Seven principles.One boundary.

A framework for agents that help people without inheriting the authority of the state.

Public value precedes technology

process and law first, tooling second

Technology itself does not create new value. Public value appears only when an institution is willing to redesign the process and build the legal framework that carries the change. The sequence is need, then process redesign, then legal authority and safeguards, then operational readiness, then a bounded agent, then measurable outcomes. Deploying a model is a late step, not the first one.

Measure the project against service outcomes: completion rate, processing time, avoidable contacts, accessibility, error and appeal rates, staff workload, unequal outcomes. Model accuracy and automation percentage are engineering measures. They are not, by themselves, measures of public value.

Follow the argument

Delegation, not AI

the mandate is the problem, not the model

Once an agent can do more than explain, the central technical problem is not conversation. It is delegation. Six questions have to be answerable for every action: who is the legal principal, what may be delegated, which logical agent may act, which running workload is making this request, which service makes the final decision, and what evidence remains afterwards.

These are different objects with different owners and lifecycles. Collapsing them into one bearer token creates a standing master key. A safer architecture keeps them separate.

Follow the argument

Authority-per-action, not ID-per-agent

durable mandate → fresh presentation → narrow execution authority → concrete action

A durable mandate, a portable credential, a fresh presentation, a service access token, and a downstream action grant are five different things. Authority is expressed as exact actions, resources, limits, purpose, and validity, and every derived grant is strictly narrower than its parent: audience, action, resource, limits, lifetime, and delegation depth all narrow, never widen.

An agent identifier says who is asking. Only a mandate says what they may do, and only the service decides whether this action is allowed now. The hierarchy is durable mandate, then fresh presentation, then narrow execution authority, then the concrete action; each step is narrower than the one before. “Minutes, not months” applies to execution tokens, not to the mandate itself; a tax-declaration mandate that legitimately spans a month is not a bug.

Follow the argument

The service is the enforcement boundary

permit / confirmation_required / deny

A government service cannot outsource its final authorization decision to the citizen’s agent, to a model gateway, or to a national registry. A policy enforcement point sits at the resource API or command broker; a policy decision point evaluates verified context and authoritative service state. Its result is one of three explicit outcomes: permit (the action is within current authority), confirmation_required (the action is eligible but needs a specified human approval), or deny (the evidence, authority, policy, or state does not permit it).

Stronger authentication cannot repair missing authority. If the citizen never granted the action, asking for another PIN does not make it valid. A new or expanded mandate is a separate process.

Follow the argument

Two chains meet at the service

who authorised this, and which workload is asking

Two independent trust chains meet at the receiving public service: the mandate chain, which represents what the person has authorised, and the workload-identity chain, which identifies the software instance or managed workload presenting the request.

Neither is sufficient alone. A valid mandate presented by the wrong workload must fail. A correctly attested workload without authority from the citizen must also fail.

Follow the argument

The centre holds trust, not traffic

the state keeps trust, not the data flow

In the X-Road pattern the central server distributes membership and security-policy configuration, while security servers mediate the actual requests and responses. A national trust plane can publish trusted issuers, mandate status, and operator information without ever seeing the contents of an ordinary citizen-service transaction. The registry never brokers a transaction.

“Outside the data path” does not mean “never contacted”. Credential issuance, periodic status distribution, and exceptional identity resolution still touch the control plane. What the baseline forbids is synchronous consultation of a national service on every ordinary action.

Follow the argument

The agent is never the authority

human authority, always; human confirmation when required

The model may plan, explain, retrieve, and prepare. Trusted code verifies evidence. The service makes the authorization decision. A deterministic command boundary performs the side effect. Personal legal approval is never synthesised by the model: where an action requires explicit confirmation or a signature, the service binds that approval to the exact authoritative transaction through a trusted channel outside the agent, and the agent supplies no text to that screen. Which class each action belongs to is the service owner’s call.

The promise of agentic government is not a state run by autonomous models. It is a state in which people receive practical, personalised help without surrendering control or learning the internal structure of public administration.

Follow the argument

Put the boundary to the test.

Synthetic scenarios. Real decision logic.

Choose a scenario to see the public service check the evidence, authority and limits. No real identity, signature or government transaction is involved.

Checking the boundary…

Scenario · expected outcome

Valid, in-scope read

Read the 2026 tax record within an active mandate.

permit

The action fits the evidence, mandate, service policy and citizen limits. The public service makes the decision.

Authorization: permit · Execution: one new effect, recorded in the receipt

Strictest bound: citizen · €200

Bound holder-key proof is present.
The evidence is bound to this service.
The mandate is within its validity period.
The parent mandate is not revoked on the last signed status.
The presenting workload is independently attested.
The action is allowed by both mandate and service.
The requested resource is within the mandate.
No additional delegation is requested.
Local policy is current and the domain is not quarantined.
The amount fits the strictest bound: citizen (€200).
The payload matches the approved transaction.
The resource version has not changed after approval.

Simulation receipt: demo-4ccfe9bd8354

No real action is executed. This receipt identifies a simulation.

Expected outcomes

Scenario	Outcome	What the boundary checks
Valid, in-scope read	`permit`Execution: one new effect, recorded in the receipt	The action fits the evidence, mandate, service policy and citizen limits. The public service makes the decision.
Consequential submission	`confirmation_required`Execution: nothing until the person confirms	Authority is sufficient, but execution must wait. The service displays the exact transaction through a trusted channel outside the agent. Policy and state are checked again before commit.
Wrong audience	`deny`Execution: nothing	Evidence for another service cannot authorise this request.
Stolen token	`deny`Execution: nothing	A token without its bound key is rejected. There is no bearer-token downgrade.
Replay	`permit`Execution: earlier result returned, no new effect	Idempotent replay: the service returns the result it already committed and does not execute the action again. This preset represents an identical, previously committed request; a real service retrieves its stored result, this stateless demo stores nothing.
Changed payload	`deny`Execution: nothing	The payload changed. Review and approve a new transaction.
Revoked mandate	`deny`Execution: nothing	Revoked status fails closed; so does status older than 120 seconds for a protected write. A child token cannot outlive its parent’s authority.
Stale status	`deny`Execution: nothing	Revoked status fails closed; so does status older than 120 seconds for a protected write. A child token cannot outlive its parent’s authority.
Crossing a limit	`deny`Execution: nothing	The remaining allowance is insufficient. Real services must enforce shared limits atomically.
Policy change	`deny`Execution: nothing	Current service policy overrides a previously issued token.
Injected intent	`confirmation_required`Execution: nothing until the person confirms	Authority is sufficient, but execution must wait. The service displays the exact transaction through a trusted channel outside the agent. Policy and state are checked again before commit.

Read the full architecture