Design note: accountability for misbehaviour
Development status: Research — This note records goals, assumptions and open questions; nothing here is an assurance or a released feature. Layered defences against validator collusion and misbehaviour — including redundancy, bonded evidence and challenge periods — penalties for misbehaviour, and governed dispute and appeal processes are being explored, and none of the defences is implemented. An experimental penalty library exists in an internal prototype, but no penalties are enforced and no dispute process operates on any available network, and nothing is publicly available for live use.
Before you read: Problem statement and intended properties.
How is the design intended to make misbehaviour costly and contestable, and what is unresolved? This note frames accountability as a research goal: misbehaviour by participants who run the network would carry consequences, and decisions about it could be contested and corrected. It brings together the intended defences, penalties and dispute processes at goal level, the assumptions they would rest on, their current non-enforcement and the open questions. Values, procedures and decision-makers are not described, and the capability pages for each topic are linked rather than repeated.
Motivation
A shared network relies on participants, such as validators, who could misbehave individually or by colluding with others.
Accountability, as used in this note, means that misbehaviour would carry consequences, and that decisions about misbehaviour could be contested and corrected — rather than misbehaviour being free and decisions being final.
For organisations and assurance readers, accountability is part of what would make results trustworthy: a result is easier to rely on when those who produce it have something to lose by producing it wrongly. For participants, a credible way to contest decisions matters as well, because a mistaken penalty is itself a harm.
Intended goals (each a goal, not an assurance)
- Layered defences — Being explored; none implemented. No single defence would be relied on alone. The intended layers include redundancy, bonded evidence and challenge periods.
- Penalties — Being explored; an experimental penalty library exists internally, and no penalties are enforced on any available network. Misbehaviour by participants who run the network is intended to be penalised. See penalty.
- Contestability — Being explored; no process operates. Governed dispute and appeal processes are intended for contested protocol decisions, including penalty decisions.
- Evidence-based decisions — Being explored. Penalties and disputes are intended to rest on evidence. What counts as evidence, and how it would be handled, are not described.
Taken together, the goals aim to deter misbehaviour, to avoid reliance on any single participant and to correct mistaken decisions. The concepts are explained on Threat model and misbehaviour defences, Penalties for misbehaviour and Disputes and appeals.
Assumptions the goals would rest on
- Fault assumptions. How many participants could misbehave, and in which ways, before the intended properties would fail is not published, and assumptions from other networks should not be assumed to apply.
- Something to lose. Consequences would depend on participants having committed something they could lose; what, and how much, is not described.
- Sound evidence. Penalties and disputes would depend on evidence being produced, preserved and assessed correctly; how this would be done is not described.
- Sound decisions. Disputes would depend on the integrity and competence of whoever decides; no process can guarantee correct outcomes.
- Someone checking. Challenge periods would help only if someone checks within them.
Limitations, and what exists today
Status of this section: Experimental implementation exists for an internal penalty library; nothing described in this note is available.
- None of the intended layered defences is implemented, in the experimental implementation or on any network.
- An experimental penalty library exists in an internal prototype. It is not evidence that penalties work or would be applied, and nothing in it should be read as a penalty rule.
- No penalties are enforced, and no dispute or appeal process operates, on any available network.
- No attack testing results, resilience measurements or independent audit results are published. See Security assurance status and reporting problems.
Open questions
- Which assumptions about misbehaviour are acceptable for the intended uses?
- How would the layers interact, and how would their effectiveness be evaluated? See Evaluation methodology and published results.
- How would penalties be kept proportionate, and how would mistaken penalties be corrected?
- Who would decide disputes, and how would those deciding be held accountable themselves?
- How would collusion among several participants be detected and addressed?
These questions also appear in the consolidated list on Assumptions and open questions. No answer is published, and none should be inferred from the way a question is phrased.
How this note relates to other pages
- Intended defence categories at concept level: Threat model and misbehaviour defences.
- The status of penalties: Penalties for misbehaviour.
- Contesting decisions: Disputes and appeals.
- Who would be relied on for what: Trust assumptions and responsibilities by participant.
Assumptions, trust and limitations
- These are design-stage goals; their effectiveness is unproven and they may change.
- Accountability is not a substitute for trust. Even with every intended layer in place, participants would still be relied on for some things, as described on Trust assumptions and responsibilities by participant.
Not yet available, and how this page will grow
- Further technical reference is not yet available.
- If a reviewed threat model or accountability design is approved for publication, it would be linked here with its date; evaluations would be linked from Evaluation methodology and published results.
- Changes would be recorded in the Documentation change log.
What this note does not claim
This note does not claim:
- resistance to any specific attack;
- any tolerance figure;
- any offences, amounts, evidence formats, procedures, deadlines or decision-makers;
- that penalties are enforced, or that disputes operate, anywhere;
- any assurance that misbehaviour would be detected or penalised;
- any guaranteed right of appeal or outcome.
Anything not stated here as available or assured should be treated as neither.
Related pages
- Threat model and misbehaviour defences — the intended defence categories at concept level.
- Penalties for misbehaviour — the status of penalties.
- Disputes and appeals — how decisions could be contested.
- Assumptions and open questions — these questions in the consolidated list.
Glossary
References
No approved public references yet.
