denotes the number of seats at school \(s\). Let \(\emptyset\) denote a null school with an unlimited capacity;

• A profile of student preferences \(P_{\mathcal{I}}=\{P_i\}_{i\in \mathcal{I}}\), where \(P_i\) denotes the strict preference relation of student \(i\in \mathcal{I}\) over \(\mathcal{S}\cup \{\emptyset\}\). We write \(s R_i s^{\prime}\) if \(s P_is^{\prime}\) or \(s = s^{\prime}\). A school \(s\) is acceptable to student \(i\) if \(s P_i \emptyset\), and otherwise we call it unacceptable to \(i\);

• A profile of school priorities \(\succ_{\mathcal{S}}=\{\succ_s\}_{s\in \mathcal{S}}\), where \(\succ_s\) is the strict priority order used by school \(s\in \mathcal{S}\) to rank students. Each student \(i\) has a score \(\pi_{i,s} \in \mathbb{N}\) at each school \(s\) such that, for any two students \(i\) and \(j\), \(i \succ_s j\) if and only if \(\pi_{i,s}>\pi_{j,s}\); set \(\pi_{i,\emptyset}=0\) for all \(i\in \mathcal{I}\);

• A type space for students \(\mathcal{M}=\{m_1,m_2,\ldots,m_L \}\) and a function \(\tau: \mathcal{I}\rightarrow \mathcal{M}\) such that, for each student \(i\), \(\tau(i)\) is \(i\)’s type. For each \(m\in \mathcal{M}\), let \(\mathcal{I}^m= \tau^{-1}(m)\) denote the set of type-\(m\) students. For each \(I\in 2^\mathcal{I}\), let \(I^m= I\cap \mathcal{I}^m\);

• A profile of reserve quotas \(\{q_s^r\}_{s\in \mathcal{S}}\), where \(q_s^r=\{q_s^m\}_{m\in \mathcal{M}}\), such that \(q^m_s\in \mathbb{N}\cup \{0\}\) and \(\sum_{m\in \mathcal{M}} q_s^m < q_s\). For each school \(s\), \(q^m_s\) is the quota of reserved seats for type-\(m\) students, and \(q^o_s= q_s-\sum_{m\in \mathcal{M}} q_s^m\) is the quota of open seats for all students. We assume that \(q^m_s < |\mathcal{I}^m|\) for every school \(s\) and every student type \(m\).⁸

In the context of China’s high school admissions, \(\mathcal{S}\) represents the set of high schools, \(\mathcal{M}\) represents the set of middle schools from which students graduate, \(q^m_s\) represents the number of reserved seats at high school \(s\) for middle school \(m\), and \(\pi_{i,s}\) represents student \(i\)’s score in admission tests. Though Chinese students are typically ranked according to their test scores,⁹ our model allows schools to rank students using different priority orders.

2.0.0.1 Outcome

In the literature, a matching is often defined as a function that assigns students to schools without exceeding the capacity of each school. However, such a definition is insufficient to describe the admission outcome for our purpose. In our applications, policymakers are required to reveal the seat types admitted students occupy. Students occupying reserved seats are viewed as beneficiaries of affirmative action, who are protected from justified envy from students of other types. Different allocations of reserved seats indicate different implementations of affirmative action parameters.

Formally, an admission outcome in our model is defined as follows.

In Definition 1, for any student \(i\), if \((s,i,t)\in \mu\) for some \(s\in \mathcal{S}\) and \(t\in \mathcal{T}\), it means that \(i\) is admitted to a type-\(t\) seat at school \(s\). If \((\emptyset,i,t)\in \mu\) for some \(t\in \mathcal{T}\), it means that \(i\) is unmatched, in which case the type of her seat is irrelevant; for convenience, we say that \(i\) occupies an open seat at \(\emptyset\). Condition (1) says that each student is admitted to exactly one school, possibly the null school. Condition (2) says that each school’s capacity is respected. Condition (3) says that, for each \(m\in \mathcal{M}\), each school \(s\) provides at most \(q^m_s\) reserved seats to type-\(m\) students.

Given an outcome \(\mu\), for each school \(s\), let \(\mu(s)= \{(s,i,t)\in \mu:i\in \mathcal{I},t\in \mathcal{T}\}\), and for each student \(i\), let \(\mu(i)= \{(s,i,t)\in \mu:s\in \mathcal{S}\cup\{\emptyset\},t\in \mathcal{T}\}\). When there is no confusion, we also use \(\mu(s)\) to denote the set of students admitted to school \(s\) and use \(\mu(i)\) to denote the school admitting student \(i\). Given a school \(s\), for each seat type \(t\in \mathcal{T}\), let \(\mu^t(s)\) denote the set of admitted students who occupy type-\(t\) seats. Similarly, for each \(m\in \mathcal{M}\), let \(\mu^m(s)\) denote the set of type-\(m\) students admitted to \(s\). Additionally, we define \(\mu^{rm}(s)=\mu^r(s)\cap \mu^m(s)\), which is the set of type-\(m\) students who occupy reserved seats at \(s\). For each \(i\in \mathcal{I}\), let \(t^{\mu}_{i}\) denote the type of \(i\)’s seat in \(\mu\).

Given an outcome \(\mu\), by ignoring students’ seat types, we obtain a matching in the standard definition. Formally, a (standard) matching is a function \(u: \mathcal{I}\cup \mathcal{S}\rightarrow 2^{\mathcal{I}} \cup \mathcal{S}\cup \{\emptyset\}\) such that, for each \(i \in \mathcal{I}\), \(u(i)\in \mathcal{S}\cup \{\emptyset\}\), for each \(s\in \mathcal{S}\), \(u(s)\in 2^{\mathcal{I}}\) with \(|u(s)|\le q_s\), and for each student-school pair \((i,s) \in \mathcal{I}\times \mathcal{S}\), \(u(i)=s\) if and only if \(i\in u(s)\). We say that a matching \(u\) is induced by an outcome \(\mu\) if, for each \(s\in \mathcal{S}\), \(u(s)= \{i\in \mathcal{I}: (s,i,t)\in \mu \text{ for some } t\in \mathcal{T}\}\). A matching can be induced by multiple outcomes that differ in the allocation of seat types.

2.0.0.2 Stability

In the usual definition of stability proposed in the literature (e.g., [10]), a school’s reserve quota \(q^m_s\) is interpreted as a “floor” for affirmative action in the sense that, as long as there are enough applicants from \(\mathcal{I}^m\), the school must admit at least as many as the reserve quota, even if this creates priority violations. On the other hand, \(q^m_s\) is also treated as a “ceiling” for affirmative action in the sense that, once the school admits more type-\(m\) students than the reserve quota allows, the admitted students are no longer allowed to initiate priority violations. However, this treatment of reserve quotas does not align with the practices in many countries. In China, it is commonly observed that a high school admits more students from a middle school than the reserve quota allows, yet the high school still uses the reserve quota to prioritize students from that middle school.

In this paper, we interpret a reserve quota \(q^m_s\) as a “budget” for priority violations that school \(s\) can create to favor students from \(\mathcal{I}^m\); students from \(\mathcal{I}^m\) who benefit from such violations occupy reserved seats. By specifying seat types, our approach can accommodate various usages of the “budget”.

Specifically, in an outcome \(\mu\), a student \(i\) is said to have justified envy towards another student \(j\) if \(i\) prefers \(j\)’s assigned school to her own and has higher priority than \(j\) for that school, and either they have the same student type, or \(j\) occupies an open seat; that is, \(\mu(j) P_i \mu(i)\), \(i \succ_{\mu(j)}j\), and [\(\tau(i)= \tau(j)\) or \(t^{\mu}_j=o\)].

An outcome \(\mu\) is individually rational if no student is assigned to an unacceptable school; that is, for all \(i\in \mathcal{I}\), \(\mu(i) R_i \emptyset\).

An outcome \(\mu\) is non-wasteful if every school preferred by a student over her assignment allocates all of its seats to students; that is, for all \(i\in \mathcal{I}\) and all \(s P_i \mu(i)\), \(|\mu(s)|=q_s\).

Finally, an outcome \(\mu\) is reserve-non-wasteful if every school preferred by a student over her assignment has used up its reserve quota for that student’s type; that is, for all \(i\in \mathcal{I}\) and all \(s P_i \mu(i)\), \(|\mu^{r\tau(i)}(s)|=q^{\tau(i)}_s\). Schools are viewed as obligated to allocate reserved seats, up to the reserve quota, whenever eligible students request such seats.

Example 1 illustrates the flexibility of our definition in accommodating different allocations of reserved seats.

2.0.0.3 Mechanism

When defining mechanisms, we assume that only students’ preferences are unknown to policymakers. A mechanism specifies a strategy space \(\Sigma_i\) for each student \(i\) along with a function \(\psi\) that selects an outcome for each strategy vector \((\sigma_1,\sigma_2,\ldots,\sigma_n)\in \times_{i\in \mathcal{I}}\Sigma_i\). A mechanism is said to satisfy an axiom defined for an outcome if the outcome it finds for every strategy vector satisfies the same axiom. When \(\Sigma_i\) equals the domain of preferences for all \(i\in \mathcal{I}\), we call \(\psi\) a direct mechanism. In the paper, we assume that all strict preferences are possible and use \(\mathcal{R}\) to denote this domain. A direct mechanism \(\psi\) is strategy-proof if, for any preference profile \(P_\mathcal{I}\in \mathcal{R}^\mathcal{I}\), any student \(i\in \mathcal{I}\), and any possible manipulation \(P'_i\neq P_i\), \(\psi_i(P_\mathcal{I}) R_i \psi_i(P'_i,P_{-i})\). Two direct mechanisms are called equivalent if they find an identical outcome for every preference profile.

In the paper, we will discuss mechanisms that use different strategy spaces. Specifically, we will study mechanisms that require students to submit a pair of preference lists and that admit students to schools in two stages. We refer to them as sequential mechanisms. We will also study direct mechanisms and refer to them as simultaneous mechanisms, since they require students to submit a single preference list and assign them in one stage.

3 Verifiability of School and Seat Assignments↩︎

If policymakers were able to disclose information without constraint, then students could verify their assignments under any mechanism. In the extreme, if all details of the admission process were disclosed, students could replicate the entire procedure on their own computers and verify the assignments of all students. Such a level of transparency is clearly unrealistic. In practice, policymakers face institutional and cultural constraints that limit what can be disclosed. Motivated by the practices in several countries, we assume that policymakers publicly disclose no information beyond school cutoffs. Students must rely only on their private scores and the publicly disclosed cutoffs to verify their assignments.

Given an outcome \(\mu\), a school cutoff profile \(c(\mu)=\bigl(\{c^m_s\}_{m\in\mathcal{M}},c^o_s\bigr)_{s\in\mathcal{S}\cup\{\emptyset\}}\) specifies, for each school \(s\), the cutoff for type-\(m\) reserved seats, \(c^m_s\), and the cutoff for open seats, \(c^o_s\). We focus on non-wasteful outcomes: whenever a school has unfilled seats, they are available to any student, so the open-seat cutoff is set to zero. This yields: \[\label{equation:cutoff:new} \scalebox{.9}{c^m_s=\begin{cases} \min_{i\in \mu^{rm}(s)} \pi_{i,s}, & \text{if }|\mu^{rm}(s)|=q^m_s>0; \\ 0, & \text{if } q^m_s>0 \text{ and }|\mu^{rm}(s)|<q^m_s;\\ +\infty, & \text{if } q^m_s=0. \end{cases} \quad c^o_s=\begin{cases} \min_{i\in \mu^{o}(s)} \pi_{i,s}, & \text{if }|\mu(s)|=q_s; \\ 0, & \text{otherwise}. \end{cases} }\tag{1}\] The cutoffs for all seats at the null school are set to zero.

Given a cutoff profile \(c(\mu)\), the set of achievable schools for student \(i\) in outcome \(\mu\) is \[\mathcal{S}^\mu_i = \Bigl\{s\in\mathcal{S}\cup\{\emptyset\}\colon \pi_{i,s}\ge \min\bigl\{c^{\tau(i)}_s,\, c^o_s\bigr\}\Bigr\}.\] School \(s\) is achievable to student \(i\) if her score meets at least one of the cutoffs at \(s\). We use \(\max (P_i, \mathcal{S}^\mu_i)\) to denote the best school among \(\mathcal{S}^\mu_i\) according to \(P_i\).

In the classical school choice framework, [35] show that every stable matching corresponds to a vector of market clearing school cutoffs, and vice versa. This remains true in school choice with a reserve system.

Lemma 1 shows that every student can verify her school assignment using only her own score and the disclosed cutoffs. So, the true challenge is the verification of seat-type assignment: when a student’s score meets both \(c^{\tau(i)}_s\) and \(c^o_s\) at her assigned school \(s\), the cutoffs alone do not determine whether she occupies a reserved or an open seat.

Section 3.1 shows that sequential mechanisms resolve this ambiguity naturally through their two-stage structure, and characterizes the resulting verification procedures. Although sequential mechanisms are strategically complex, their verification procedures serve as templates for the concept of verifiability for simultaneous mechanisms introduced in Section 3.2.

3.1 Verifiability in Sequential Mechanisms↩︎

Sequential mechanisms allocate reserved seats and open seats across all schools in two distinct stages. Each student \(i\) is required to report a pair of preference lists \((P^r_i, P^o_i)\) before the mechanisms are run: \(P^r_i\) is for the reserved-seat stage and \(P^o_i\) is for the open-seat stage. Depending on the order of the two stages, we call the two variants sequential-reserve-open (SeqRO) and sequential-open-reserve (SeqOR) respectively. SeqRO allocates reserved seats in stage 1 and open seats in stage 2, and SeqOR reverses the order. In both mechanisms, each stage runs DA using participating students’ reported preferences and schools’ quotas.

• SeqRO: Stage 1 runs DA using students’ reported \(P^r_i\) and schools’ reserve quotas \(q^m_s\). In each step, each unassigned student \(i\) applies to the highest-ranked acceptable school in \(P^r_i\) that has not rejected her; each school \(s\) tentatively admits the highest-priority applicants of each type \(m\) from new applicants in this step and tentatively admitted applicants from the previous step, up to quota \(q^m_s\). Stage 1 stops when each student either has been admitted to an acceptable school or has been rejected by every acceptable school. At each school \(s\), admitted students occupy reserved seats, and any unfilled reserve quota is added to its open-seat quota for stage 2. Unassigned students in stage 1 participate in stage 2.

  Stage 2 runs DA using participating students’ reported \(P^o_i\) and schools’ open-seat quotas, similar to Stage 1 except that, in each step, each school \(s\) tentatively admits the highest-priority applicants regardless of their type up to the open-seat quota. Admitted students occupy open seats. Students not admitted in both stages are unmatched.

• SeqOR: The order of the two stages of SeqRO is reversed, with the difference that stage 1 runs DA using schools’ original open-seat quotas \(q^o_s\).

Under SeqRO, the unassigned reserved seats in stage 1 are allocated as open seats in stage 2. However, in SeqOR, the reserve quotas are set aside when open seats are allocated in stage 1. Consequently, the unassigned reserved seats in stage 2 of SeqOR can be wasted. Under both mechanisms, since each stage runs DA, the outcome in each stage is stable with respect to participating students’ submitted preferences and is therefore characterized by school cutoffs. Students can thus verify their school assignments using only their private scores and publicly disclosed school cutoffs in both stages. A student first verifies whether she is eligible for any school in stage 1, and if so, whether she is assigned to the best such school according to her submitted preferences. If she is not eligible for any school in stage 1, she then verifies whether she is eligible for any school in stage 2, and if so, whether she is assigned to the best such school according to her submitted preferences. Once a student’s assigned school is verified in either stage, her seat-type assignment is automatically verified.

The above observation is simple, but we formalize it for later reference. Under SeqRO, the school cutoffs are defined by 1 : unfilled reserved seats are converted to open seats, so the cutoff convention follows the non-wasteful formula. Under SeqOR, the reserved-seat cutoff is calculated as in 1 , but because reserved seats are set aside when open seats are allocated, the open-seat cutoff depends only on the exogenous open quota: \(c^o_s=\min_{i\in \mu^{o}(s)} \pi_{i,s}\) if \(|\mu^o(s)|=q^o_s\), and \(c^o_s=0\) otherwise.

Given students’ submitted preferences \(\{P^r_i, P^o_i\}_{i\in \mathcal{I}}\) and the school cutoff profile \(c(\mu)\) in an outcome \(\mu\), we define \(\mathcal{S}^o_i= \{s\in \mathcal{S}: \pi_{i,s}\ge c^o_s,~sP^o_i \emptyset \}\) and \(\mathcal{S}^r_i=\{s\in \mathcal{S}: \pi_{i,s}\ge c^{\tau(i)}_s,~sP^r_i \emptyset\}\) as the sets of schools achievable to a student \(i\) in the two stages.

The following result formalizes students’ verification order under the two mechanisms.

We omit the proof of the above proposition since it resembles Lemma 1.

Although sequential mechanisms have intuitive verifiability properties, they are manipulable and might be strategically complex for students. Students often confront a trade-off between securing a safe assignment in stage 1 and risking the possibility of obtaining a better assignment in stage 2. Appendix 10 presents a Nash equilibrium (NE) analysis of sequential mechanisms under the complete information assumption (Proposition 5). The set of NE outcomes of SeqRO coincides with the set of stable matchings; in contrast, under SeqOR, not every stable matching is attainable as a NE outcome, and wasteful NE outcomes may arise. However, incomplete information prevails in practice and complicates students’ strategies. This motivates our search for strategy-proof simultaneous mechanisms in Section 4.

3.2 Definition of Verifiability for Simultaneous Mechanisms↩︎

Although sequential mechanisms are verifiable by design, they are strategically complex. Simultaneous mechanisms address this by assigning all seats in a single stage with a single preference list. However, unlike sequential mechanisms, they must resolve seat-type assignment without the benefit of separate stages: once a student’s school assignment is verified, the cutoffs alone may not determine whether she occupies a reserved or an open seat. So we need an exogenous rule to resolve the ambiguity.

We propose a verification protocol with two variants that mirror the two verification orders under sequential mechanisms: the reserve-first order and the open-first order. Under the reserve-first order, which mirrors SeqRO, a student infers that she occupies a reserved seat if her score meets her type’s reserved-seat cutoff at her assigned school, and an open seat otherwise. Under the open-first order, which mirrors SeqOR, she infers that she occupies an open seat if her score meets the open-seat cutoff, and a reserved seat otherwise. Both orders require only the student’s own score and the two seat-type cutoffs at her assigned school. Importantly, they are the only orders that naturally extend the familiar verification protocols under sequential mechanisms. The paper asks which simultaneous mechanisms preserve those familiar verification protocols.

We formally define verifiability for an outcome as follows.

We then define verifiability for a simultaneous mechanism as follows.

The following example illustrates the concept by contrasting a verifiable outcome with an unverifiable one.

4 Verifiable and Strategy-proof Simultaneous Mechanisms↩︎

For simultaneous mechanisms, verifiability implies stability because the definition of verifiability incorporates a cutoff characterization of outcomes. Since we also seek strategy-proofness, this motivates our focus on the class of DA mechanisms, which differ in the choice rules used by schools. We therefore begin by defining choice rules.

A standard choice rule in the literature specifies the set of students chosen by a school from every potential set of applicants. Formally, a standard choice rule for a school \(s\) is a function \(C: 2^{\mathcal{I}}\rightarrow 2^{\mathcal{I}}\) such that, for each \(I\in 2^{\mathcal{I}}\), \(C(I)\subseteq I\) and \(|C(I)|\le q_s\). For each \(m\in \mathcal{M}\), let \(C^m(I)\) denote the set of type-\(m\) chosen students.

In this paper, a choice rule \(\mathcal{C}\) must additionally specify the seat types assigned to chosen students. To simplify the definition, we treat school \(s\) and the set of applicants \(I\) as forming an artificial economy in which all applicants regard school \(s\) as acceptable. We then require \(\mathcal{C}(I)\) to be a well-defined outcome in this economy. This requirement ensures that \(\mathcal{C}(I)\) respects the quotas for all seat types at school \(s\). Let \(\mathcal{C}\langle I \rangle\) denote the set of chosen students under \(\mathcal{C}(I)\). For each \(t\in \mathcal{T}\), let \(\mathcal{C}^t\langle I \rangle\) denote the set of chosen students who occupy type-\(t\) seats. For each \(m\in \mathcal{M}\), let \(\mathcal{C}^{tm}\langle I \rangle=\mathcal{C}^t\langle I \rangle\cap I^m\). For each chosen student \(i\), let \(t^{\mathcal{C}(I)}_i\) denote her assigned seat type. Throughout the paper, we use the calligraphic font \(\mathcal{C}\) to denote a choice rule specifying seat types, and use \(C\) to denote a standard choice rule that does not specify seat types. We say that \(C\) is induced by \(\mathcal{C}\) if, for all \(I\in 2^{\mathcal{I}}\), \(C(I)= \mathcal{C}\langle I \rangle\).

We extend the concept of verifiability to choice rules.

It is well known that substitutability of choice rules is sufficient and almost necessary for the functioning of DA and for the stability of its outcome. The definition of substitutability does not refer to students’ seat types: a standard choice rule \(C\) is substitutable if, for all \(I\in 2^\mathcal{I}\) and all distinct \(i,j\in I\), \(i \in C(I)\) implies \(i \in C(I\backslash\{j\})\); \(C\) is \(q\)-acceptant if, for all \(I\in 2^\mathcal{I}\), \(|C(I)| =\min\{q, |I|\}\). A choice rule \(\mathcal{C}\) is said to satisfy these properties if the induced \(C\) satisfies them.

The following result is the foundation for our approach.

Section 4.1 characterizes verifiable choice rules. Section 4.2 characterizes verifiable and strategy-proof simultaneous mechanisms. We show that these mechanisms must be DA associated with the choice rules characterized in Section 4.1. So, our restricted attention to the class of DA mechanisms at the outset is without loss of generality.

4.1 Characterization of Verifiable Choice Rules↩︎

We first characterize verifiable choice rules. By Definition 5, if a choice rule \(\mathcal{C}\) is reserve-first verifiable, then, in any outcome \(\mathcal{C}(I)\), students of each type who occupy reserved seats must have higher priority than students of the same type who occupy open seats. Moreover, the reserved seats for a given type must be exhausted before any student of that type is assigned to an open seat. If the reserved seats for some type are not exhausted, then any unassigned reserved seats must have been converted into open seats, provided that some students are rejected. This observation naturally leads to the following choice rule, denoted by \(\mathcal{C}^{SimRO}\).

• For each \(I\in 2^{\mathcal{I}}\), \(\mathbf{\mathcal{C}^{SimRO}}\) selects students as follows: In the first step, for each \(m\in \mathcal{M}\), allocate reserved seats to the highest-ranked applicants from \(I^m\) up to the reserve quota \(q^m_s\). In the second step, all remaining seats are treated as open seats and allocated to the highest-ranked students among remaining applicants, regardless of their type.

We call the corresponding DA mechanism simultaneous-reserve-open (SimRO). Theorem 1 proves that \(\mathcal{C}^{SimRO}\) is the only reserve-first verifiable choice rule.

On the other hand, if a choice rule \(\mathcal{C}\) is open-first verifiable, then, in any outcome \(\mathcal{C}(I)\), students occupying open seats must have higher priority than those occupying reserved seats, regardless of their type. This suggests that such a choice rule should assign open seats before reserved seats. We now define a choice rule inspired by this idea, which can be viewed as a natural counterpart of \(\mathcal{C}^{SimRO}\). The rule first assigns students to open seats up to the open quota, and then assigns the remaining students to reserved seats for their respective types up to the corresponding reserve quotas. A subtlety arises when the reserved seats for some type are not filled by targeted students: to ensure non-wastefulness, the unfilled reserved seats should be made available again as open seats. This leads to the choice rule denoted by \(\mathcal{C}^{SimORO}\).

• For each \(I\in 2^{\mathcal{I}}\), \(\mathbf{\mathcal{C}^{SimORO}}\) selects students as follows: In the first step, allocate open seats to the highest-ranked students, regardless of their type, up to the open quota \(q^o_s\). In the second step, for each \(m\in \mathcal{M}\), allocate reserved seats to the highest-ranked remaining students from \(I^m\), up to the reserve quota \(q^m_s\). In the last step, if there exist unfilled reserved seats, they are treated as open seats and allocated to the highest-ranked remaining students, regardless of their type.

We call the corresponding DA mechanism simultaneous-open-reserve-open (SimORO). As discussed in Section 5, both SimRO and SimORO are used in China’s high school admissions.

However, unlike \(\mathcal{C}^{SimRO}\), \(\mathcal{C}^{SimORO}\) is not open-first verifiable. It is not surprising because in \(\mathcal{C}^{SimORO}\), reserved seats might be assigned in a step between steps in which open seats are assigned. As a result, a student occupying a reserved seat may be ranked between two students occupying open seats. Section 6.1 shows that all choice rules with fixed precedence orders of reserved and open seats are not verifiable.

Now, we are ready to present our characterization of open-first verifiable choice rules. We define a specific choice rule, \(\mathcal{C}^{SimOR}\), which selects students by running DA in an artificial economy consisting of school \(s\) and the set of applicants \(I\). Different from the artificial economy previously discussed, here, we regard “open seats” (denoted by \(s^o\)) and “reserved seats” (denoted by \(s^r\)) as two contract terms and assume that all students prefer \(s^o\) over \(s^r\).

• For each \(I\in 2^{\mathcal{I}}\), \(\mathbf{\mathcal{C}^{SimOR}}\) selects students as follows: In the artificial economy consisting of school \(s\) and students \(I\), run DA by letting all students apply to \(s^o\) before applying to \(s^r\). In each step, after receiving applications, for each \(m\in \mathcal{M}\), \(s\) first assigns reserved seats to the highest-ranked students from \(I^m\) who apply to \(s^r\), up to the quota \(q_s^m\). Then, \(s\) allocates the remaining seats as open seats to the highest-ranked remaining students, regardless of their type, who apply to \(s^o\). The result of this DA procedure determines the set of chosen students along with their seat types.

We call the corresponding DA mechanism simultaneous-open-reserve (SimOR).

\(\mathcal{C}^{SimOR}\) is open-first verifiable. While there may exist other open-first verifiable choice rules, Lemma 3 proves that they must select the same set of students as \(\mathcal{C}^{SimOR}\), and among them, \(\mathcal{C}^{SimOR}\) always assigns the minimum number of reserved seats. For a choice rule \(\mathcal{C}\) and a set of applicants \(I\), we respectively use \(\mathcal{C}^r\langle I \rangle\) and \(\mathcal{C}^o\langle I \rangle\) to denote the set of chosen students who occupy reserved seats and the set of chosen students who occupy open seats.

Example 3 illustrates the selection procedure of \(\mathcal{C}^{SimOR}\) and its difference from other open-first verifiable choice rules.

The following theorem is our first main result in the paper.

In words, \(\mathcal{C}\) is open-first verifiable if and only if it always selects the same set of students as \(\mathcal{C}^{SimOR}\), and there exists a threshold student \(j\) who occupies an open seat under \(\mathcal{C}^{SimOR}\) such that all selected students ranked below \(j\) are assigned reserved seats, and all selected students ranked at or above \(j\) are assigned open seats. \(\mathcal{C}^{SimOR}\) itself corresponds to choosing \(j\) as the lowest-priority open-seat student, thereby minimizing reserved-seat assignments.

Let \(C^{SimRO}\) and \(C^{SimOR}\) denote the standard choice rule induced by \(\mathcal{C}^{SimRO}\) and \(\mathcal{C}^{SimOR}\), respectively. We obtain the following corollary.

4.2 Characterization of Verifiable and Strategy-proof Mechanisms↩︎

We extend our characterization of verifiable choice rules to a characterization of verifiable and strategy-proof mechanisms. By Lemma 2, as long as schools use substitutable and verifiable choice rules, the corresponding DA mechanism is individually rational, strategy-proof, and verifiable. However, it does not preclude the potential existence of other mechanisms that possess these properties but do not belong to the class of DA mechanisms. In the following, we show that all such mechanisms must be essentially equivalent to those DA mechanisms.

We utilize the result of [15] to obtain our characterization. In a matching with contracts model, [15] call an axiom for standard choice rules punctual if it imposes a requirement on choice problems that can be checked without referring to other choice problems. They show that, if every school uses a standard choice rule that is path independent, size monotonic, and characterized by a set of punctual axioms, then the corresponding DA is the unique mechanism satisfying individual rationality, strategy-proofness, and extensions of those punctual axioms to matchings.

In our paper, verifiability restricts how a school selects students from a set of applicants. So, it is punctual. By ignoring seat types, Corollary 1 shows that reserve-first and open-first verifiability respectively characterize \(C^{SimRO}\) and \(C^{SimOR}\), both of which are path independent and size monotonic standard choice rules. The extensions of these axioms to matchings are essentially equivalent to our definition of verifiability for outcomes, in a sense made precise in Appendix 8.2. This allows us to derive Lemma 4 based on the main result of [15]. In Lemma 4, a standard direct mechanism refers to a function \(\varphi\) that finds a standard matching \(\varphi(P_\mathcal{I})\) for every preference profile \(P_\mathcal{I}\). A standard direct mechanism \(\varphi\) is induced by a direct mechanism \(\psi\) if, for every \(P_\mathcal{I}\), \(\varphi(P_\mathcal{I})\) is a matching induced by the outcome \(\psi(P_\mathcal{I})\).

We apply Lemma 4 to prove Theorem 2.

Theorem 2 shows that verifiability and strategy-proofness single out exactly SimRO and the class of mechanisms with school assignments equivalent to SimOR.

5 Implications for Admission Clearinghouses in Practice↩︎

Having characterized the verifiable mechanisms, we now turn to practice. This section uses the verifiability lens to interpret how admission clearinghouses are actually designed across Chinese cities, to derive concrete guidance for policymakers who must choose among competing mechanisms, and to extend that guidance to other countries.

5.1 How Admission Clearinghouses Are Designed in China↩︎

Chinese policymakers have adopted a diverse set of mechanisms for high school admissions. 2 compiles the mechanisms used by 35 major Chinese cities in 2023. Among them, 23 cities adopt sequential mechanisms and 12 adopt simultaneous mechanisms; among the 23, 18 use SeqRO and 5 use SeqOR. The potential wastefulness of SeqOR may explain why SeqRO predominates. Among simultaneous mechanisms, SimRO and SimORO are most commonly used; Section 4.1 has shown that SimRO is verifiable while SimORO is not.

Verifiability organizes this variation. Some cities that initially used the unverifiable SimORO have since switched to SeqRO,¹² a transition consistent with policymakers’ pursuit of verifiability. A natural question is why these policymakers do not instead switch to the verifiable SimRO. The answer reveals a second design objective: many policymakers adopting simultaneous mechanisms prefer to fill open seats before reserved seats, so as to leave reserved seats for students from lower-performing middle schools, and some state this goal explicitly.¹³ \(\mathcal{C}^{SimOR}\) is the verifiable rule that best serves this goal, but it is not straightforward to implement: it is defined via DA in an artificial economy in which students rank open seats above reserved seats, which differs from how policymakers typically design and communicate admission procedures.

Both \(\mathcal{C}^{SimRO}\) and \(\mathcal{C}^{SimOR}\) impose a fixed priority between open and reserved seats. Section 5.2 examines another approach observed in several Chinese cities that allows each student to choose her own seat-type priority order, making the seat-type assignment self-explanatory. We show that this approach provides a unified framework for \(\mathcal{C}^{SimRO}\) and \(\mathcal{C}^{SimOR}\), as they arise as the two extreme cases in which all students choose to prioritize open seats or reserved seats. Our construction of \(\mathcal{C}^{SimOR}\) is in fact inspired by this approach. Section 5.3 then presents arguments for recommending \(\mathcal{C}^{SimOR}\) among verifiable choice rules. Section 5.4 discusses applications to other countries.

5.2 The Subschool Approach: Unifying \(\mathcal{C}^{SimRO}\) and \(\mathcal{C}^{SimOR}\)↩︎

The key design principle of the subschool approach is to make seat-type determination transparent by giving each student control over her own seat-type priority order. The mechanism in this approach, we call simultaneous-separate (SimSep), explicitly divides each school \(s\) into two subschools: the open subschool \(s^o\), which allocates open seats, and the reserved subschool \(s^r\), which allocates reserved seats. Students submit preferences over all subschools and DA is run to find an outcome. Several Chinese cities have adopted this approach precisely to help students understand how their seat types are determined.

We describe SimSep as a DA process in which each school uses a choice rule \(\mathcal{C}^{SimSep}\). In each round, each unassigned student applies to the highest-ranked subschool in her preference list that has not rejected her. School \(s\) receives a set of applicants \(I\) applying to \(s^o\) and a set \(I'\) applying to \(s^r\), represented by the pair \((I, I')\).

• For every pair \((I, I')\), \(\mathbf{\mathcal{C}^{SimSep}}\) selects students as follows: Subschool \(s^o\) allocates open seats to the highest-ranked applicants from \(I\), up to the quota \(q^o_s\). Meanwhile, for each \(m\in\mathcal{M}\), subschool \(s^r\) allocates reserved seats to the highest-ranked applicants from \(I'\cap\mathcal{I}^m\), up to the quota \(q^m_s\). Let \(\mathcal{C}^{SimSep}(I, I')\) denote the outcome and \(\mathcal{C}^{SimSep}\langle I, I'\rangle\) the set of selected students.

An obvious limitation of SimSep is that its subschool quotas are fixed exogenously, so unfilled reserved seats may be wasted. A natural improvement is to allow unfilled reserved seats to be reallocated as open seats. We call this modified choice rule \(\mathcal{C}^{SimFlex}\) and the corresponding DA mechanism simultaneous-flexible (SimFlex).

• For every pair \((I, I')\), \(\mathbf{\mathcal{C}^{SimFlex}}\) selects students as follows: In the first step, for each \(m\in\mathcal{M}\), school \(s\) allocates reserved seats to the highest-ranked students from \(I'\cap\mathcal{I}^m\), up to the quota \(q^m_s\). In the second step, school \(s\) allocates all remaining seats as open seats to the highest-ranked students from \(I\), regardless of type. Let \(\mathcal{C}^{SimFlex}(I, I')\) denote the outcome and \(\mathcal{C}^{SimFlex}\langle I, I'\rangle\) the set of selected students.

Since unfilled reserved seats are converted to open seats, \(\mathcal{C}^{SimSep}\langle I, I'\rangle\subseteq \mathcal{C}^{SimFlex}\langle I, I'\rangle\) for every pair \((I, I')\). By Theorem 2 of [36], students are weakly better off under SimFlex than under SimSep.

Although students must submit preferences over subschools, they have no strict preference between \(s^o\) and \(s^r\) for any given school: they care about school assignment, not seat type. We show that it is a weakly dominant strategy for every student to truthfully rank subschools: if student \(i\) prefers \(s\) over \(\tilde{s}\), she ranks \(s^o\) and \(s^r\) above \(\tilde{s}^o\) and \(\tilde{s}^r\), implying that \(i\) must rank \(s^o\) and \(s^r\) adjacently in her preferences. Therefore, we say that a preference list over subschools \(P^*_i\) is consistent with student \(i\)’s preferences over schools \(P_i\) if, for every school \(s\), the subschools \(s^o\) and \(s^r\) are ranked adjacently and the relative school order matches \(P_i\).

For each school \(s\), we say that student \(i\) reports the order \(s^o\)–\(s^r\) if she ranks \(s^o\) immediately above \(s^r\), and \(s^r\)–\(s^o\) if she ranks \(s^r\) immediately above \(s^o\). Both orders are weakly dominant under SimFlex, and reporting either leads to the same school assignment for \(i\), though her seat type may differ.

When all students play weakly dominant strategies under SimFlex, since every student ranks every pair of \(s^o\) and \(s^r\) adjacently, once a student is about to apply to any subschool of school \(s\), we let \(i\) apply to \(s\) and let \(\mathcal{C}^*\) be a choice rule that encapsulates the part of the SimFlex procedure governing how \(s\) processes applications.

• Facing applicants \(I\) reporting \(s^o\)–\(s^r\) and applicants \(I'\) reporting \(s^r\)–\(s^o\), \(\mathbf{\mathcal{C}^*}\) selects students by running DA in an artificial economy consisting of \(s\) and \(I\cup I'\), where all \(i\in I\) prefer \(s^o\) over \(s^r\) and all \(j\in I'\) prefer \(s^r\) over \(s^o\), with \(s\) using the choice rule \(\mathcal{C}^{SimFlex}\). Denote the outcome by \(\mathcal{C}^*(I, I')\).

Then, SimFlex is equivalent to a DA mechanism with the choice rule \(\mathcal{C}^*\).

The following result is the main theoretical contribution of this section: the two verifiable choice rules characterized in Theorem 1 arise as the two extreme cases of \(\mathcal{C}^*\).

When all students report \(s^o\)–\(s^r\) (so \(I'=\emptyset\)), \(\mathcal{C}^*\) implements \(\mathcal{C}^{SimOR}\); when all report \(s^r\)–\(s^o\) (so \(I=\emptyset\)), it implements \(\mathcal{C}^{SimRO}\). The two characterized choice rules are thus not ad hoc constructions but the natural endpoints of a single flexible mechanism under different student coordination outcomes. Under either pure coordination outcome, SimFlex is verifiable: uniform reporting of \(s^o\)–\(s^r\) yields an open-first verifiable outcome, and uniform reporting of \(s^r\)–\(s^o\) yields a reserve-first verifiable outcome. When students mix reporting orders, the outcome may fail to be verifiable, as Example 4 in Appendix 9 shows.

Among the 35 cities in 2, Shenyang and Xiamen adopt SimSep.¹⁴ Xiamen explicitly requires students to rank \(s^o\) above \(s^r\) for every school; under weakly dominant strategies, Xiamen’s mechanism therefore approximates SimOR. Shenyang imposes no such requirement. A government proposal noted that many middle schools preferred their students to list open seats above reserved seats and suggested adopting the same requirement as Xiamen; Shenyang’s policymakers ultimately chose not to do so.¹⁵

Although reporting \(s^o\)–\(s^r\) is not individually required in Shenyang, students may nonetheless have a collective incentive to do so. Since both \(s^o\)–\(s^r\) and \(s^r\)–\(s^o\) are weakly dominant, switching from the latter to the former is costless for student \(i\). The following result shows that this switch weakly expands the set of \(i\)’s peers who are selected by school \(s\).

When all students switch to reporting \(s^o\)–\(s^r\), by Proposition 3, the outcome converges to SimOR.¹⁶ This provides a collective rationality foundation for the Xiamen requirement: even absent a mandate, each student has an incentive to report \(s^o\)–\(s^r\) if she values the welfare of her peers. It also provides an explanation for the preferences of middle schools in Shenyang.

5.3 Choosing a Mechanism: Guidance for Policymakers↩︎

A policymaker who has committed to disclosing only cutoffs, and therefore to a verifiable mechanism, still faces a choice between \(\mathcal{C}^{SimRO}\) and \(\mathcal{C}^{SimOR}\). We recommend \(\mathcal{C}^{SimOR}\), for at least three reasons that bear directly on practice.

Distributional consequences. The primary argument concerns how \(\mathcal{C}^{SimRO}\) and \(\mathcal{C}^{SimOR}\) differ in their treatment of targeted students. Under \(\mathcal{C}^{SimRO}\), reserved seats are allocated before open seats: a high-scoring targeted student who claims a reserved seat reduces the reserved seats available to lower-scoring peers who may need affirmative action more. Under \(\mathcal{C}^{SimOR}\), open seats are allocated first, so reserved seats remain for targeted students who could not secure an open seat on merit. In the case of two student types, \(\mathcal{C}^{SimOR}\) and \(\mathcal{C}^{SimRO}\) coincide with the rules studied by [12]. Their results imply that, within a broad class of choice rules, \(\mathcal{C}^{SimOR}\) maximizes the number of targeted students admitted, whereas \(\mathcal{C}^{SimRO}\) minimizes it. For multiple types, no single maximization criterion is available, but the preference for SimOR persists: it consistently leaves reserved seats for lower-scoring targeted students rather than absorbing them with higher-scoring peers. Many Chinese cities explicitly state the goal of reserving seats for lower-scoring students, and their preference for open-first mechanisms reflects this priority.

Transparency about affirmative action use. Among open-first verifiable choice rules, \(\mathcal{C}^{SimOR}\) minimizes reserved-seat assignments, as established in Lemma 3. This is a transparency property: \(\mathcal{C}^{SimOR}\) admits as many students as possible on merit before deploying reserved seats, revealing the true extent to which affirmative action is actually used. If a city designates 50% of seats as reserved but finds that only 30% are claimed, the policy may appear less redistributive than initially perceived, enhancing its political sustainability. A mechanism that fills reserve quotas mechanically even when targeted students would have qualified for open seats inflates the apparent footprint of affirmative action and may generate unnecessary opposition.

Floor constraints. In the context of China, \(\mathcal{C}^{SimOR}\) provides an additional benefit for targeted students. As mentioned in the related literature, several Chinese cities impose a floor constraint on reserved-seat admissions, requiring that the score of a reserved-seat student not fall below the lowest open-seat score at the same school by more than a fixed margin. Consequently, a low-scoring targeted student may be rejected by a school despite unfilled reserved seats. By maximizing open-seat admissions, \(\mathcal{C}^{SimOR}\) minimizes the open-seat cutoff at each school, thereby relaxing the floor constraint and broadening access to reserved seats for the students who most need them.

5.4 Applications to Brazil and India↩︎

The paper’s framework extends beyond China to other countries with affirmative action in centralized admissions. Two prominent examples are Brazil and India, which operate large-scale centralized admissions under constitutional or legislative mandates for affirmative action. In both countries, the key elements of the paper’s framework, including multiple types of reserved seats, category-specific cutoffs, and minimal public disclosure, are present. The verifiability concept and Theorem 1 apply, while some institutional details require extensions (e.g., horizontal reserves in India).

Brazil’s centralized university admission system allocates seats between a universal open category and multiple quota categories for disadvantaged groups, using a national exam score as the priority index. For each institution and program, the system publicly discloses the minimum qualifying score in each category, corresponding to the cutoff profile \(c(\mu)\) in our framework. This public disclosure reflects a commitment to transparency: students and the public can verify whether the quota policy is correctly applied by comparing individual scores to the published cutoffs. The remaining question of whether the published cutoffs alone also determine which category’s seat a student occupies is precisely what our verifiability concept addresses, and Theorem 1 characterizes the allocation rules that guarantee it. The distributional arguments for \(\mathcal{C}^{SimOR}\) in Section 5.3 apply equally to the Brazilian context, since an open-first allocation leaves reserved seats for students from disadvantaged groups who could not secure an open seat on merit.

India’s centralized university admissions and government recruitment systems allocate seats between an open general category and multiple reservation categories for historically disadvantaged groups, with publicly disclosed cutoffs for each combination of category, institution, and program. This multi-category structure with public cutoff disclosure fits the paper’s multi-type framework directly, and the routine use of published cutoffs by students, families, and advocacy groups to audit whether the reservation policy is correctly implemented reflects the same verifiability goal. Theorem 1 identifies the allocation rules under which seat-type assignment is verifiable from the published cutoffs alone, and the characterization applies for any number of reservation categories. One feature of India’s system that goes beyond the current model is the distinction between “vertical” reservations and “horizontal” reservations. Incorporating horizontal reservations would require an extension of the framework, but the core seat-type verification question remains the same.

6 Related Choice Rules in the Literature↩︎

6.1 Slot-specific Priorities (and Capacity Transfers)↩︎

We show that \(\mathcal{C}^{SimRO}\) and \(\mathcal{C}^{SimOR}\) do not belong to the class of choice rules with slot-specific priorities defined by [13]. In this class, school \(s\) has \(q_s\) seats \(\mathcal{A}=\{a_1,\ldots,a_{q_s}\}\), partitioned into open seats and reserved seats for each type via a function \(\beta:\mathcal{A}\to\mathcal{M}\cup\{o\}\) with \(|\beta^{-1}(o)|=q_s^o\) and \(|\beta^{-1}(m)|=q_s^m\) for each \(m\in\mathcal{M}\). A precedence order \(\rhd\) ranks the \(q_s\) seats. The induced choice rule \(\mathcal{C}^\rhd\) fills seats one by one in this order: an open seat \(a_k^\rhd\) is assigned to the highest-priority remaining student under \(\succ_s\); a reserved seat for type \(m\) is assigned to the highest-priority remaining student under \(\succ_m\), where students in \(\mathcal{I}^m\) are ranked above all others while maintaining relative order within \(\mathcal{I}^m\) and within \(\mathcal{I}\backslash\mathcal{I}^m\). If the student admitted to a reserved seat does not belong to \(\mathcal{I}^m\), the seat is reclassified as an open seat.

For any precedence order \(\rhd\), \(\mathcal{C}^\rhd\) is not verifiable. Moreover, \(\mathcal{C}^\rhd\) may differ from \(\mathcal{C}^{SimOR}\) and \(\mathcal{C}^{SimRO}\) even when only the admitted students are compared; Examples 5 and 6 show this. The fundamental difficulty with \(\mathcal{C}^\rhd\) is that when a student type has unfilled reserve quotas, the precedence order determines which students fill them. But the set of eligible students varies across choice problems; it depends on which types have unfilled quotas. No fixed order can accommodate all such variations while maintaining verifiability.

[14] extend this framework to slot-specific priorities with capacity transfers (SSPwCT), which subsume the dynamic reserve choice rules of [31]. Each original seat has a shadow seat with initial capacity zero, and a capacity transfer vector governs transfers from unfilled original seats to their shadows. The choice rule \(\mathcal{C}^{SimRO}\) belongs to the SSPwCT class. However, \(\mathcal{C}^{SimOR}\) does not, even when only the admitted students are considered; this is illustrated by Example 7.

6.2 Backward Transfer Choice Rule↩︎

[16] introduce the backward transfer choice rule to manage de-reservation of unfilled reserved seats for a specific category (the OBC) in India’s affirmative action system, consistent with the over-and-above principle. The rule first allocates open seats to the highest-priority students, then allocates reserved seats to the highest-priority remaining students of each category. If reserved seats remain unfilled for OBC, their count is added to the open-seat quota and the first step is repeated; this continues until no OBC reserved seats remain unfilled or all applicants are admitted.

The choice rule \(\mathcal{C}^{SimORO}\) is not verifiable because it does not ensure that students occupying open seats have higher priorities than those occupying reserved seats. Applying the backward transfer logic to \(\mathcal{C}^{SimORO}\) yields an open-first verifiable choice rule: in each iteration, open seats are allocated to the highest-priority students regardless of type, reserved seats are allocated to the highest-priority remaining students of each type, and any unfilled reserved seats are transferred to the open quota. By Theorem 1, this procedure selects the same students as \(\mathcal{C}^{SimOR}\). However, it may assign more students to reserved seats than \(\mathcal{C}^{SimOR}\) does. For example, if all seats are filled after the first two steps of \(\mathcal{C}^{SimORO}\), the backward transfer procedure leaves the outcome unchanged, whereas \(\mathcal{C}^{SimOR}\) would assign all admitted students to open seats.

6.3 Characterization Result of [17]↩︎

[17] characterize the class of reserves-and-quotas choice rules in a school choice model with type-specific lower and upper bounds. Within this class, they recommend the regular rule, which minimizes priority violations and selects the priority rank-maximal set of applicants.¹⁷ They argue that focusing on the regular rule is without loss of generality, since the outcome of any rule in the class can be replicated by the regular rule by simply increasing the lower bounds (reserve quotas).

In the absence of type-specific upper bounds, the regular rule coincides with \(\mathcal{C}^{SimRO}\). The construction of \(\mathcal{C}^{SimOR}\) is similar in spirit to that of the regular rule: both divide each school into subschools and run DA in an artificial economy. The difference lies in how subschools are constructed and how students are assigned to subschools. [17] introduce type-specific subschools and allow students to apply to all subschools in any order. When all students first apply to their own type’s subschool, the order of their remaining applications becomes irrelevant and the outcome is the regular rule. In our construction, motivated by real-world mechanisms used in China (Section 5.2), each school is divided only into two subschools. When all students first apply to the open subschool and then to the reserve subschool, the outcome is \(\mathcal{C}^{SimOR}\). Example 8 shows that \(\mathcal{C}^{SimOR}\) is neither priority violation-maximal nor priority rank-minimal within [17]’s class of choice rules, so their characterization of the regular rule does not apply symmetrically to \(\mathcal{C}^{SimOR}\).

Our different recommendations reflect distinct views on the purpose of affirmative action. We do not treat minimizing priority violations as a central objective. Instead, we view reserve quotas as a “budget” for priority violations: the goal is first to maximize the impact of affirmative action, and then, conditional on that, to minimize the expenditure of this budget. This leads to our recommendation of \(\mathcal{C}^{SimOR}\). In practice, adjusting reserve quotas is often infeasible due to legal and political constraints, so we do not expect that the outcome of \(\mathcal{C}^{SimOR}\) can be conveniently replicated by \(\mathcal{C}^{SimRO}\) via increasing reserve quotas.

7 Conclusion↩︎

This paper studies how to design a centralized admission clearinghouse so that affirmative action is verifiable: each participant can confirm both her assigned school and her seat type from her own score and the publicly disclosed cutoffs. We show that verifiability, together with individual rationality and strategy-proofness, singles out essentially two deferred acceptance mechanisms, and we characterize the choice rules behind them. Among the two rules, \(\mathcal{C}^{SimOR}\) is new and deploys a reserved seat only when a participant cannot earn an open seat on merit, so that every reserved-seat assignment reflects genuine affirmative action and the clearinghouse never overstates the policy it applies.

Beyond the characterization, the analysis yields guidance for the design of real admission clearinghouses. Verifiability organizes the diversity of mechanisms across 35 major Chinese cities. The same framework applies to the national admission systems of Brazil and India, where category-specific cutoffs are likewise disclosed, suggesting that verifiability is a practical design benchmark well beyond the Chinese context.

More broadly, our results show how public disclosure constraints can discipline the design of allocation systems. In markets where the policymaker controls both the allocation algorithm and the information released to participants, verifiability emerges as a first-order design requirement alongside incentive compatibility and fairness. Several extensions are natural and practically relevant: incorporating the horizontal reservations observed in some systems, accommodating richer disclosure regimes, and empirically evaluating how verifiability shapes participants’ trust and behavior. We view these as promising directions for bringing transparency by design closer to the operation of large-scale matching markets.

8 Proofs↩︎

8.1 Proofs for Section 3↩︎

8.2 Proofs for Section 4↩︎

8.3 Proofs for Section 5↩︎

9 Examples↩︎

10 Nash Equilibrium Analysis of Sequential Mechanisms↩︎

11 Admission Mechanisms used in Major Chinese Cities↩︎

2 lists the mechanisms used by 35 major cities in China in 2023. These cities include the capital cities of 30 provincial-level divisions and 5 other cities ranked among the top twenty by population (i.e., Dongguan, Qingdao, Shenzhen, Suzhou, Xiamen). The capital city of Tibet is not listed because it does not implement the affirmative action policy we study.

References↩︎

---

1. School of Business, Xiangtan University. Email: xinquan.hu.eco@gmail.com.↩︎

2. Institute for Social and Economic Research, Nanjing Audit University. Email: zhangjun404@gmail.com.↩︎

3. We thank Orhan Aygün and Bertan Turhan for comments. All errors are ours.↩︎

4. The incident happened in Shenzhen’s 2025 high school admissions. See the news report (in Chinese).↩︎

5. See the linked official documents of China’s central government in [5] and [6], which proposed and institutionalized this policy.↩︎

6. A school choice rule axiom is punctual if it can be checked in each choice problem in isolation without reference to the other choice problems.↩︎

7. Some Chinese cities require that the scores of students admitted to reserved seats cannot fall below the lowest score of those admitted to open seats at the same school by more than a fixed margin. We exclude this detail from our analysis, since it is a secondary component of the system compared to those we study, and there is a trend in China towards eliminating this constraint. For example, Wuhan, a city discussed by both [33] and [34], has eliminated the floor constraint for reserved-seat students since 2024. See the 2024 document of Wuhan Municipal Education Bureau.↩︎

8. This assumption ensures that reserved seats are binding; if all students of a given type fit within the reserve quota, affirmative action is non-binding and the distinction between seat types becomes trivial.↩︎

9. In practice, score ties are broken according to exogenous rules, so students are strictly ranked.↩︎

10. In \(\mu_4\), \(i_2\) occupies a reserved seat; in \(\mu_5\), \(i_1\) occupies a reserved seat, to fulfill the reserve-non-wastefulness requirement. But they do not benefit from affirmative action.↩︎

11. When all schools use substitutable choice rules, DA runs as follows: in each round \(\ell\), each unassigned student applies to the highest-ranked school in her preferences that has not rejected her; facing new applicants in this round and tentatively admitted students in the previous round, the total set of which is denoted by \(I^\ell_s\), each school \(s\) admits students in \(\mathcal{C}_s(I^\ell_s)\). The algorithm stops when all students are either admitted or have been rejected by all acceptable schools.↩︎

12. For example, Shenzhen used SimORO before 2022 and switched to SeqRO in 2022. See the linked document of Shenzhen Municipal Education Bureau (2022).↩︎

13. For example, the document of Hefei Municipal Education Bureau (2025) stated such a goal.↩︎

14. See the linked documents of Shenyang Municipal Education Bureau (2021) and of Xiamen Municipal Education Bureau (2025).↩︎

15. See the linked document of Shenyang in 11.↩︎

16. Proposition 4 holds at the choice-rule level. Whether peers benefit at the outcome level depends on the full preference profile, but one would expect that statistically more peers benefit than suffer.↩︎

17. The regular rule is also characterized by [37] through a different approach.↩︎