Many of the suggestions made so far seem to assume that the users are cooperative and will not try to defeat any of the suggested "auditing" mechanisms. Is that assumption correct?