29. Risks & Mitigations
| Risk | Impact | Mitigation |
|---|---|---|
| IP proximity to Avatar franchise (reduced in v0.3) | Legal takedown, forced rebrand | Elemental theme removed; remaining rules in Section 1.4; IP attorney review of names, emblems, key art and store copy before reveal. |
| Invented faiths offend real believers or are read as caricatures (v0.3) | Community backlash, press, platform risk | Archetype-based invented faiths; respectful codex; sensitivity readers; no real symbols or texts; capped, non-graphic suppression mechanics; moderation of real-religion debate (Sections 14, 21). |
| Currency exploits or runaway inflation (v0.3) | Broken economy, distrust, rollbacks | Emission caps, TSR-only cross rates, circuit breakers, insider-trading locks, settlement delays, bot simulations of all ten regimes before Wave 2 (Section 12.10). |
| Ten currencies overwhelm casual players (v0.3) | Churn, confusion | Wallet always shows home-currency and TSR values; most citizens never need to convert; currency play is optional depth for traders and bankers. |
| Trademark conflict on a nation name (Kindle most likely) (v0.4) | Forced rename after reveal | Formal search before any public reveal; 2–3 fallback names prepared for Kindle; names kept unless a concrete issue appears (Appendix B, R2). |
| Real-world political controversy | Bad press, platform issues, community toxicity | Stylized systems, neutral codex, sensitivity review, strict real-politics rules, no real symbols. |
| Unpopular nations (population imbalance) | Dead nations, failed politics | Much reduced in v0.7: AI leaders always govern and AI citizens fill population; Pioneer incentives, shortlist weighting, soft caps, lower viability floor (~25 humans), per-capita scaling; monitor choice rates. |
| AI leader misbehavior (replaces ‘leader abuse’, v0.7) | Unfair punishments, erratic policy, players quit | Charter Limits as AI behavior constraints (Section 8.18); legal action set; decision budgets; appeals; kill switches; moderation reversal. (The v0.6 ‘inactive leaders’ risk no longer exists – AI leaders are never inactive.) |
| AI cost overrun (v0.7) | LLM bills grow with shards and chat | Per-shard token budgets with graceful degradation, model routing, caching and batch, Notable caps, cost dashboard; estimates in Section 22.13 [ASSUMPTION]. |
| AI quality: dull, inconsistent or irrational leaders (v0.7) | Politics feels fake; players disengage | Authored personas, memory, eval harness (persona consistency, responsiveness), shadow mode, staff persona refresh via in-world events (Section 10.5). |
| Perception of AI-run politics (v0.7) | Players feel powerless or object to AI on principle; press frames it as ‘AI rules people’ | Pillar 6 (humans matter): binding human levers per system, capped AI vote bloc, visible cause and effect; clear disclosure and codex; playtest the feeling of agency early. |
| AI bias or real-world ideology leakage (v0.7) | Reputational and community risk | Invented ideologies, blocklists, bias evals across nations and personas, sensitivity review of persona templates (Sections 21.4, 22.15). |
| Provider dependence (v0.7) | Price changes, deprecations, outages | Provider abstraction with two adapters, personas and memory in our DB, utility-model fallback (Section 8.19), shadow-mode migration (Section 22.15). |
| Prompt injection and manipulation (v0.7) | Players steer AI leaders or Notables | Citizen text as quoted, clustered data only; legal action set; validator; red-team evals; logging and moderation. |
| AI disclosure and regulation (v0.7) | Legal obligations to label AI content or interactions may apply in some markets | AI badges and labels everywhere by design; counsel review (R11) [VERIFY counsel]. |
| Multi-accounting and spying | Rigged votes, distrust | Verification tiers, gating, detection, espionage career. |
| Economy inflation / exploits | Broken markets | Sinks, double-entry ledger, event sourcing, rollback tooling, bot simulations. |
| Persistence fatigue / no wipes | Late joiners feel behind | Heirs, Ages, anti-snowball pricing, newcomer bonuses, new shards. |
| Korund fun gap | Players avoid the most constrained nation | Strong collective goals, medals, monuments, smuggling and radio thrills, highest security; playtest early. |
| Scope creep (10 systems) | Delays, ~6 months longer to 1.0 than the six-nation plan [ASSUMPTION] | Strict MVP of 3 nations; nations as data (Section 22.5); two delivery waves; reusable modules (elections, referendums, succession, rotation, plots). |
| Population spread thin across ten nations | Hollow politics in some nations | AI citizens fill population (Section 11.7); lower viability floor and shard-opening rule (Section 19.2); per-capita scaling; last-resort shard merges at Age boundaries that preserve nationality (decided v0.4). |
| Fulmara read as ‘pay-to-vote’ | Community backlash, press | Shares only purchasable with earned in-game currency; caps; AI Tribune counter-power elected by non-shareholders; clear messaging that this is the nation’s system, not monetization. |
| Varkand read as glorifying military rule | Press, platform and community concerns | Visible weaknesses, no real insignia or events, honest plebiscites, sensitivity review with people who lived under military rule. |
| Veldwood voter fatigue | Turnout collapses, referendums decided by few | Max 4 items per Vote Day, re-submission lock, no penalty for skipping, turnout monitored in alpha; the capped Simulated Public bloc adds a little AI weight, but outcomes still depend on human turnout (Section 11.9). |
| Browser performance on low-end devices | Churn | Chunking, LOD, data-texture rendering, 2D fallback on mobile; 3D bundle loaded only on /play (Section 22.7). |
| Vendor dependence on Clerk and Vercel (v0.6) | Price changes, outages or lock-in | Game state never lives in Clerk (Organizations not used; database keyed by Clerk userId); authorization re-checked on our server; the game server runs off Vercel; keep an export path for users (Clerk offers full user-data export); review published prices before Early Access. |
| Auth/realtime security gaps (v0.6) | Account takeover, forged actions, leaked fog data | Svix-verified webhooks, networkless JWT verification with authorized parties, short token lifetime with refresh on the socket, per-resource auth checks, read-only DB role for the web app, security review at milestone T7. |
| Moderation cost | Budget | Template-only UGC at MVP, filters, volunteer program, vendor at scale. |
Last updated on