The Citizen interface is useful, but it pollutes its derived classes with methods and attributes that can cause confusion later on (I've got a concrete example of that confusion that Perry and I just spent a few days tracking down - Citizen's getId() was being mistaken for SourceRecord.getId()). I think everything Citizen provides should be hidden and only accessible through a friend interface, e.g.:

afw::image::Image<float> image(4, 5);

daf::base::CitizenAccess::getId(image);

We should also make an effort to ensure that other aspects of Citizen's design don't affect derived classes, perhaps by prefixing an name that could be seen by derived classes with a "Citizen" prefix; see https://dev.lsstcorp.org/trac/ticket/2461.