Ability to distinguish individual users behind Flag activities in a privacy preserving way

this came up in another topic (FEP-0391 currently proposes using attributedTo pointing to activities that resulted in the current activity) but erincandescent pointed out that attributedTo has a lot of problems with being too vague and circularly defined. for the specific use case you describe, i would consider an extension property along the lines of onBehalfOf or similar. trying to stay within the existing vocab is not always a good idea, and indeed there are other properties that at first glance could work too — generator comes to mind.

the thing to be wary of is that in RDF, as:actor implies as:attributedTo, due to it being a subproperty. so you have three statements being made instead of two — the actor is the actor, but the actor is also the attributedTo, and then the third statement would declare that the pseudonymous actor is also the attributedTo:

<activity> as:attributedTo <p> .
<activity> as:actor <a> .
<activity> as:attributedTo <a> .  # this is implied by the immediately above statement