I’d like to add to this discussion one more opinion from the Slack:
I think any user can flag any user, regardless of either’s role.
(The author is @CodePotent, but this does not matter at this context. I have to mention him just because using direct quotation)
So, my note. I think we should flag separate posts only. Not users. And all moderator actions should be also applied to separate posts only, but not users (accounts/IPs). Some reasons:
If a user breaks some rules this doesn’t mean that all his posts/actions are bad for community. There still can be 99% of harm and 1% of extreme profit. The mod task is to fix those 99%, yes, but also to keep the profitable 1%.
Accounts are not absolutely safe. They can be sometimes hacked, used by spammers etc. If any sanctions/penalties are applied to a user in whole, this will maximize all harmfull effects for both sides (user and community).
So each post/action should be estimated separately. And the user (person) is untouchable.
This could be even generalized to an ideological/philosophical point of view. Flagging a post is a request for cleaning, which is normal. Flagging a user is a requiest for punishment, which is rather ambicious and police-alike. I really think that first method is the key.
And one more note about IPs (a bit offtopic but has very similar logic/ethic background):
To my mind IP-address should never be used for user identification (e.g. for detecting spammers, bans, limitations etc). Many providers across the world use dynamic IP-adresses. There are also proxies and specific situations with gateways (for example, this forum tells me that I’m connected from Germany, but I’m not). Dynamic means that 1 external IP may be occasionaly used by different people within a large subnet. Even more specific markers such as system fonts cash and browser detailes are not always reliable. So any automatic actions depending on this are objectionable. If antispam system fires on normal users even once, it should be removed. 1 community member is more important than potential threat from 100 spammers.