A Project Aqua proposal for decentralised identity, democratic participation and universal income in the age of AI
Working proposal — October 2026
The problem with proving you are human
As artificial intelligence becomes increasingly capable, one of the most difficult problems facing decentralised societies is deceptively simple: how do we know that one account represents one human being?
For most online services, the problem is an inconvenience. For a system in which every participant receives a vote, a universal basic income (UBI), and a share of communal assets, it becomes fundamental.
If one person can create a thousand convincing identities, they might collect a thousand incomes and exercise a thousand votes.
Traditional solutions rely on governments, identity documents, biometric databases, trusted institutions or some combination of these. Cryptographic solutions can establish that an identity controls a particular key or device, but they cannot by themselves establish that the identity represents a unique human.
Biometrics and physical devices can help, but introduce other difficulties. People can own multiple devices, hardware can be compromised, and biometric identification raises privacy, accessibility and surveillance concerns. AI may also make the technical obstacles to impersonation progressively easier to overcome.
Project Aqua has previously explored a composite Proof of Human Work system combining hardware security, local biometrics, environmental challenges, social connections and cryptographic proofs.
Those ideas remain useful, but they may be trying to solve a problem that does not require a perfect solution.
What if we stopped trying to prove that every account belongs to a unique human?
What if we instead built a system in which most people are expected to cooperate, opportunities for cheating are mathematically constrained, and the community can discover suspicious behaviour as the network grows?
This is the idea behind BranchID.
Identity through relationships
The starting point is a simple observation: people do not generally enter society as isolated, anonymous entities.
They have friends, families, colleagues, neighbours and communities. Other people know they exist.
These relationships cannot provide absolute proof of unique identity. People can lie, collude or be deceived. But social relationships contain information that a cryptographic key alone does not.
BranchID proposes that entry into an economically recognised identity network should normally occur through an existing participant.
An established member can invite a limited number of new members. Those members can subsequently invite others, creating a branching structure.
Every account has a verifiable position in this structure: who introduced it, when it joined, which accounts it subsequently introduced, and which community it belongs to.
The system does not need to publish people’s real names or disclose their individual votes.
Its key asset is the structure of relationships.
Instead of a global authority asking, “Can you prove you are human?”, the system asks a different question:
“How did you enter this community, and does the behaviour of your part of the network remain consistent with genuine human participation?”
A bounded identity tree
Consider a new Aqua community established by four trusted founding members.
These founders are not appointed permanent leaders, nor do they receive additional voting rights. Their role is to establish the initial network through existing relationships.
Each founder can introduce up to 20 people.
This produces a first generation of 80 people, all of whom are assumed, for the initial model, to be genuine.
Subsequent members can invite up to ten additional people each.
The network could expand extremely quickly. Four founders can lead to 80 first-generation members, then 800 second-generation members, then 8,000 third-generation members.
Uncontrolled growth would create opportunities for fake accounts to multiply. BranchID therefore introduces two restrictions.
First, accounts have a limited number of invitations and the community has a defined maximum size and depth.
Second, the community itself votes on whether further expansion is permitted.
These are growth gates.
A possible starting arrangement is:
| Stage | New members | Total accounts |
| Four founders | 4 | 4 |
| First generation | 80 | 84 |
| Second generation | 800 | 884 |
| Third generation, initially capped | 1,616 | 2,500 |
The maximum community size is therefore initially 2,500 accounts, rather than allowing the entire potential third generation to join immediately.
Unfilled positions are simply unused capacity. They do not represent votes, incomes or economic claims that existing members can collect.
Every admitted account receives one ordinary vote and, subject to Aqua’s funding and eligibility rules, one UBI entitlement and an equal individual interest in the relevant communal asset pool.
There is no permanent reduction in an individual’s allocation because they introduced someone else.
That is a departure from an earlier version of the idea, in which accounts shared a conserved voting allocation inherited from their ancestors.
The earlier approach made it difficult to manufacture additional voting power, but risked creating unequal entitlements and permanent advantages for founding members.
The newer proposal is simpler: equal rights for recognised participants, but constrained and observable entry.
Assuming cooperation, without depending on perfection
The proposal rests on a social assumption that deserves scrutiny.
Most people, most of the time, will not deliberately undermine a community that provides them and those around them with meaningful benefits.
This is not the same as assuming everyone is honest.
People cheat, make mistakes and sometimes cooperate in fraud. But social systems, including markets, neighbourhoods, voluntary associations and commons, routinely depend on substantial cooperation without possessing infallible methods of identifying honest participants.
Research on public-goods games has identified conditional cooperation: many people cooperate when they believe others are also contributing. This provides some support for the approach, although such experiments cannot establish how people would behave when additional accounts might yield $25,000 per year.
BranchID asks whether limited invitations, social accountability, collective governance and the possibility of detection can keep fraudulent identities below an acceptable threshold.
For an initial experiment, suppose we set that threshold at 3% of the recognised population.
The 3% is a proposed engineering target, not a demonstrated safe level. Even a relatively small fraudulent minority might be decisive in a close election.
The initial assumptions might be:
- All four founders are genuine.
- Their 80 immediate invitees are genuine.
- Of the second-generation accounts introduced by genuine sponsors, 99% are genuine.
- Of the third-generation accounts introduced by genuine sponsors, 98% are genuine.
- Once an account is fake, an attacker may also control accounts created beneath it.
These are assumptions to test, not established facts about human behaviour.
For the 2,500-account community, if invitations are spread approximately evenly across available positions and fake identities have no special priority in obtaining additional invitations, the expected number of fake accounts is approximately:
Second generation: 800 × 1% = 8.
Third generation: 1,616 × (1 − 0.99 × 0.98) ≈ 48.
Total: approximately 56 fake accounts, or 2.25% of the community.
Under these assumptions, the proposal meets its provisional 3% target.
But the result is sensitive to how invitations are distributed.
If the eight fraudulent second-generation accounts each manage to create ten additional fraudulent identities, they could collectively control 88 accounts, including themselves. That alone represents 3.52% of the entire 2,500-account community.
This is why limiting the total population is not sufficient.
The allocation of invitations, the size of individual descendant groups, and the credibility of different generations matter.
A deliberate attacker behaves differently from an ordinary person who occasionally makes a mistaken invitation. We need to model both.
Growth gates: democracy becomes part of identity verification
The proposed growth gates are perhaps the most distinctive element of BranchID.
At defined stages, the community votes on whether to authorise another generation or release additional invitations.
Before the vote, members can examine aggregate information about the existing network: how quickly accounts appeared, how the different branches have developed, whether patterns of voting participation seem unusual, and whether there are credible concerns about fraud.
The vote then serves two purposes.
It decides whether the community is ready to expand.
It also produces further information about how the community behaves.
Suppose the network reaches 884 members and holds a growth vote.
The four founding branches show broadly similar participation, but one branch exhibits extraordinary turnout, overwhelmingly supports expansion, and has produced most of its accounts within a short period.
This would not prove that the branch contains fake identities.
Perhaps its members are unusually enthusiastic, organised or concerned about growth.
Nevertheless, the combination of observations gives the community a reason to examine the branch more closely before authorising additional places.
The analysis can also compare generations.
If founders and early members participate at ordinary rates while recently introduced accounts participate almost unanimously, this is another potentially informative pattern.
Importantly, a new generation may genuinely favour expansion more strongly than an established generation. Differences of opinion are not evidence of fraud by themselves.
The algorithm must distinguish unexplained anomalies from ordinary political and social differences.
A growth vote is therefore both a democratic decision and an opportunity to observe the network under a common event.
This creates a feedback loop. A community showing credible participation and few unexplained irregularities can continue expanding. A community exhibiting concerning patterns can slow expansion, investigate and reconsider.
A negative vote should not automatically indicate fraud, and a positive vote should not automatically establish legitimacy.
Fraudulent accounts can vote too. If they become sufficiently numerous, they may help authorise their own expansion.
That possibility is one of the central questions the proposal needs to test.
A public tree and a privacy-preserving fraud detector
BranchID would maintain a cryptographically verifiable record of account sponsorship, community membership and relevant governance events.
Project Aqua already envisages a gossip-based directed acyclic graph (DAG) for communicating and agreeing on important system activity.
Such a record could support the analysis of network growth without requiring a central database of real-world identities.
The algorithm might examine several categories of evidence.
Network structure. How quickly were accounts created? Do certain subtrees grow unusually rapidly? Are invitations distributed in patterns inconsistent with comparable communities? Do suspicious clusters repeatedly appear beneath particular accounts?
Voting behaviour. How does aggregate participation vary by generation and branch? Are there recurring anomalies across different types of election? Does a group participate unusually strongly only when its own expansion is at stake?
Economic activity. Do funds repeatedly converge on a small number of destinations? Are many accounts receiving UBI but exhibiting little independent economic activity? Do related accounts show unusual transaction concentration?
Community evidence. Is the claimed membership consistent with what other community participants can plausibly observe? Are real people unable to join because available places appear to have been consumed by questionable accounts?
These signals could be combined into a statistical risk assessment.
But there are essential safeguards.
High turnout does not prove fraud. A family or cooperative may legitimately pool income. Real communities may expand rapidly. Individuals must be free to associate, trade and vote together.
Likewise, sophisticated fake accounts could imitate the economic and voting behaviour of independent people.
The purpose of the algorithm is therefore to identify patterns warranting further investigation, not to declare individuals fraudulent based on a numerical score.
Voting secrecy must remain intact. Aggregate results should not be released for groups so small that individual choices could be reconstructed. The four founders, for example, should not have their individual voting preferences exposed through an ostensibly anonymous breakdown.
Financial analysis also requires careful separation between the identity DAG and the payment ledger. A system cannot simply infer private spending from a DAG that does not record it. Privacy-preserving statistics, selective proofs or appropriately authorised audits would need to be developed.
Anonymity, accountability and transparency must coexist rather than one eliminating the others.
Making dishonesty costly and cooperation attractive
The proposal’s deeper security mechanism is economic and social rather than purely technical.
An invitation is a scarce opportunity.
If a participant uses all ten available invitations to create fake accounts, those invitations are no longer available for genuine friends, relatives or neighbours who might want to join.
A fraudulent branch may eventually attract attention because its reported population does not correspond with what other people can observe.
And if members know that the network analyses sponsorship, voting and appropriately available transaction patterns, they may be less willing to engage in obvious fraud.
These pressures do not make cheating impossible.
The financial incentive remains substantial. Ten extra UBI-receiving identities would represent $250,000 per year if they all received full payments.
A determined attacker might patiently establish fake accounts, distribute their activity across different services and imitate legitimate behaviour.
Collusion is also possible. A group of real people might deliberately sponsor fictitious members and share the proceeds.
The proposal cannot simply assume that social goodwill will overcome these incentives.
The question is whether the expected costs of cheating, including the scarcity of invitations, detection risk, social consequences and possible loss of fraudulent proceeds, can outweigh the benefits for enough participants.
This is a matter for behavioural and adversarial testing, not an assumption that can be established mathematically.
There should also be a distinction between reserve invitations and reserve votes.
A member might reasonably keep invitations unused until someone genuinely needs to join. But creating extra funded identities to preserve additional votes for important decisions would introduce a separate governance vulnerability.
If Aqua wishes to let people express unusually strong preferences, mechanisms such as quadratic voting or limited voting credits could be investigated separately. Those credits should not generate additional UBI entitlements or encourage fake identities.
What happens when the algorithm detects a problem?
The system should not automatically delete suspicious accounts or punish their sponsors.
Doing so risks reproducing the very concentration of power Aqua is intended to avoid.
A possible response would begin with publishing an understandable, privacy-preserving explanation of the anomaly.
The community could then authorise additional investigation, temporarily limit expansion in the affected part of the network, or require further evidence before admitting new accounts.
More serious action would require clear procedures, opportunities to challenge findings and independent review.
Existing participants should not lose basic economic security merely because they belong to a branch displaying statistically unusual behaviour.
Another danger is exclusion. Established members might oppose admitting newcomers because they perceive them as competitors for resources or political influence.
Growth gates must not become a tool for maintaining a privileged membership.
Rules governing growth, appeals, transfer between communities and eventual admission would need to be established before real economic entitlements depended upon them.
BranchID and the wider Aqua Canopy
The original BranchID concept was broader than a single sponsorship tree.
It imagined a network of relationships in which identities could be created, delegated, joined, separated and recognised across different communities.
The larger structure was provisionally called the Aqua Canopy: a forest of independent communities, roots and economic arrangements, cooperating without requiring a single global authority.
Under that approach, anyone might create a cryptographic identity or establish an independent root. But creating an identity would not automatically grant a vote over another community’s decisions or a claim on its shared assets.
Recognition and economic rights require agreement.
The current proposal deliberately narrows the experiment.
We begin with one bounded community, four trusted founders, limited invitations and democratic growth gates.
We do not yet attempt to solve the problem of spawning new communities, connecting multiple independent roots or transferring economic entitlements between them.
Those are potential extensions, not requirements for the initial design.
This distinction is important. BranchID is the proposed relationship and admission mechanism. Aqua Canopy is the possible future network in which multiple such communities coexist.
What we need to discover
The next stage should be an open simulation and, eventually, a small voluntary pilot.
A simulation could populate a virtual town with genuine participants, mistaken sponsors, opportunistic cheaters and coordinated attackers.
Different agents would have different motivations. Some would care strongly about the community. Others would occasionally bend the rules. Some would deliberately attempt to maximise the number of funded identities under their control.
The model should include the ability of fraudulent agents to understand and adapt to the detection algorithm.
We would test different invitation limits, founder counts, generation depths, rates of cooperation and thresholds for authorising expansion.
The central measurements would include the proportion of fake accounts, the economic cost of fraudulent claims, the degree of voting distortion, and the algorithm’s ability to identify suspicious clusters without wrongly accusing legitimate participants.
It would also be important to test whether honest communities remain cooperative after observing others cheating.
The crucial question is not whether the system survives an unrealistically obedient population of bots. It is whether it survives intelligent adversaries operating among imperfect but generally cooperative human beings.
A real pilot would need to go further, testing whether people actually behave as the simulations assume.
The early generations are especially important. Four trusted founders may be enough to begin an experiment, but those founders are not a mathematical guarantee of honesty. They may be mistaken, compromised or colluding.
Similarly, a fixed-depth tree bounds the number of positions an attacker can occupy in a particular subtree; it does not independently prove the proportion of fake accounts will stay below 3%.
And an algorithm that identifies unusual behaviour cannot guarantee that patient, well-disguised fraud will be detected.
These are unresolved problems, not minor implementation details.
A different approach to trust
The ambition behind BranchID is not to produce a perfect identity system.
It is to build one that can function despite uncertainty about identity.
Most approaches begin by assuming the system must establish whether each participant is uniquely human before allowing them to take part.
BranchID begins with a different possibility: human communities already possess imperfect but useful knowledge about the people within them, and that knowledge can be organised through limited sponsorship, observable relationships and democratic oversight.
Instead of relying entirely on a technical test that AI may eventually defeat, we use the structure of the community itself.
Instead of permitting unrestricted account multiplication, we place mathematical boundaries on growth.
Instead of treating identity verification as a one-time event, we continually gather evidence through ordinary participation.
Instead of delegating the final decision to a central authority, we allow the community to participate in governing expansion, subject to safeguards protecting minority rights and newcomers.
The underlying hypothesis is simple:
A society does not necessarily need to identify every dishonest participant if it can constrain the opportunities for dishonesty, recognise suspicious concentrations of influence, and maintain sufficiently strong cooperation among the rest.
Whether this can support one vote and one income per human remains unproven.
But it is a different problem from building an infallible proof-of-humanity system, and perhaps a more tractable one.
It also raises a broader question about how decentralised systems should be designed in an age of increasingly capable artificial intelligence.
Should we seek perfect technical enforcement of individual honesty? Or should we construct social systems that remain functional when individuals are imperfect, identities are uncertain and some participants deliberately break the rules?
BranchID is an attempt to explore the second possibility.
It is offered as an open proposal for simulation, criticism and improvement, not a completed identity protocol.
The aim is to discover whether trust, bounded growth, equal entitlements and collective observation can provide enough security for a decentralised economic democracy.
Perhaps the solution to unique identity is not perfect proof.
Perhaps it is a society structured so that most people have good reasons to cooperate, and the people who don’t cannot easily overwhelm everyone else.
Related work and intellectual foundations
This proposal is not the first to consider social relationships as a defence against fake identities.
- SybilGuard — Haifeng Yu and colleagues (2006). Uses social-network trust relationships to constrain Sybil attacks. Paper
- SybilLimit — Yu and colleagues (2008). Develops stronger bounds under particular assumptions about social-network structure. Paper
- Conditional cooperation — Urs Fischbacher, Simon Gächter and Ernst Fehr (2001). Experimental evidence on how willingness to cooperate depends on the behaviour of others. Paper
- Governing the Commons — Elinor Ostrom (1990). Examines how communities organise, monitor and govern shared resources, including the importance of locally appropriate rules and conflict resolution. Related research
BranchID’s proposed combination of bounded invitation trees, equal individual entitlements, generation-based voting analysis and democratic growth gates has not yet been demonstrated to provide robust resistance to coordinated identity fraud.
That is precisely what needs to be tested.
Project Aqua — Open working proposal, October 2026.