20. Anti-Cheat & Multi-Account Prevention

Revised v0.7 – less critical. With no human office there are no offices to capture and less to spy on. The remaining multi-account risks are vote and signature stuffing, rigging collective-action thresholds, Fulmara share caps and market manipulation. Verification therefore gates voting and counted civic actions only; everything else is play. No system can stop multi-accounting fully; the goal is to make it costly, detectable and pointless.

Layer	Measures
Identity tiers (revised v0.7)	Tier 0: Clerk account with a verified email – play, work, trade (new-account limits relax with tenure), chat, talk to Notables, join parties, unions and congregations. Tier 1: + a phone number verified by Clerk SMS code, one phone per account (hashed-phone table) – vote, sign petitions and initiatives, pledge to claimants or rivals, vote Charter Shares, up-vote debate questions: every action that is counted. Tier 2 is removed (there is no office to run for). Optional passkeys; no government ID (Section 22.3).
Gating counts, not play	Unverified accounts can do everything except be counted; large transfers are limited by account tenure – so alts are useless for the remaining high-value abuses.
Detection	Clerk signals (v0.6): suspicious sign-up challenges (automation, VPN/Tor/proxy), disposable-email and sub-address blocking, verified phone, session/device list, locked sign-in identifiers, bans (Section 22.8). Our signals: device/browser fingerprint signals, IP and ASN patterns, login timing correlation, shared payment methods, trade graphs (repeated one-way value transfers), chat-content similarity. Signals produce risk scores for human review, never automatic bans alone. Disclose in the privacy policy; follow GDPR/CCPA [VERIFY counsel].
Household rule	Multiple accounts from one household are allowed but flagged as ‘linked’; linked accounts share one 5% Charter Share cap in Fulmara and are discounted in petition and question up-vote clustering. (The v0.6 office restrictions are obsolete.)
Server authority	All game state is server-authoritative; the client only renders and sends intents. Rate limits on actions; automation (bots) detected via timing and input-pattern analysis.
Economy guards	Daily transfer and currency-conversion limits for new accounts; market and FX anomaly detection (wash trading, price manipulation, circular cross-border flows, insider trading around peg or printing decisions); double-entry ledger to catch duplication bugs; full money rules in Section 12.10.
Legitimate outlet	A real Espionage career (Section 15.5) gives spy fantasy without alts.
Penalties	Proven multi-account abuse: void votes, signatures and pledges, reverse gains; repeat offenses: account suspension. Appeals reviewed by staff.