Questions.

No. It is an architectural proposal derived from one essay, and every page says so. Estonia’s published description of Bürokratt fits the first lane, information and navigation: it helps people find public-service information and hands over to a person when it gets stuck. The X-Road analogy is architectural, not literal: a central server that distributes configuration while security servers carry the traffic. Nothing here describes a national mandate registry that exists today, and the evaluator on this site works on synthetic state only.

Once an agent can do more than explain, the hard question is not conversation but delegation. Six things must be answerable for every action: who the legal principal is, what may be delegated, which logical agent may act, which running workload is making this request, which service makes the final decision, and what evidence remains afterwards. These are different objects with different owners and lifetimes. Collapsing them into one token creates a standing master key; keeping them separate is what makes the action bounded, revocable and auditable. The argument in the essay.

No. Identity proves who is acting. A mandate proves what they may do. The public service decides whether the action is allowed now. An agent identity is necessary but insufficient: authority has to be delegated separately by the principal, bounded to exact actions, resources and limits, and enforced by the service that owns the resource. See agent identity, mandate and enforcement boundary.

Because a mandate record, a mandate credential, a presentation, a service access token and a downstream action grant have different purposes, owners and lifetimes. A single bearer token would be a standing master key: revoking it erases the durable mandate, and losing it hands authority to whoever holds it. Separation is what makes revocation, privacy and audit work: revoking a mandate invalidates dependent grants within a defined bound, expiring one token does not erase the mandate, and a fresh presentation never becomes an unlimited execution credential. The five objects.

No. Whether an act requires ordinary authentication, explicit approval, several approvers or a qualified electronic signature is a legal and service-policy question, and the architecture makes the service owner say which class each action belongs to. What it does insist on is that where confirmation is required, the service renders the exact transaction through a trusted channel outside the agent and binds the approval to it. A receipt is evidence that a request was evaluated and committed; it is not a signature, and under eIDAS only a qualified electronic signature has the legal effect of a handwritten one. Confirmation must bind the exact transaction.

Injection redirects intent, not authority. Untrusted content can change which in-scope action the agent picks; it cannot widen the scope, because scope lives in a signed credential the agent cannot mint and the service verifies independently. The service does not need to identify the injection: the proposed action stays bounded by the mandate, current policy and confirmation requirements, and for consequential actions the person sees the exact transaction before anything commits. Host or signing-component compromise is a different threat and needs operator containment, not a better prompt. Design for prompt injection as an authorization problem.

A national trust plane can publish trusted issuers, mandate status and operator information without ever seeing the contents of an ordinary citizen-service transaction. Requests travel directly from the agent’s protected client to the public service, where the mandate chain and the workload-identity chain meet. “Outside the data path” does not mean “never contacted”: issuance, periodic status distribution and exceptional identity resolution still touch the control plane. What the baseline forbids is a synchronous national lookup on every ordinary action. The centre holds trust, not traffic.

Within a measured contract, not “instantly”. The maximum revocation window is publication delay plus delivery or refresh delay plus verifier application delay plus a clock allowance, and dependent service tokens and internal grants must be invalidated inside it. The essay proposes pilot values of five minutes for API access tokens, sixty seconds for internal grants and 120 seconds for the maximum signed status age, with protected writes failing closed beyond it. Those are design targets for a pilot, not statements of national capability, and a national rollout would need resilient fallbacks before such a tight bound. Revocation needs a measurable contract.

Estonia’s Administrative Procedure Act gains § 7¹, automaatne haldusmenetlus: an authority may issue acts or perform steps automatically through an information system. The amendment enters into force on 1 January 2027 and applies to procedures started on or after 1 July 2027. It is the authority acting automatically, which is a different role from a citizen’s agent expressing the citizen’s intent as a representative; this architecture is about the second role and about how the first can verify it. The law keeps discretionary decisions for specific acts, preserves the right to personal contact and to be heard, and requires an automated act to say so and explain its decision principles. The statute and an unofficial gloss.

Not automatically. The AI Act is use-case and risk based: classification depends on intended purpose and actual influence, not on the fact that a government uses the system. Separate Article 50 transparency obligations may apply independently of high-risk classification. Regulation (EU) 2026/1744 moved the Chapter III high-risk obligations for Annex III systems to 2 December 2027 and the Annex I obligations to 2 August 2028; GDPR, administrative law, accessibility and cybersecurity duties apply throughout the transition. Compliance with AI rules does not itself confer authority to perform a public task. Law supplies authority; standards carry evidence.

With a service failure worth fixing, not with a model. The order of work is need, then process redesign, then legal authority and safeguards, then operational readiness, then a bounded agent, then measurable outcomes. Adopt in stages: navigation and preparation, narrow reversible actions, bounded submissions, and only then consequential workflows after task-specific legal analysis, a DPIA, AI Act classification and security validation. Test the denial paths before widening any mandate, and put the people in place: a multidisciplinary team, sandbox pilots, and a design that keeps junior officials learning judgement. A realistic adoption path.

It applies the essay’s rule order to supplied synthetic state and returns one of three words with a list of reasons: evidence first (holder-key proof, audience, validity, status, workload), then authority (action, resource, delegation depth, policy), then the strictest limit, then consistency (payload digest, resource version), then replay and confirmation. Eleven presets cover the essay’s acceptance table. There is no model, no database and no cookie; every request carries everything the service needs, and the same expected outcomes are printed statically for readers without JavaScript or when the service is down. It is a demonstration of decision logic, not a verifier, a signature service or a transaction store. Put the boundary to the test.