{
  "$schema": "https://agenticsurfaces.org/patterns.schema.json",
  "version": "1.0.0",
  "generated": "2026-09-29T13:29:11.547Z",
  "license": "CC-BY-NC-SA-4.0",
  "licenseUrl": "https://creativecommons.org/licenses/by-nc-sa/4.0/",
  "count": 81,
  "patterns": [
    {
      "id": "1.1",
      "title": "Cryptographic content provenance",
      "territory": 1,
      "slug": "cryptographic-content-provenance",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For images and video, where binding provenance to a file at intake is a settled response."
        },
        {
          "level": "emerging",
          "note": "For documents, where the same approach is being worked out but not yet routine."
        },
        {
          "level": "frontier",
          "note": "For government text submissions, where proving who authored a passage pasted from elsewhere remains an unsolved problem."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "C2PA Technical Specification (v2.4)",
          "jurisdiction": "C2PA",
          "year": 2026,
          "source": "https://spec.c2pa.org/specifications/specifications/2.4/specs/C2PA_Specification.html",
          "tier": "primary",
          "anchor": "c2pa-spec"
        },
        {
          "name": "C2PA Explainer",
          "jurisdiction": "C2PA",
          "source": "https://spec.c2pa.org/specifications/specifications/2.4/explainer/Explainer.html",
          "tier": "primary"
        },
        {
          "name": "Content Credentials (Wikipedia)",
          "source": "https://en.wikipedia.org/wiki/Content_Credentials",
          "tier": "evidence"
        },
        {
          "name": "C2PA v2.1 Specification",
          "jurisdiction": "C2PA",
          "year": 2024,
          "source": "https://spec.c2pa.org/specifications/specifications/2.1/specs/_attachments/C2PA_Specification.pdf",
          "tier": "primary",
          "anchor": "c2pa-v21"
        },
        {
          "name": "C2PA Security Considerations",
          "jurisdiction": "C2PA",
          "source": "https://spec.c2pa.org/specifications/specifications/1.0/security/Security_Considerations.html",
          "tier": "primary"
        },
        {
          "name": "Samsung Galaxy S25 series arrives worldwide — Samsung Newsroom",
          "jurisdiction": "Global",
          "year": 2025,
          "source": "https://news.samsung.com/global/samsung-galaxy-s25-series-arrives-worldwide",
          "tier": "primary",
          "anchor": "samsung-s25"
        },
        {
          "name": "Content Credentials in Adobe apps — Adobe Help",
          "jurisdiction": "Global",
          "source": "https://helpx.adobe.com/creative-cloud/apps/adobe-content-authenticity/content-credentials/overview.html",
          "tier": "primary",
          "anchor": "adobe-content-credentials"
        },
        {
          "name": "Content Credentials in Azure OpenAI — Microsoft Learn",
          "jurisdiction": "Global",
          "year": 2026,
          "source": "https://learn.microsoft.com/en-us/azure/foundry-classic/openai/concepts/content-credentials",
          "tier": "primary",
          "anchor": "azure-content-credentials"
        }
      ],
      "assurance": "Government needs confidence that a digital submission's origin and edit history are what they claim to be. An agency receiving it can then rely on where it came from and how it was changed rather than judging the content alone. The agency's intake platform must capture that signed record at receipt and be able to produce it later.",
      "access": "Content Credentials require signing tooling that ships with newer devices and paid creative software. A submitter drafting in a plain text box, on an older phone, or from a shared or public computer can't produce one. Two equally genuine submissions can arrive, but only the better-resourced one has the credential, so the uncredentialed submission can read as less trustworthy once analysts start weighting the signal. A signed credential can also bind identity metadata that a submitter with well-founded caution won't attach.",
      "openings": [
        "Hold the credential to an optional enhancement.",
        "Accept an unsigned submission, and weight it no lower by default.",
        "Treat a missing credential as an ordinary state of the channel, never as a flag."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "ProvenanceReceipt",
            "annotation": "The agency signs each document at the moment it arrives, so the record proves the submission was unaltered after receipt without claiming who wrote it."
          }
        ]
      },
      "whereThingsGoWrong": "The failure mode here is a flawed derivation: a figure authentic in origin yet wrong in how it was computed, such as a debt averaged from annual income data. Provenance on the document alone misses it. The document is genuine, so nothing on its face looks wrong; only a tamper-evident chain of how each figure was derived makes the calculation method auditable after the fact.\n\nA provenance credential can be forged with valid signatures, or applied by a signer that vouches for content it never witnessed. A valid signature then gets read as proof the content is genuine when it attests only that the file is untampered since signing.\n\nTwo limits bound the assurance: it holds only against a trust list someone has vetted, and the absence of a credential proves nothing at all.",
      "framing": "Binding a tamper-evident record of origin and edit history to a digital file\nat the point of intake. An agency can settle a question about a submission's\norigin from the record itself, without contacting anyone who handled the file.\n",
      "challenge": "As agent drafting becomes routine, most agent-produced text reaches an intake\nform by copy-paste into a plain text box, not as a signed file. A cryptographic\nprovenance chain can bind a record to a file at the moment it is signed, but it\ncannot see across that copy-paste boundary, so the growing share of submissions\ntyped in this way has no possible credential to check. The agency is left\ndistinguishing an original from a synthetic submission by reading it, exactly\nwhere the pattern's signal has nothing to attach to.\n",
      "precedentsNote": "**[C2PA specification](#s-c2pa-spec) (v2.4).** The Coalition for Content\nProvenance and Authenticity, founded by Adobe, ARM, Intel, Microsoft, and\nTruepic, maintains an open standard that cryptographically binds provenance\nmetadata to a digital asset. Its core construct, the Content Credential, is\na tamper-evident structure recording who created an asset, what tools were\nused, and how it was modified, and each edit adds to the provenance chain\ninstead of replacing it. The specification is published openly, and its\nmembership spans technology, media, and hardware companies.\n\n**Content Credentials in shipped products ([Samsung](#s-samsung-s25),\n[Adobe](#s-adobe-content-credentials),\n[Microsoft](#s-azure-content-credentials)).** Samsung ties Content\nCredentials on the Galaxy S25 lineup to AI-generated and AI-edited images,\nwhich is narrower than a camera app signing every photograph it takes.\nAdobe applies them across Photoshop, Lightroom, Stock, and Premiere, and\nautomatically to content generated on Firefly; Azure OpenAI issues them on\nevery AI-generated image under a Microsoft certificate. Each deployment\nsigns what a tool generated or edited, so a file that was only photographed\nor typed reaches an agency with nothing to check.\n\n**[C2PA text and document coverage](#s-c2pa-v21) (v2.1).** Version 2.1\nadded regions of interest for text-based formats including PDF, Office\ndocuments, and EPUB, and the specification defines provenance for an asset\n'in a form such as an image, video, audio recording, or document'.\nCloud-based manifests extended coverage to formats that cannot embed\nmetadata directly, opening a path to plain-text provenance. Practical\nimplementations remain concentrated on images and video, and tooling for\ntext documents is nascent.\n",
      "transferability": "**Medium transferability, with significant gaps.** C2PA's architecture binds a\ncryptographic manifest to a file at creation and through each subsequent edit.\nThat file-binding model maps well to document submissions where the government controls the\nsubmission tool (an online form that generates a signed PDF). It maps poorly to\nthe more common case: a user drafting text in an arbitrary word processor,\nemail client, or AI assistant and pasting it into a web form. The chain of\nprovenance breaks at every copy-paste boundary.\n\nFor government consultation submissions, C2PA would need to operate at the\nsubmission-platform level rather than the authoring-tool level. The platform\ncould sign the submission at intake, recording the submitter's identity and\ntimestamp, but this proves reception, not authorship. Proving authorship\nprovenance for text remains an open problem in the specification.\n\nThe image-text gap is structural. Images have a 1:1 relationship between file and\ncontent; text is routinely composed across tools, edited collaboratively, and\nsubmitted by pasting. C2PA's file-centric provenance model does not transfer\ncleanly to text-centric workflows, and proving authorship provenance for pasted\ntext remains the unsolved gap.\n"
    },
    {
      "id": "1.2",
      "title": "Verifiable credentials and decentralized identity",
      "territory": 1,
      "slug": "verifiable-credentials-decentralized-identity",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For identity verification: verifying who someone is to a credential is a settled response (W3C Recommendation, eIDAS mandate)."
        },
        {
          "level": "frontier",
          "note": "For using the same credentials to attest how a submission was prepared: binding a preparation-method claim to that verified identity has not been built."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "W3C Verifiable Credentials 2.0 — Recommendation Announcement",
          "jurisdiction": "W3C",
          "year": 2025,
          "source": "https://www.w3.org/news/2025/the-verifiable-credentials-2-0-family-of-specifications-is-now-a-w3c-recommendation/",
          "tier": "primary",
          "anchor": "w3c-vc-20"
        },
        {
          "name": "W3C Verifiable Credentials Overview",
          "jurisdiction": "W3C",
          "source": "https://www.w3.org/TR/vc-overview/",
          "tier": "primary"
        },
        {
          "name": "W3C VC Working Group Charter 2026",
          "jurisdiction": "W3C",
          "year": 2026,
          "source": "https://w3c.github.io/vc-charter-2026/",
          "tier": "evidence"
        },
        {
          "name": "Regulation (EU) 2024/1183 (eIDAS 2.0) — EUR-Lex",
          "jurisdiction": "EU",
          "year": 2024,
          "source": "https://eur-lex.europa.eu/eli/reg/2024/1183/oj",
          "tier": "primary",
          "anchor": "eidas-2"
        },
        {
          "name": "QEAA Put Simply — Bundesdruckerei",
          "jurisdiction": "EU",
          "source": "https://www.bundesdruckerei.de/en/innovation-hub/qeaa-put-simply",
          "tier": "evidence"
        },
        {
          "name": "Digital ID Act 2024",
          "jurisdiction": "AU",
          "year": 2024,
          "source": "https://www.digitalidsystem.gov.au/what-is-digital-id/digital-id-act-2024",
          "tier": "primary",
          "anchor": "digital-id-act"
        },
        {
          "name": "Legislating the Future of Identity Verification — Allens",
          "jurisdiction": "AU",
          "year": 2026,
          "source": "https://www.allens.com.au/insights-news/insights/2026/04/legislating-the-future-of-identity-verification-navigating-australias-digital-id-act/",
          "tier": "evidence"
        },
        {
          "name": "Trusted Digital Identity Framework (TDIF) — AGA",
          "jurisdiction": "AU",
          "source": "https://architecture.digital.gov.au/standard/trusted-digital-identity-framework-tdif",
          "tier": "primary"
        },
        {
          "name": "Google — Aadhaar Verifiable Credentials in Google Wallet",
          "jurisdiction": "India",
          "year": 2026,
          "source": "https://blog.google/products-and-platforms/platforms/google-pay/aadhaar-digital-id/",
          "tier": "primary",
          "anchor": "aadhaar-wallet"
        }
      ],
      "assurance": "Government needs confidence that a claim about a submitter (their identity, qualification, or authority to act for others) holds to a sufficient level. That confidence must not force the submitter to disclose more than the purpose requires, and the credential's issuing authority must stand behind the claim as its accountable holder.",
      "access": "A credential wallet assumes a personal smartphone and the digital skill to run it, so people on shared or basic devices are denied the verified path outright. The EU's own 80% adoption target concedes that a fifth of users won't hold the wallet. Wallets are issued to adults acting in their own name, so minors, people under guardianship, and people with fluctuating capacity often can't hold the credential, even when they're entitled to the outcome it would ease. Biometric or document verification deters people with a well-founded reluctance to undergo it, and anonymous or pseudonymous participation disappears if identity becomes the price of being heard. Unverified input can be discounted next to credentialed input without the submitter ever seeing the penalty.",
      "openings": [
        "Hold verified identity to an optional signal: the anonymous channel stays open, and a submission without a credential is a full submission.",
        "Publish any weight the credential adds, rather than applying it as a silent discount.",
        "Make the CredentialConsent step operable by keyboard and assistive technology, announcing non-visually which claim is verified and which is self-asserted."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "CredentialConsent",
            "annotation": "An independently attested identity sits beside a preparation-method declaration the submitter makes themselves, so a reader can tell which claim is vouched for."
          }
        ]
      },
      "whereThingsGoWrong": "Identity binding governs who is submitting, not how an agency reaches a decision, so it does not by itself stop a bad automated decision. It prevents a system issuing consequential demands with no named author to answer for them. Binding each automated determination to an accountable decision-maker creates the chain of responsibility that is otherwise missing.",
      "framing": "Letting a submitter prove who they are, what they're qualified for, or what\nauthority they hold, using a portable credential an agency can check. An\nagency gets a claim it can check at intake, without collecting identity\ndocuments it then has to protect.\n",
      "challenge": "Tools that let a user hold portable, machine-verifiable credentials and have\nan agent present them are now widely available. As agent-presented credentials\nbecome routine, an agency meets more claims relayed by software than handed\nover by the person they describe. No settled way exists to tell whether the\ncredential still reflects what its holder authorized.\n",
      "precedentsNote": "**[W3C Verifiable Credentials Data Model v2.0](#s-w3c-vc-20).** The full\nfamily of VC specifications reached W3C Recommendation status, establishing\na web standard for expressing credentials such as driver's licenses,\ndegrees, and professional registrations in a cryptographically secure,\nprivacy-respecting, and machine-verifiable form. The model supports\nselective disclosure, so a submitter can prove one attribute without\ndisclosing the rest of the credential.\n\n**[EU eIDAS 2.0](#s-eidas-2) and Qualified Electronic Attestations of\nAttributes.** Regulation (EU) 2024/1183 requires every Member State to\nprovide at least one European Digital Identity Wallet within 24 months of\nthe implementing acts, and certain private relying parties to accept them\nwithin 36 months of the same trigger, so both deadlines run from those acts\nand not from a date the Regulation itself fixes. A QEAA is a verifiable\ncredential issued by a Qualified Trust Service Provider, interoperable\nacross borders. Its issuer is accredited and the attestation carries legal\neffect, neither of which follows from a credential format alone.\n\n**Australian Government Digital ID System, under the [Digital ID Act\n2024](#s-digital-id-act).** The Digital ID Act 2024 established a\nlegislated accreditation scheme, superseding a Trusted Digital Identity\nFramework that had run as a pilot, and the system most recognizable as\nmyGovID opens to the private sector at the end of 2026 under rule reforms\nthat added a redress framework. Accreditation is legislated and the\naccredited credential is one private relying parties will be able to\naccept. It verifies identity, and does not record content provenance or how\na submission was prepared.\n\n**[Aadhaar Verifiable Credentials in Google Wallet](#s-aadhaar-wallet)\n(India).** Google added Aadhaar-based verifiable credentials to Google\nWallet in India, using the W3C Digital Credentials API and ISO/IEC 18013-5.\nIt is government-scale VC issuance running inside consumer wallet\ninfrastructure.\n",
      "transferability": "**High transferability for identity verification; low transferability for content\nprovenance.** Verifiable Credentials solve the \"who is submitting\" problem well.\nThey do not solve the \"how was this submission prepared\" problem at all. A user\npresenting a verified credential proves their identity but says nothing about\nwhether their submission was personally drafted, AI-generated, or copied from a\ncampaign template.\n\nVCs could be extended with custom claim types, such as a \"submission process\nattestation\" claim where the holder declares the preparation method. The claim would be\nself-attested but cryptographically bound to identity, creating accountability for\nfalse declarations. No such credential type has been built, so it is an unbuilt\nresponse rather than an adaptation of an existing one.\n\nThe gap is concrete wherever a national digital identity scheme already exists.\nA government authentication wallet typically handles sign-in to public services\nbut offers no mechanism for attaching provenance claims to the submissions a\nuser lodges through it. An accreditation framework could in principle support\nattribute assertions about preparation methods, but where no such use case has\nbeen contemplated in the legislation, rules, or technical architecture, closing\nthe gap depends on amending the scheme's rules rather than on the technology\nalone.\n"
    },
    {
      "id": "1.3",
      "title": "Self-attestation and disclosure",
      "territory": 1,
      "slug": "self-attestation-disclosure-ux",
      "maturity": "emerging",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For academic publishing, where asking submitters to declare how they prepared their work is a settled response, unlike legal practice, where the disclosure wave receded rather than hardening into one."
        },
        {
          "level": "emerging",
          "note": "For government consultations, where applying it to user submissions is still new but has strong analogues to draw from."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [
        "1.7"
      ],
      "precedents": [
        {
          "name": "Publisher AI Policies & Disclosure Rules — Enago",
          "source": "https://www.enago.com/responsible-ai-movement/resources/publisher-ai-policies-disclosure-rules-authors",
          "tier": "evidence"
        },
        {
          "name": "Nature Portfolio — Artificial Intelligence (AI) editorial policy",
          "source": "https://www.nature.com/nature-portfolio/editorial-policies/ai",
          "tier": "primary",
          "anchor": "nature-ai-policy"
        },
        {
          "name": "Science (AAAS) — journals editorial policies (AI section)",
          "source": "https://www.science.org/content/page/science-journals-editorial-policies",
          "tier": "primary"
        },
        {
          "name": "AI Policies in Academic Publishing 2025 — Thesify",
          "year": 2025,
          "source": "https://www.thesify.ai/blog/ai-policies-academic-publishing-2025",
          "tier": "evidence"
        },
        {
          "name": "AI Hallucination Cases Database — Damien Charlotin (HEC Paris)",
          "jurisdiction": "Global",
          "year": 2026,
          "source": "https://www.damiencharlotin.com/hallucinations/",
          "tier": "evidence"
        },
        {
          "name": "US Court of Appeals for the Fifth Circuit — decision declining its proposed AI certification rule",
          "jurisdiction": "US",
          "year": 2024,
          "source": "https://www.ca5.uscourts.gov/docs/default-source/default-document-library/court-decision-on-proposed-rule.pdf?sfvrsn=5967c92d_2",
          "tier": "primary",
          "anchor": "fifth-circuit"
        },
        {
          "name": "Schilke & Reimann — The transparency dilemma: How AI disclosure erodes trust (OBHDP)",
          "year": 2025,
          "source": "https://doi.org/10.1016/j.obhdp.2025.104405",
          "tier": "evidence"
        },
        {
          "name": "Mata v. Avianca, Inc. — opinion and order on sanctions (S.D.N.Y.)",
          "jurisdiction": "US",
          "year": 2023,
          "source": "https://law.justia.com/cases/federal/district-courts/new-york/nysdce/1:2022cv01461/575368/54/",
          "tier": "primary",
          "anchor": "mata-avianca"
        },
        {
          "name": "AI Declaration Statement — Pressbooks",
          "source": "https://kpu.pressbooks.pub/booktemplate/front-matter/ai-declaration-statement/",
          "tier": "evidence",
          "anchor": "aid-framework"
        },
        {
          "name": "Three Disclaimers for Safe Disclosure — arXiv",
          "source": "https://arxiv.org/pdf/2404.09041",
          "tier": "evidence",
          "caveat": "preprint"
        },
        {
          "name": "Registering and Declaring Interests — UK Parliament",
          "jurisdiction": "UK",
          "source": "https://guidetoprocedure.parliament.uk/articles/xl01eB4L/registering-and-declaring-interests",
          "tier": "primary",
          "anchor": "uk-register-interests"
        },
        {
          "name": "Conflict of Interest Declaration Form — UK Procurement Pathway",
          "jurisdiction": "UK",
          "source": "https://www.procurementpathway.civilservice.gov.uk/documents/template/pa-2023-conflict-of-interest-declaration-form/manage-and-monitor",
          "tier": "primary"
        },
        {
          "name": "Conflict of Interest — Australian Department of Finance",
          "jurisdiction": "AU",
          "source": "https://www.finance.gov.au/government/procurement/clausebank/conflict-interest",
          "tier": "primary"
        },
        {
          "name": "Preventing and Managing Conflicts of Interest in the Public Sector — UNODC",
          "source": "https://www.unodc.org/documents/corruption/Publications/2020/Preventing-and-Managing-Conflicts-of-Interest-in-the-Public-Sector-Good-Practices-Guide.pdf",
          "tier": "primary"
        },
        {
          "name": "Engage Victoria — Victoria's online consultation platform",
          "jurisdiction": "AU (Vic)",
          "source": "https://engage.vic.gov.au/",
          "tier": "primary"
        },
        {
          "name": "Have Your Say — nsw.gov.au",
          "jurisdiction": "AU (NSW)",
          "source": "https://www.nsw.gov.au/have-your-say",
          "tier": "primary"
        }
      ],
      "assurance": "The pattern's central claim: a self-declaration is worth something only when a false certification draws professional or reputational consequence. Government needs a usable, low-barrier provenance signal that nearly any submitter can produce; the declaration supplies the signal, and the receiving agency must attach and enforce the consequence itself. Where no consequence is available (the anonymous channel), the declaration is data for follow-up, never assurance.",
      "access": "A submitter with low literacy, limited English, a cognitive disability, or a crisis leaving them little time or attention can be deterred by a multi-field disclosure form, abandoning the submission rather than working out what each declaration means. The declaration options must include the honest answer for a submission prepared with a guardian's or supporter's help, or those users are pushed into a false declaration. If a disclosure reads as incomplete, it must not become a worse outcome for the person who found the form hardest.",
      "openings": [
        "Make the simplest truthful declaration ('I prepared this submission myself without AI tools') the one-tap default.",
        "Write every field in plain language with examples, and include declaration options for supported and assisted preparation.",
        "Treat incomplete disclosure as a flag for follow-up, never a bar to submission.",
        "Make the progressive-disclosure control work by keyboard and screen reader, announcing what each expansion reveals."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "PreparationDisclosure",
            "annotation": "Disclosure opens as a single default for the common case, and asks for the tool, the version, and the extent only from submitters who used AI assistance."
          }
        ]
      },
      "whereThingsGoWrong": "Self-attestation governs how a submission was prepared, not how an agency reaches a decision, so it does not bear on a decision-side failure. Its own failure mode is subtler. Nothing stops a submitter from declaring the easy answer regardless of the truth, so the field records what people chose to write, regardless of what happened. An anonymous channel's rate of honest declaration is unmeasurable by construction, because non-disclosers are only observed when caught. Disclosure can also backfire against the honest discloser: evaluators trust declared AI users less even when the work itself is judged no worse (Schilke & Reimann 2025), so a bare declaration field penalizes honesty unless reviewers are instructed (and the form states) that a declared preparation method does not discount a submission's merit treatment. The same discipline runs in reverse: an unaccountable automated process trusted on its own assertion fails for the same reason.",
      "framing": "Asking the submitter to state, in a structured way, how their submission was\nprepared: personally, with help, with AI tools, or on an organization's behalf.\nThe declaration gives reviewers a preparation signal on every submission without\nadding work that deters honest submitters.\n",
      "challenge": "In the absence of cryptographic proof, the most widely deployed provenance\nmechanism is self-declaration: asking the submitter to state how their submission\nwas prepared. As agent-assisted drafting becomes ordinary, that declaration\nbecomes the only provenance signal most channels can ask for, and its usefulness\nturns almost entirely on form design. A form that asks the wrong question\ncollects false or empty declarations at scale, and an agency that cannot tell\nthe honest discloser from the silent one is left with no signal at all.\n",
      "precedentsNote": "**[Academic publisher AI disclosure policies](#s-nature-ai-policy).**\nNearly every major academic publisher now requires authors to disclose AI\ntool use, and none permits AI to be listed as an author: Science bans\nAI-generated text outright, Springer Nature prohibits AI authorship while\nallowing undisclosed copy-editing, and Elsevier, Wiley and SAGE permit it\nwith detailed, section-tied disclosure. Version information is standard,\nnaming the tool, its version, the access date, and the task it performed.\nEvery major publisher now requires the declaration, and each sets its own\ngranularity.\n\n**Legal profession AI disclosure after [Mata v Avianca](#s-mata-avianca).**\nAfter a New York federal judge sanctioned attorneys under Rule 11 for a\nbrief containing fabricated ChatGPT citations, federal judges began issuing\nstanding orders requiring an AI certification. Federal and state\nauthorities then moved the other way: the [Fifth Circuit](#s-fifth-circuit)\ndeclined a circuit-wide rule because existing accuracy obligations already\nreach AI-assisted filings, and Illinois and New York codified that\ndisclosure should not be required in a pleading. Rule 11 had already reached the conduct, so the consequence outlasted the\ncertification requirement built on top of it.\n\n**The [Artificial Intelligence Disclosure (AID)\nFramework](#s-aid-framework).** The framework pairs a self-assessment\nrubric with checkbox declarations, toggle descriptions, and version\ntracking covering tool, version, access date, and task. The declaration is\nspecified down to the fields it asks an author to supply.\n\n**[UK](#s-uk-register-interests) and Australian conflict-of-interest\ndeclarations.** The UK Parliamentary Register of Members' Financial\nInterests requires registration within 28 days and publishes the result\nunder the Open Parliament Licence, the UK's Procurement Pathway supplies a\nstandardized declaration form, and the Australian Department of Finance\nmaintains a clausebank template for the same purpose. Each declaration is\nmandatory and published to a deadline, and none of them is verified at the\npoint it is made.\n",
      "transferability": "**High transferability for the mechanism; uncertain effectiveness.** Self-attestation\nis the lowest-barrier provenance signal: no special technology, no identity\ninfrastructure, no changes to authoring tools. The academic and legal precedents\nshow that structured disclosure forms specifying tool, version, task, and extent\nproduce more useful information than binary checkboxes.\n\nBoth precedents draw their force from consequence: false certification\ntriggers professional sanctions, and a misconduct finding damages a career.\nGovernment consultations have no equivalent professional body standing behind\na declaration, so its weight rests on whatever the receiving agency can attach\nto it.\n"
    },
    {
      "id": "1.4",
      "title": "Proof of personhood at submission",
      "territory": 1,
      "slug": "proof-of-personhood-at-submission",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "emerging",
          "note": "For the building blocks, where World ID, Privacy Pass, and the House-passed but lapsed Comment Integrity and Management Act point to a stakes-tiered personhood bar, and the FCC fake-comment crisis showed the need."
        },
        {
          "level": "frontier",
          "note": "As a deployed response in public processes: no government platform has yet tiered its personhood bar to the stakes with a lower-friction fallback."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [
        "5.3"
      ],
      "precedents": [
        {
          "name": "World ID: full-stack proof of human — world.org",
          "jurisdiction": "Global",
          "year": 2026,
          "source": "https://world.org/blog/announcements/world-id-full-stack-proof-of-human",
          "tier": "primary",
          "anchor": "world-id"
        },
        {
          "name": "The new World ID and the partners bringing proof of human — world.org",
          "jurisdiction": "Global",
          "year": 2026,
          "source": "https://world.org/blog/announcements/the-new-world-id-and-the-partners-bringing-proof-of-human-to-the-internet",
          "tier": "primary"
        },
        {
          "name": "Achieving proof of human — World whitepaper",
          "jurisdiction": "Global",
          "source": "https://whitepaper.world.org/achieving-proof-of-human",
          "tier": "primary"
        },
        {
          "name": "World: Proof of Personhood — world.org",
          "source": "https://world.org/blog/world/proof-of-personhood-what-it-is-why-its-needed",
          "tier": "evidence"
        },
        {
          "name": "Comment Integrity and Management Act of 2024 (H.R. 7528)",
          "jurisdiction": "US",
          "year": 2024,
          "source": "https://www.congress.gov/bill/118th-congress/house-bill/7528",
          "tier": "primary",
          "anchor": "hr-7528"
        },
        {
          "name": "House Bill Targets AI-Generated Comments — Nextgov",
          "jurisdiction": "US",
          "year": 2024,
          "source": "https://www.nextgov.com/artificial-intelligence/2024/05/house-bill-targets-ai-generated-comments-rulemaking/396419/",
          "tier": "evidence"
        },
        {
          "name": "Artificial Intelligence and Public Comment — CSG",
          "jurisdiction": "US",
          "source": "https://www.csg.org/2025/01/14/artificial-intelligence-and-public-comment/",
          "tier": "evidence"
        },
        {
          "name": "NY Attorney General report on fake net neutrality comments",
          "jurisdiction": "US",
          "year": 2021,
          "source": "https://ag.ny.gov/press-release/2021/attorney-general-james-issues-report-detailing-millions-fake-comments-revealing",
          "tier": "primary",
          "anchor": "fcc-comments"
        },
        {
          "name": "Millions of IDs Misused to Submit Net Neutrality Comments — IAPP",
          "jurisdiction": "US",
          "source": "https://iapp.org/news/a/millions-of-ids-misused-to-submit-net-neutrality-comments-to-fcc/",
          "tier": "evidence"
        },
        {
          "name": "FCC Flooded with Fake Comments — The Hill",
          "jurisdiction": "US",
          "year": 2017,
          "source": "https://thehill.com/policy/technology/332753-fcc-flooded-with-thousands-of-fake-anti-net-neutrality-comments/",
          "tier": "evidence"
        },
        {
          "name": "Mass, Computer-Generated, and Fraudulent Comments — ACUS",
          "jurisdiction": "US",
          "year": 2021,
          "source": "https://www.acus.gov/sites/default/files/documents/Final%20Report%20on%20Mass,%20Computer-Generated,%20and%20Fraudulent%20Comments%20(Final%2006-01-2021)_0.pdf",
          "tier": "primary"
        },
        {
          "name": "Petitioning the Assembly — Parliament of NSW",
          "jurisdiction": "AU (NSW)",
          "source": "https://www.parliament.nsw.gov.au/parliamentary-business/legislative-assembly/petitioning-the-assembly",
          "tier": "primary",
          "anchor": "nsw-epetitions"
        },
        {
          "name": "House of Representatives petition rules",
          "jurisdiction": "AU",
          "source": "https://www.aph.gov.au/Parliamentary_Business/Petitions/House_of_Representatives_Petitions/Petition_Rules",
          "tier": "primary"
        },
        {
          "name": "Making a submission to a committee inquiry — aph.gov.au",
          "jurisdiction": "AU",
          "source": "https://www.aph.gov.au/Parliamentary_Business/Committees/House/Making_a_submission",
          "tier": "primary"
        },
        {
          "name": "Inaccessibility of CAPTCHA — W3C working note",
          "jurisdiction": "W3C",
          "year": 2021,
          "source": "https://www.w3.org/TR/turingtest/",
          "tier": "primary",
          "anchor": "w3c-captcha"
        },
        {
          "name": "Privacy Pass issuance protocol — RFC 9578 (IETF)",
          "jurisdiction": "IETF",
          "year": 2024,
          "source": "https://www.rfc-editor.org/rfc/rfc9578.html",
          "tier": "primary",
          "anchor": "privacy-pass"
        }
      ],
      "assurance": "Government needs confidence that a human was involved in a submission, a question distinct from knowing who that human is. That confidence must be proportionate to what the process decides, so a routine comment is not held to the same bar as a high-stakes proceeding. The agency running the process, whether a consultation, an inquiry, or a formal proceeding, must administer that tiering and hold the assurance signal attached to each submission.",
      "access": "Every proof-of-personhood mechanism excludes a different group. CAPTCHAs fail people with visual and cognitive disabilities. Phone verification fails the 3–5% of Australian adults without mobiles. Government digital ID fails people without identity documents or the digital skill to enroll. Biometrics fail people whose bodies don't match the sensor's assumptions. Others could clear any tier but have well-founded reasons to refuse biometric or digital-ID enrollment altogether. For them the zero tier must be a genuine route to a full hearing, not a nominal one whose submissions are weighted down without notice to the submitter. Minors and people under guardianship are entitled to take part in decisions that concern them, yet they rarely hold the phone contracts, documents, or accounts the higher tiers demand. A single hard gate turns any of these into outright denial. A fallback route that flags or discounts what passes through it turns the denial into a slower route to a lesser hearing.",
      "openings": [
        "Accept submissions at every tier, including none: a submission without proof of personhood goes through, its assurance signal stated.",
        "Publish the weighting applied to each tier rather than applying it silently.",
        "Never demand the highest-assurance proof for routine comment."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "PersonhoodTier",
            "annotation": "Personhood is treated as a gradient, attaching a visible assurance tier to each submission rather than forcing a single submit-or-don't checkpoint."
          }
        ]
      },
      "whereThingsGoWrong": "Proof of personhood concerns inbound submissions, not outbound automated decisions, so it does not bear directly on a decision-side failure. The FCC fake-comment crisis supplies the mirror-image lesson: volume-based systems are trivially gameable, and the damage surfaces only retrospectively, the same way harm from an unaccountable automated process appears long after the fact.",
      "framing": "Confirming that a human was involved in a submission without necessarily\nlearning who they are. A reviewer deciding what to act on can see whether a\nhuman was confirmed, and at what strength.\n",
      "challenge": "Tools that can generate and lodge submissions at unlimited volume are now widely\navailable, so as automated submission grows, a process that weighs what it\nreceives must be able to separate input a real person was involved in from input\nproduced entirely by automated systems. This is distinct from identity verification (knowing who\nsomeone is): proof of personhood asks only whether a human was involved, without\nnecessarily identifying them. What that leaves open is how a confirmation of\ninvolvement should travel with the submission to the analyst weighing it.\n",
      "precedentsNote": "**[World ID](#s-world-id).** The system issues a proof of uniqueness from\nan iris scan taken on custom biometric hardware, letting a person prove\nmembership of a verified-humans set without revealing which member they\nare. Uniqueness at that strength requires a centralized registry of\nbiometric data, and enrollment on hardware most submitters will never\nencounter.\n\n**[CAPTCHA](#s-w3c-captcha) and [Privacy Pass](#s-privacy-pass) (RFC\n9578).** The W3C's working note on CAPTCHA records that 'the very nature of\nthe interactive task inherently excludes many people with disabilities,\nresulting in a denial of service to these users'. Privacy Pass,\nstandardized at the IETF by Cloudflare, Apple, Google, and Fastly, issues a\ntoken attesting humanness without revealing identity. It proves humanness\nwithout an interactive task, which is the step the W3C note identifies as\nexcluding.\n\n**US [Comment Integrity and Management Act of 2024](#s-hr-7528) (H.R.\n7528).** The bill passed the House by voice vote, then lapsed with the\n118th Congress without a Senate vote, so it never became law. It would have\nrequired 'human verification to ensure that the comments are coming from a\nreal person' on Regulations.gov and set out how mass form-letter comments\nmust be published, rather than blocking AI-generated comments outright. One\nchamber of a legislature voted for human verification on its own comment\nchannel, and for publishing form letters instead of blocking them.\n\n**[NSW ePetitions](#s-nsw-epetitions) and Australian House committee\nsubmissions.** Signing a NSW Legislative Assembly ePetition requires\nidentifying as a NSW resident and giving a valid email address, the House\nof Representatives e-petition flow enforces the House's petition rules at\ncreation with Petitions Committee vetting before publication, and lodging a\ncommittee submission needs only a My Parliament account. The three channels\nrequire different degrees of identification, and the lightest applies to\nthe channel that decides the least.\n",
      "transferability": "**Medium transferability with serious access trade-offs.** Proof of personhood\naddresses the \"unlimited volume\" half of the problem directly, and the Comment\nIntegrity and Management Act provides a direct legislative analogue for Australian\nconsultations. But the spectrum of mechanisms involves difficult trade-offs:\n\n| Mechanism | Assurance level | Privacy cost | Access barrier |\n|---|---|---|---|\n| CAPTCHA | Low (AI can solve) | Low | Medium (accessibility) |\n| Email verification | Low-medium | Medium | Low |\n| SMS/phone verification | Medium | Medium | Medium |\n| Government digital ID (myGovID) | High | High (identified) | High (requires setup) |\n| Biometric (World ID) | High | Very high (iris scan) | Very high |\n\nA tiered approach lets agencies set requirements proportionate to the stakes and\nvulnerability of the process. Low-stakes consultations might accept email\nverification; high-stakes regulatory proceedings might require verified identity.\nWhat stays undesigned is which Australian processes should sit at\nwhich tier: no legislation or platform standard yet maps a stakes level to a\nspecific assurance floor.\n"
    },
    {
      "id": "1.5",
      "title": "Structured intake with process metadata",
      "territory": 1,
      "slug": "structured-intake-with-process-metadata",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "emerging",
          "note": "For the building blocks, where session analytics, paste detection, and structured forms are mature, and a software audit trail (vendor-documented in Xero as a timestamped, per-user log of changes to financial records) offers a partial analogue, though not the interview-level preparation provenance the frontier rung needs."
        },
        {
          "level": "frontier",
          "note": "For capturing preparation method as a byproduct of intake: no government consultation platform currently records it as structured data."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [
        "5.2"
      ],
      "precedents": [
        {
          "name": "Show Editors in Google Docs — Google Workspace Updates",
          "year": 2021,
          "source": "https://workspaceupdates.googleblog.com/2021/05/view-more-context-on-google-docs-edits-with-show-editors.html",
          "tier": "primary",
          "anchor": "google-docs-editors"
        },
        {
          "name": "AI in Public Consultations — Delib",
          "source": "https://www.delib.net/newsroom/ai-in-public-consultations",
          "tier": "evidence",
          "anchor": "delib-analytics"
        },
        {
          "name": "Designing for Agentic AI: Practical UX Patterns — Smashing Magazine",
          "year": 2026,
          "source": "https://www.smashingmagazine.com/2026/02/designing-agentic-ai-practical-ux-patterns/",
          "tier": "evidence",
          "anchor": "agentic-ux-catalog"
        },
        {
          "name": "Engage Victoria — Victoria's online consultation platform",
          "jurisdiction": "AU (Vic)",
          "source": "https://engage.vic.gov.au/",
          "tier": "primary"
        },
        {
          "name": "Set up a public consultation project on Engage Victoria — vic.gov.au digital guide",
          "jurisdiction": "AU (Vic)",
          "source": "https://www.vic.gov.au/Set-up-a-public-consultation-project-on-Engage-Victoria-digital-guide",
          "tier": "primary"
        },
        {
          "name": "Have Your Say — nsw.gov.au",
          "jurisdiction": "AU (NSW)",
          "source": "https://www.nsw.gov.au/have-your-say",
          "tier": "primary"
        },
        {
          "name": "Australian Senate climate committee — submissions received as standard form letters",
          "jurisdiction": "AU",
          "year": 2009,
          "source": "https://www.aph.gov.au/Parliamentary_Business/Committees/Senate/Former_Committees/climate/submissions/sublist",
          "tier": "primary",
          "anchor": "senate-form-letters"
        }
      ],
      "assurance": "Decision-makers need the preparation signal to be reliable enough to weigh. The agency operating the intake platform must capture it automatically, as a byproduct of the submission flow, and answer for its accuracy when a decision-maker relies on it.",
      "access": "A guided, sectioned intake raises the cost of submitting. A time-poor submitter, or one in distress, is deterred by a form that demands justification section by section. Multi-section navigation is harder work for screen-reader and switch users than a single text box. Session capture (timing, edit counts, paste patterns) is exactly what a submitter with well-founded caution about surveillance will refuse, and if they walk away, the channel has deterred them. The free-text escape hatch can become the low-status route whose submissions read as second class.",
      "openings": [
        "Treat the free-text alternative as an equivalent submission that simply comes with less process metadata.",
        "Disclose what the session records before the submitter begins the form.",
        "Let the paste prompt be dismissed without penalty, and keep it non-blocking for assistive technology, reachable by keyboard, and announced when it appears."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "GuidedIntake",
            "annotation": "Sectioned intake fields gather how a submission was built as a byproduct of writing it, never as a gate the submitter has to clear."
          }
        ]
      },
      "whereThingsGoWrong": "Structured intake's timing and paste-pattern signal can itself be gamed: an agent that types at a scripted human pace and pastes in staggered fragments can make machine-drafted text read as personally composed. Structured intake records how a user prepared a submission, so it doesn't catch a decision-side failure. Its design principle still transfers: capturing a complete provenance chain from raw inputs to final output, as a byproduct of the workflow, is exactly the auditability that an opaque calculation pipeline lacks.",
      "framing": "Capturing how a submission was put together (timing, structure, what was typed and\nwhat was pasted) as a byproduct of the intake itself, so the preparation signal\nitself costs the submitter no extra effort to produce. Reviewers get context on\nhow an entry was prepared without asking the submitter for a separate declaration\nor proof of how they wrote it.\n",
      "challenge": "Once agent drafting is the ordinary way submissions are produced, the\nentries with no preparation signal will approach the whole of the intake.\nA 2,000-word consultation response looks identical whether it was personally\ndrafted over a week, generated by an AI in thirty seconds, or circulated as a\nform letter by a campaign organization. Decision-makers need process metadata\nto interpret what they read: the signal exists so a reader can weigh an\nentry, never so the system can screen it out unread.\n",
      "precedentsNote": "**[Google Docs edit history and Show Editors](#s-google-docs-editors).**\nDocs records who wrote or edited every passage with timestamps and\ncolor-coded attribution, Show Editors reveals the edit provenance of any\nhighlighted range, and version history preserves each prior state.\nPer-passage authorship is produced by the editing itself, at no additional\ncost to the writer.\n\n**[Citizen Space consultation analytics](#s-delib-analytics) (Delib).** The\nplatform captures submission metadata including timing patterns, completion\nrates, and session data, and its operator commits to keeping AI analysis\ntraceable to the original submission. The metadata describes the submission\nevent (when it arrived, from what address, how long the session ran) and\nrecords nothing about how the response was prepared.\n\n**[Agentic AI UX pattern catalog](#s-agentic-ux-catalog) (Smashing\nMagazine).** The catalog sets out Action Audit and Undo, and Explainable\nRationale and Confidence Signal, as concrete designs for a human-legible\nrecord of what an AI system did and why. Each pattern assumes the AI tool\nkeeps that record itself.\n\n**[Australian Senate committee form-letter\ndisclosure](#s-senate-form-letters).** Senate committees list 'submissions\nreceived as standard form letters, including form letters with additional\nindividual comments' as a disclosed category of the official record.\nCampaign origin is captured and published at intake, without asking the\nsubmitter for anything extra.\n",
      "transferability": "**High transferability for the design principle; medium for implementation.** The\ntax software model is the strongest analogue: a structured workflow that captures\nprocess metadata as a natural byproduct. A government consultation platform could\nimplement this through a structured composition environment (sectioned guidance\nthat captures timing and paste patterns per section), a non-blocking\npaste-detection prompt that creates a natural disclosure\nmoment, and session metadata (duration, edit count, sequence, typed-to-pasted\nratio) treated as behavioral rather than content analysis.\n\nThe critical limitation is that process metadata from the submission platform\ncaptures only the final-mile activity. If a user drafts in Word, refines with\nChatGPT, and pastes the result, the platform sees only the paste event. The tax\nsoftware model works because preparation happens inside the tool; consultation\nsubmissions are typically prepared externally.\n"
    },
    {
      "id": "1.6",
      "title": "Linking a person's input to the final text",
      "territory": 1,
      "slug": "show-your-working",
      "maturity": "frontier",
      "maturityNote": "Frontier. Letting a submitter show how a piece was built is a response no government consultation platform yet offers. The building blocks (document timelines, contribution attribution, source annotation) exist in collaborative editing tools but have not been adapted to the submission intake context. The academic disclosure model is the closest analogue, but it works after the fact in a published paper rather than at the point of submission, so the response still has to be designed for intake.",
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "ISO 15489-1:2016 — Records management: concepts and principles",
          "jurisdiction": "International",
          "year": 2016,
          "source": "https://www.iso.org/standard/62542.html",
          "tier": "primary",
          "anchor": "iso-15489"
        },
        {
          "name": "Audit Trails for Accountability in LLMs — arXiv",
          "source": "https://arxiv.org/html/2601.20727v1",
          "tier": "evidence",
          "caveat": "preprint"
        },
        {
          "name": "AI Disclosure Patterns — Shape of AI",
          "source": "https://www.shapeof.ai/patterns/disclosure",
          "tier": "evidence",
          "anchor": "shape-of-ai"
        },
        {
          "name": "Elsevier — generative AI policies for journals",
          "source": "https://www.elsevier.com/about/policies-and-standards/generative-ai-policies-for-journals",
          "tier": "primary",
          "anchor": "elsevier-ai-policy"
        },
        {
          "name": "Interoperable Architecture for Digital Identity Delegation for AI Agents — arXiv",
          "year": 2026,
          "source": "https://arxiv.org/pdf/2601.14982",
          "tier": "evidence",
          "caveat": "preprint",
          "anchor": "agent-delegation-arch"
        }
      ],
      "assurance": "What has to be confirmable is the working itself: which parts of a submission came from the submitter, a tool, or a template, not just a yes-or-no declaration about the whole. Confirming the working has to set a disclosure norm rather than depend on technical enforcement, because a determined submitter can defeat any detection. The agency running the consultation platform must hold that disclosure norm and apply it consistently across submissions.",
      "access": "Documenting how a piece was built is a literacy task in its own right. An individual writing from lived experience, in a second language, or in distress can be deterred by an apparatus that reads as built for institutions with staff. Once annotated submissions read as more credible, the unannotated submission from the person the consultation most concerns counts for less, for no difference in truthfulness.",
      "openings": [
        "Keep every show-your-working feature voluntary, with the plain declaration ('I wrote this myself, based on my own experience') the fastest route to submit.",
        "Instruct readers that an absent provenance note is not evidence of assembly-line production.",
        "Make the provenance-note and source-annotation controls operable by keyboard and assistive technology, ignorable at no cost in steps, and legible in plain language. Announce each control's state non-visually."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "ShowYourWorking",
            "annotation": "Showing your working is offered as a voluntary norm rather than enforced, so a submitter who chooses the plain declaration pays no extra steps."
          }
        ]
      },
      "whereThingsGoWrong": "'Show your working' targets the provenance of inbound submissions, so on its own it does not constrain the agency side. Applied to the agency's own reasoning, the same principle (an inspectable chain from each input to the final output) is precisely what exposes an unjustified leap, such as deriving a fortnightly liability from annual data, before it stands as fact.",
      "framing": "Letting a submitter show how their text was built: which parts they wrote, which\ncame from a tool or a template, and what sources fed it. Reviewers can give a\nsubmitter's own account the weight template text can’t claim.\n",
      "challenge": "As tools that assemble polished text from multiple contributors, AI assistance,\nor a campaign template become the default way submissions are drafted, the final\nsubmission obscures the contribution of individual thought.\nDecision-makers cannot tell genuine deliberation from assembly-line production\nby reading the submitted text alone.\n",
      "precedentsNote": "**[ISO 15489-1](#s-iso-15489) records management.** The standard separates\nversion history, which records what changed in the content, from the audit\ntrail, which records who accessed, viewed, shared, or approved it, and\ntreats an immutable event log as the basis of a defensible chain of\ncustody. Document platforms implement both, down to per-character\nauthorship attribution. The distinction is settled records-management\npractice.\n\n**[Shape of AI disclosure patterns](#s-shape-of-ai).** The pattern library\ndocuments disclosure labels that name the operation performed, such as\nsummarized with AI, rewrote with AI, or translated with AI. Granular verbs\ncommunicate the nature and extent of AI involvement that a generic marker\ncannot.\n\n**[Elsevier's generative AI policy](#s-elsevier-ai-policy).** Authors must\nname the tool and the reason for its use in a set statement, and take\nresponsibility for the reviewed output; the wider academic convention\nextends the same statement to version, access date, and the sections\naffected. The declaration has moved from a binary checkbox to a structured\nstatement.\n",
      "transferability": "**Medium transferability.** The document audit trail model works when drafting\nhappens within a controlled environment. A consultation platform cannot assume\none: submitters draft wherever they like. What transfers is the disclosure shape,\nnot the capture: a provenance note in the submitter's own words (\"Drafted over the\nweek\", \"From my own notes\"), optional source annotation (\"this section draws on\n[organization]'s position paper\"), and a contribution breakdown for organizational\nsubmissions.\n\nThe legal profession model proves a voluntary norm can take hold: once\ndisclosure is expected, staying silent becomes the anomaly that draws\nscrutiny. What doesn't transfer is the disciplinary backdrop that model\nrelies on. A lawyer risks bar sanctions for non-disclosure; a consultation\nsubmitter risks nothing equivalent. The same pressure would have to come\nfrom norm-setting alone, with no professional body standing behind it.\n"
    },
    {
      "id": "1.7",
      "title": "The attestation-verification gap",
      "territory": 1,
      "slug": "attestation-verification-gap",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For the individual components: attestation forms, identity verification, and risk-based assurance levels are each settled."
        },
        {
          "level": "frontier",
          "note": "As a coherent response that pulls them into a submission intake scaling assurance to the stakes, tying the assertion to consequence, and keeping access open: not yet attempted for government consultation contexts."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [
        "1.3"
      ],
      "precedents": [
        {
          "name": "eIDAS 2.0 (Regulation (EU) 2024/1183)",
          "jurisdiction": "EU",
          "year": 2024,
          "source": "https://eur-lex.europa.eu/eli/reg/2024/1183/oj",
          "tier": "primary",
          "anchor": "eidas-2"
        },
        {
          "name": "Login.gov — our services",
          "jurisdiction": "US",
          "source": "https://www.login.gov/partners/our-services/",
          "tier": "primary",
          "anchor": "logingov"
        },
        {
          "name": "NIST SP 800-63A — Identity Proofing and Enrollment (rev. 4)",
          "jurisdiction": "US",
          "year": 2025,
          "source": "https://pages.nist.gov/800-63-4/sp800-63a.html",
          "tier": "primary",
          "anchor": "nist-63a"
        },
        {
          "name": "Mata v. Avianca, Inc. — opinion and order on sanctions (S.D.N.Y.)",
          "jurisdiction": "US",
          "year": 2023,
          "source": "https://law.justia.com/cases/federal/district-courts/new-york/nysdce/1:2022cv01461/575368/54/",
          "tier": "primary",
          "anchor": "mata-avianca"
        }
      ],
      "assurance": "Government needs an assertion from a submitter to mean something without standing up full verification infrastructure for every submission. That confidence must be traceable to a real, if pseudonymous, identity, and strong enough that a false assertion costs the submitter something real once discovered, rather than resting on evidence inspected up front. The agency receiving the submission must bind the assertion to an identity and track false attestation after the fact.",
      "access": "Organizations, law firms, and lobby groups can produce verified credentials. Most individuals can't. Without a wallet or digital ID, or with a well-founded refusal to enroll in one, a submitter lands on the unverified side. The result is a de facto two-tier intake: the verified submission is weighted up, and the attested one reads as suspect. Legal-sounding certification text adds a further deterrent. A submitter reading in a second language, unsure what they would be liable for, walks away rather than sign.",
      "openings": [
        "State plainly that unverified attestation is a valid and respected way to submit.",
        "Build no interface that visually privileges the verified tier.",
        "Write the declaration in plain language, framed as a norm rather than a penalty.",
        "Reserve sanction-grade consequence for the formal proceedings that warrant it."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "AttestationLevel",
            "annotation": "The declaration is made binding after the fact rather than verified up front, tying each submission to an identity and scaling the consequence to what the process decides."
          }
        ]
      },
      "whereThingsGoWrong": "The attestation-verification gap concerns the assurance of user submissions, so it does not directly govern automated decisions. Its core principle still applies on the agency side: an assertion must be either independently verified or backed by real after-the-fact consequence, which is exactly what an unaccountable automated process that issues adverse determinations violates.",
      "framing": "Giving an unverified declaration real weight instead of asking every\nsubmitter to prove it up front. Without something backing the declaration, an\nagency must either demand proof most submitters can't produce, or treat every\ndeclaration as meaningless.\n",
      "challenge": "Attestation (\"I declare that this is true\") and verification (\"I can prove that\nthis is true\") sit at opposite ends of the assurance spectrum. For the\nforeseeable future, most provenance signals a government channel collects will be\nattestations. As agent-prepared submissions become ordinary, the volume of\nunverifiable declarations grows with them: an agency comes to hold a mass of\nassertions it can neither check at intake nor safely ignore, and an attestation\nwith no consequence when false stops telling anyone anything.\n",
      "precedentsNote": "**Qualified Electronic Attestations under [eIDAS 2.0](#s-eidas-2), and\n[Login.gov](#s-logingov) tiers.** Under Regulation (EU) 2024/1183 a\nQualified Electronic Attestation of Attributes is issued by an accredited\ntrust service provider that has verified the attribute against authentic\nsources. Login.gov offers three service tiers spanning authentication,\nbasic identity verification, and enhanced identity verification, under a\nlive US federal deployment. Verification against authoritative sources is\noperating in both, under an accreditation regime in the EU and as a live\nfederal service in the US.\n\n**Rule 11 sanctions in [Mata v Avianca](#s-mata-avianca).** A lawyer\ncertifying that a brief was human-verified is making a self-declaration,\nand the court sanctioned attorneys who filed a false one. The attestation\nis verifiable after the fact, and a consequence attaches when it proves\nfalse.\n\n**[NIST SP 800-63A](#s-nist-63a) identity proofing (rev. 4).** The US\nguidelines scale proofing to the risk of the transaction: IAL1 validates\ncore attributes against authoritative or credible sources, IAL2 collects\nfurther evidence and applies more rigorous processes to confirm the\napplicant is the rightful owner of it, and IAL3 adds a trained proofing\nagent in an attended, on-site session with at least one biometric. Every\nrung sits above self-assertion, and an intake that takes an unproofed\ndeclaration sits below IAL1 entirely, which is where most government\nsubmission processes sit today.\n",
      "transferability": "**High transferability for the framework; the implementation is the design\nproblem.**\n\nThe legal precedent's consequence relies on professional-body accountability:\na lawyer sanctioned under Rule 11 has a bar membership at stake. An anonymous\npublic commenter has no equivalent membership to lose, so the\nconsequence-based confidence the legal model relies on doesn't fully travel\nto consultation intake. What does travel is the framework's proportionality:\nscaling how much an agency asks for to what the submission decides has\nprecedent in risk-based verification and in eIDAS's own tiers. What stays\nundesigned is a workable, non-punitive form of after-the-fact consequence\nfor someone with no professional standing to lose and, often, no fixed\nidentity to track.\n"
    },
    {
      "id": "2.1",
      "title": "Fine-grained scope negotiation",
      "territory": 2,
      "slug": "fine-grained-scope-negotiation",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For granting a typed, single-transaction scope, where RAR is a ratified IETF standard now mandated and running in production: the Central Bank of the UAE's Open Finance profile requires RAR authorization_details. The first bank is live."
        },
        {
          "level": "frontier",
          "note": "For government services, where no service catalog yet defines actions as machine-readable scopes to grant against."
        }
      ],
      "status": "published",
      "dependsOn": [
        "2.6"
      ],
      "seeAlso": [],
      "precedents": [
        {
          "name": "OAuth 2.0 Rich Authorization Requests (RAR)",
          "jurisdiction": "IETF",
          "year": 2023,
          "source": "https://datatracker.ietf.org/doc/html/rfc9396",
          "tier": "evidence",
          "anchor": "rar"
        },
        {
          "name": "GNAP — Grant Negotiation and Authorization Protocol",
          "jurisdiction": "IETF",
          "year": 2024,
          "source": "https://www.rfc-editor.org/rfc/rfc9635.html",
          "tier": "evidence",
          "anchor": "gnap"
        },
        {
          "name": "MCP Authorization Specification",
          "jurisdiction": "Global",
          "year": 2025,
          "source": "https://modelcontextprotocol.io/specification/draft/basic/authorization",
          "tier": "primary"
        },
        {
          "name": "Open Finance UAE — Security Profile (FAPI): Requires RAR",
          "jurisdiction": "UAE",
          "year": 2024,
          "source": "https://openfinanceuae.atlassian.net/wiki/spaces/standardsv1final/pages/151846988/Security+Profile+-+FAPI",
          "tier": "primary",
          "anchor": "uae-open-finance"
        },
        {
          "name": "Agent Payments Protocol (AP2) — mandates",
          "jurisdiction": "Global (FIDO Alliance)",
          "year": 2025,
          "source": "https://ap2-protocol.org/",
          "tier": "primary"
        },
        {
          "name": "Agentic Commerce Protocol — Delegated Payment Spec (OpenAI/Stripe)",
          "jurisdiction": "Global",
          "year": 2025,
          "source": "https://developers.openai.com/commerce/specs/payment",
          "tier": "primary"
        }
      ],
      "assurance": "An agency needs each grant to be inspectable enough to confirm, at the point the agent acts, that it did exactly what the user authorized and no more. The service defining the scope catalog must enforce that boundary at the point the agent acts.",
      "access": "The scope screen risks excluding users with low digital literacy, low reading confidence, or little time. A long list of granular permissions can deter them, or they approve everything unread. Either way, they end up with a broader grant than they intended. Whoever can't set up the delegation alone needs a supported route, or this pattern's protection never reaches them.",
      "openings": [
        "Put a plain-language summary on every scope.",
        "Pre-select a standard bundle as the default fast path.",
        "Offer an assisted-digital route, by phone or in person, for users who can't complete the grant alone.",
        "Let each permission on the scope-toggle consent screen be operated by keyboard and assistive technology, with its granted-or-withheld state announced, not only shown."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "DelegationConsent",
            "annotation": "Each authorized action is offered as a single plain-language permission, with a standard bundle pre-selected that the user can narrow before granting."
          }
        ]
      },
      "whereThingsGoWrong": "Without scoping, the failure is an over-broad grant: an agent given general access reaches far beyond its task. Scoped, revocable grants narrow what the agent can reach if it misbehaves, so an agent authorized only to lodge the 2025 return cannot reach superannuation or trigger a debt-recovery action. A service that defines only coarse-grained scopes can still call a grant 'narrow' while it reaches far beyond the task described. The plain-language summary is only as honest as the scope catalog behind it.",
      "framing": "Letting a user grant an agent exactly one bounded permission (lodge this return,\ntouch nothing else) in a form the service can enforce. If the agent misbehaves,\nthe harm stops at the boundary of the one permission the user granted.\n",
      "challenge": "As users authorize agents to act in government services, they will need to grant\na single, bounded permission, such as \"submit my annual tax return for the 2025\nfinancial year but not access my superannuation records,\" rather than a coarse\nread-or-write grant. Conventional authorization scopes are blunt strings that cannot\nrepresent that nuance, so the difficulty is expressing and granting authority narrow\nenough to bound one transaction.\n",
      "precedentsNote": "**[OAuth 2.0 Rich Authorization Requests](#s-rar) (RFC 9396).** The RFC\nintroduces an `authorization_details` parameter carrying a JSON array of\ntyped authorization objects, each with a type, locations, actions, and\ndomain-specific fields. A grant can be narrowed as far as a single\ntransaction.\n\n**[GNAP](#s-gnap) (RFC 9635).** The protocol supports fine-grained\ndelegation with asynchronous authorization, requiring no browser, and\nadmits software-only clients. Both properties fit a request made when no\nuser is present to answer it.\n\n**[RAR in production: Open Finance UAE](#s-uae-open-finance).** The Central\nBank of the UAE's Open Finance security profile requires that an\nauthorization server 'shall support OAuth 2.0 Rich Authorization Requests\n(RAR)', with typed `authorization_details` for account-access and\nservice-initiation consents. Where the baseline FAPI 2.0 profile only\nsuggests RAR, the CBUAE profile mandates it. The framework is\nregulator-mandated and live, with the first bank in production.\n",
      "transferability": "RAR's JSON authorization objects are directly transferable to government service\nscoping. A government service catalog could define `authorization_details` types\nfor each service action (lodge, view, amend, withdraw). GNAP's async interaction\nmodel suits agents that operate without a browser session. Open Finance UAE shows the\nstructures work in production in the financial sector. The remaining gap is\ngovernment-side: no government currently publishes a machine-readable catalog of\nactions that could populate these structures.\n"
    },
    {
      "id": "2.2",
      "title": "Digital power of attorney",
      "territory": 2,
      "slug": "digital-power-of-attorney",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For scoped, revocable delegation to an identified person."
        },
        {
          "level": "frontier",
          "note": "As an extension to a software agent, where the attorney is not a natural person."
        }
      ],
      "status": "published",
      "dependsOn": [
        "2.6"
      ],
      "seeAlso": [],
      "precedents": [
        {
          "name": "OPG blog — launch of the Use a Lasting Power of Attorney service",
          "jurisdiction": "UK",
          "year": 2020,
          "source": "https://publicguardian.blog.gov.uk/2020/07/17/weve-launched-the-new-use-a-lasting-power-of-attorney-service/",
          "tier": "primary",
          "anchor": "use-an-lpa"
        },
        {
          "name": "OPG blog — two million LPAs added to the online Use an LPA service",
          "jurisdiction": "UK",
          "year": 2025,
          "source": "https://publicguardian.blog.gov.uk/2025/04/29/two-million-lasting-powers-of-attorney-added-to-online-use-an-lpa-service/",
          "tier": "primary"
        },
        {
          "name": "Powers of Attorney Act 2023",
          "jurisdiction": "UK",
          "year": 2023,
          "source": "https://www.legislation.gov.uk/ukpga/2023/42",
          "tier": "evidence",
          "anchor": "poa-act"
        }
      ],
      "assurance": "A relying party needs to confirm that a delegation is scoped, current, and revocable, and that the user who granted it had their identity verified, so it can act on the agent's authority without re-checking with the user. The registering authority, the OPG-equivalent registry, must keep that delegation and identity-verification record current and available.",
      "access": "Powers of attorney exist for people with fluctuating or declining capacity. Those are also the people least able to complete a multi-party digital ceremony, so a digital-only flow denies the instrument to the people it's for. A donor without internet access, or without a trusted person able to help, can't reach the grant at all.",
      "openings": [
        "Retain the paper pathway in full.",
        "Offer telephone-based setup with human assistance, and in-person setup at a government shopfront.",
        "Offer assisted-digital support where a trusted person helps, which is itself a delegation-within-delegation the flow must model rather than forbid.",
        "Never let a missing digital delegation read as a missing entitlement: the donor who arrives by paper holds the same authority."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "PowerOfAttorneyCode",
            "annotation": "A delegation scoped to a category of affairs becomes a per-organization access code, each one revocable on its own by the person who granted it."
          }
        ]
      },
      "whereThingsGoWrong": "Without organization-specific scoping, a delegate authorized for one service can drift into another. Scoped, revocable, organization-specific codes prevent that, and the donor's revocation and tracking view narrows the blast radius of any single grant. An access code intercepted in transit, or reused by an attorney after the donor has already revoked it, presents authority that no longer exists. The relying organization has no way to tell the difference at the point of use; only the donor's tracking view catches it, and only after the fact.",
      "framing": "Adapting the power of attorney, the oldest instrument for scoped, revocable\ndelegation, to a delegate that is software rather than a named person. When a\ndelegation is disputed, agencies and users inherit a legal instrument courts\nalready know how to read.\n",
      "challenge": "As users delegate to software agents, an agency must be able to accept bounded,\nrevocable authority granted to an agent that has no natural-person attorney standing\nbehind it. The difficulty is reproducing the scoped authority, identity verification,\nand safeguards against abuse that paper power of attorney provided, when the delegate\nis software rather than a named person.\n",
      "precedentsNote": "**UK [Powers of Attorney Act 2023](#s-poa-act).** The Act provides for\nfully digital creation and registration of Lasting Powers of Attorney, but\ncommencement was staggered: one section took effect at Royal Assent,\nanother two months later, and the rest was left to the Lord Chancellor to\ncommence by statutory instrument. All parties must verify their identity\nelectronically, and a witness must still see the donor sign. Digitising the\noldest instrument for scoped delegation took primary legislation and a\nphased rollout, and it kept the physical safeguard.\n\n**The [Use an LPA access code](#s-use-an-lpa) (Office of the Public\nGuardian).** A donor or attorney generates a code that lets one named\norganization, such as a bank or a healthcare provider, view an online\nsummary of the LPA, and the code expires after 30 days. Over two million\nLPAs have been added to the service. The delegation is disclosed to one\nnamed relying party for a bounded period, and it lapses without any act by\nthe donor.\n",
      "transferability": "The LPA model maps closely onto agent delegation. LPAs are already scoped (health & welfare\nvs. property & financial affairs), though agent delegation would need finer granularity. The\nsecure-access-code pattern (time-limited, organization-specific codes that third parties use\nto verify authority) maps directly to agent bearer tokens. Both the delegator and the\ndelegate (agent operator) must be identity-verified.\n\nThe retained witnessing safeguard suggests that for high-stakes delegation a purely digital\nprocess may be insufficient: a \"ceremony\" step may be needed. Donors and attorneys can keep\ntrack of which organizations have had access, and a code lapses on its own after 30 days.\nWhat the OPG service does not document is cancellation before that: expiry is the control,\nnot withdrawal, which leaves a live code live until it runs out.\n\nThe gap: LPAs delegate to identified natural persons. Delegating to a software agent has no\nequivalent, and the model does not yet settle who counts as the \"attorney\" when the delegate\nis an AI system, the agent operator that runs it, or the specific software instance.\n"
    },
    {
      "id": "2.3",
      "title": "Consumer data rights consent flows",
      "territory": 2,
      "slug": "open-banking-consent-flows",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For consumer-data consent in banking, where redirect flows, strong customer authentication, and consent dashboards run in production under PSD2 and the CDR."
        },
        {
          "level": "frontier",
          "note": "For a government service taking scoped, revocable authorization for a user's agent through such a flow, which no agency yet operates."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "Open Banking UK — Customer Experience Guidelines",
          "jurisdiction": "UK",
          "year": 2026,
          "source": "https://standards.openbanking.org.uk/customer-experience-guidelines/latest/",
          "tier": "primary",
          "anchor": "obuk-cx"
        },
        {
          "name": "Open Banking UK — TPP Permissions and CASS considerations",
          "jurisdiction": "UK",
          "source": "https://standards.openbanking.org.uk/customer-experience-guidelines/appendices/tpp-permissions-and-cass-considerations/latest/",
          "tier": "primary"
        },
        {
          "name": "OAIC — CDR consent, authorisation and dashboards guidance",
          "jurisdiction": "AU",
          "source": "https://www.oaic.gov.au/consumer-data-right/consumer-data-right-guidance-for-business/privacy-obligations/consumer-consent,-authorisation-and-dashboards",
          "tier": "primary",
          "anchor": "oaic-cdr"
        },
        {
          "name": "Treasury — CDR Consent Review Design Paper",
          "jurisdiction": "AU",
          "year": 2023,
          "source": "https://treasury.gov.au/sites/default/files/2023-08/c2023-434434-consent-design-paper.pdf",
          "tier": "primary",
          "anchor": "treasury-consent-review"
        },
        {
          "name": "DSB — CDR CX Guidelines: Authenticate",
          "jurisdiction": "AU",
          "year": 2026,
          "source": "https://cx.dsb.gov.au/authenticate",
          "tier": "primary",
          "anchor": "cdr-authenticate"
        }
      ],
      "assurance": "An agency needs the user's authorization to be specific, standing, and revocable, with the user authenticating to the government rather than to the agent, so that what the agent may do is informed and remains manageable over time. The government identity provider must hold and keep current that standing consent record.",
      "access": "Redirect flows drop a screen-reader user's context mid-journey. A time-limited strong-authentication challenge fails people with motor or cognitive impairments before they can complete it. SMS one-time codes assume a personal mobile, excluding those without one. In each case, the user intends to grant the authority, and the ceremony itself refuses them.",
      "openings": [
        "Extend the strong-authentication challenge window.",
        "Offer authentication channels that don't assume a phone: a hardware token, an email.",
        "Confirm consent through an alternative channel, such as a phone call with an automated readback of the permissions being granted.",
        "Let assistive technology read each permission's state on the consent screen and the standing dashboard, and keep revocation reachable by keyboard alone."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "DataRightsConsent",
            "annotation": "Delegations that only view data are kept apart from those that act, so authorizing an action takes a heavier confirmation than authorizing a look."
          }
        ]
      },
      "whereThingsGoWrong": "The failure to prevent is an over-broad or unauthorized data grab proceeding silently at scale. Redirect authentication keeps credentials away from the agent and forces the user to confirm scoped permissions, so that grab cannot happen unseen. A registered but rogue third-party provider can still request a bundled scope well beyond its stated purpose, counting on the user to confirm without reading it. A phished redirect can present a lookalike consent screen before the user ever reaches the bank's own page, capturing a grant the user never gave to the real service.",
      "framing": "Taking a user's authorization through a consent flow the user completes with the\ngovernment rather than with the agent: scoped permissions, strong authentication,\nand a standing dashboard for review and revocation. A compromised or over-reaching\nagent can't use credentials it never held.\n",
      "challenge": "When a user authorizes an AI agent to reach a government service on their behalf, that\nauthorization has to hold over months, not just at the moment it is granted.\n\nA flow that re-prompts the user at every step collapses under its own ceremony, and one\nthat never re-prompts drifts out of the user's control.\n",
      "precedentsNote": "**[Open Banking UK Customer Experience Guidelines](#s-obuk-cx).** The\nconsent journey runs as a redirect: the customer starts in the third-party\nprovider, the provider states the scope of data or payment access, the\ncustomer is sent to their bank for Strong Customer Authentication, confirms\nthe specific permissions, and returns. The Guidelines mandate consent and\naccess dashboards for ongoing management, minimal information presentation,\nand platform-agnostic wireframes. Scope is stated by the requester and\nconfirmed at the holder, which keeps the two acts apart.\n\n**[Australia's Consumer Data Right](#s-oaic-cdr) (CDR).** Data holders and\naccredited data recipients must both provide consumer dashboards that are\n'simple and straightforward to use and prominently displayed', and the\nconsent flow treats collection, use, and disclosure as separate elements.\nLater amendments introduced bundled and pre-filled consent for necessary\ndata, and the [Treasury design paper](#s-treasury-consent-review)\nconsidered a principles-based ban on dark patterns. The regime carries a\nformal Consent Review process covering authorization, revocation,\nre-authorization, and notification.\n\n**[CDR authentication standards](#s-cdr-authenticate).** The CX Standards\nrequire data holders and recipients to tell consumers that third parties do\nnot need their passwords to reach CDR data, and prohibit forgotten-details\nlinks on redirect screens as an affordance judged to raise the likelihood\nof phishing. The Guidelines make app-based authentication, by biometrics or\na PIN in the data holder's own app, the preferred flow, with the web\none-time-password redirect kept as a fallback. Credential isolation is\nstated to the consumer, and not left to the architecture to imply.\n",
      "transferability": "Open-banking consent flows are the closest existing analogue to government-to-agent\ndelegation. Directly transferable: redirect-based authentication (the user authenticates\nwith the government identity provider, not the agent, which never sees credentials);\nscoped permissions with human-readable summaries; consent dashboards for viewing, managing,\nand revoking active delegations; SCA for re-authorization when the agent requests expanded\nscope; and time-bound access that expires and must be renewed.\n\nKey differences for government services: government actions are often irreversible (lodging\na tax return, applying for a benefit) in ways that viewing bank data is not. The consent\nmodel needs to distinguish \"view\" delegations from \"act\" delegations, with higher ceremony\nfor the latter. The CDR's experience with dark patterns is cautionary: bundled and\npre-filled consents reduce friction but can undermine informed delegation. The temptation\nto bundle (\"just let the agent do everything\") has to be resisted by design.\n"
    },
    {
      "id": "2.4",
      "title": "Consent receipts and records",
      "territory": 2,
      "slug": "consent-receipts-and-records",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For recording consent in a durable, machine-readable form."
        },
        {
          "level": "emerging",
          "note": "As specified in Kantara and ISO/IEC TS 27560, designed for a relying agency to verify after the fact, though no named deployment is cited here yet."
        },
        {
          "level": "frontier",
          "note": "For a delegation receipt naming a software delegate: neither the Kantara specification nor ISO/IEC TS 27560 contemplates a non-human delegate."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [
        "3.2"
      ],
      "precedents": [
        {
          "name": "Kantara Initiative — Consent Receipt Specification",
          "jurisdiction": "International",
          "source": "https://kantarainitiative.org/download/consent-receipt-specification/",
          "tier": "primary",
          "anchor": "kantara-receipt"
        },
        {
          "name": "ISO/IEC TS 27560:2023 — Consent record information structure",
          "jurisdiction": "ISO/IEC",
          "year": 2023,
          "source": "https://www.iso.org/standard/80392.html",
          "tier": "primary",
          "anchor": "iso-27560"
        },
        {
          "name": "DSB — CDR CX Guidelines: CDR Receipts",
          "jurisdiction": "AU",
          "year": 2026,
          "source": "https://cx.dsb.gov.au/notifications/cdr-receipts",
          "tier": "primary",
          "anchor": "cdr-receipts"
        },
        {
          "name": "IEEE 7012-2025 — Machine Readable Personal Privacy Terms",
          "jurisdiction": "International (IEEE)",
          "year": 2025,
          "source": "https://standards.ieee.org/ieee/7012/7192/",
          "tier": "primary"
        }
      ],
      "assurance": "After a delegation has been used, a relying agency and the user both need to verify its scope, the parties, and its temporal bounds, and to tell what was authorized apart from what the agent did. The agency or identity provider that issued the original delegation must generate and retain that receipt.",
      "access": "A machine-readable record the user can't read is evidence they can't use. The person least able to parse a structured receipt is the person least able to contest an agent that exceeded its grant.",
      "openings": [
        "Give every delegation receipt a human-readable rendering: a plain-language summary in the user's preferred language, across web, PDF, email, SMS summary, and paper on request.",
        "Make the complete record of actions taken under the delegation available in an accessible format on request.",
        "Make the receipt view's timeline and download controls work with assistive technology, and state scope, parties, and time bounds in words, not codes."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "ConsentReceipt",
            "annotation": "The consent lifecycle, from collection through to withdrawal, is rendered as a timeline the user can read and take away as a record."
          }
        ]
      },
      "whereThingsGoWrong": "Without a durable record, a user cannot prove what an agent was authorized to do versus what it did. A verifiable receipt of exactly what was authorized, and what was done under it, gives the user the evidence to contest an action taken outside its granted scope. An issuer who backfills the action log after an overreach, or withholds the record until a dispute has cooled, can make the receipt say whatever is convenient by then. The receipt only holds up if entries are appended at the time of action and cannot be edited afterward.",
      "framing": "Giving every delegation a durable, verifiable record: what was authorized, by\nwhom, for how long, and what was done under it. When a delegation is later\ndisputed, the user and the agency can point to the same record of what was\nauthorized.\n",
      "challenge": "As agents act asynchronously and at scale, the consent record has to\nstay verifiable long afterward: what was consented to, when, by whom, and under what\nconditions, in a form the agency receiving the agent's requests can check. The record at\nissue here is the grant itself. The receipt an agency issues for any single action taken\nunder it is a separate instrument, and holding the two side by side is what makes an\noverreach provable.\n",
      "precedentsNote": "**[Kantara Consent Receipt Specification](#s-kantara-receipt).** The\nspecification defines a JSON record carrying transaction information, the\ncontroller's contact details, the principal's information, links to privacy\npolicies, and a description of the data collected with its purposes and\nprocessing. ISO/IEC 29184:2020 references it. The receipt is a settled\nstructure with a published field list.\n\n**[ISO/IEC TS 27560](#s-iso-27560), consent record information structure.**\nThe specification covers machine-readable consent records and receipts\nacross the full lifecycle: collection, storage, retrieval, modification,\nand withdrawal. It works alongside ISO/IEC 29184:2020, which handles the\nhuman-readable representation. The machine-readable record and the\nhuman-readable notice are standardized separately and designed to pair.\n\n**[Australia's CDR receipts](#s-cdr-receipts).** A CDR receipt must be\ngiven as soon as practicable after a consumer gives, amends, or withdraws a\nconsent, and it names who holds the consent, its purpose, the data covered,\nits duration, and how to review and withdraw it. The receipt must be given\n'in writing otherwise than through the consumer dashboard'. The record of\nwhat was authorized therefore sits somewhere the authorized party's own\ninterface cannot revise or bury.\n",
      "transferability": "Consent receipts are directly applicable to agent delegation records. A \"delegation\nreceipt\" would extend the consent receipt model with: delegation scope (the specific\nactions and services authorized, using RAR-style `authorization_details`); delegate\nidentity (the agent operator and, where possible, the specific agent instance); delegator\nidentity (bound to a verified digital identity); temporal bounds (start time, expiry,\nrenewal conditions); a revocation mechanism (how to revoke, and what happens to in-flight\ntransactions); and an audit trail of actions taken under the delegation.\n\nThe ISO/IEC 27560 lifecycle model (collect, store, retrieve, modify, withdraw) maps well to\na delegation lifecycle. The gap: neither standard contemplates a non-human delegate or the\nprovenance chain needed to prove an agent acted within its delegated authority.\n"
    },
    {
      "id": "2.5",
      "title": "Delegation registries",
      "territory": 2,
      "slug": "delegation-registries",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For verifying delegation through deployed registries."
        },
        {
          "level": "emerging",
          "note": "As registries built on verifiable credentials."
        },
        {
          "level": "frontier",
          "note": "For confirming an agent's live, scoped, unrevoked authority."
        }
      ],
      "status": "published",
      "dependsOn": [
        "2.6"
      ],
      "seeAlso": [],
      "precedents": [
        {
          "name": "Australia's Relationship Authorisation Manager (RAM)",
          "jurisdiction": "AU",
          "source": "https://authorisationmanager.gov.au/",
          "tier": "primary",
          "anchor": "ram"
        },
        {
          "name": "ATO — Accessing online services with Digital ID and RAM",
          "jurisdiction": "AU",
          "source": "https://www.ato.gov.au/online-services/accessing-online-services-with-digital-id-and-ram",
          "tier": "primary"
        },
        {
          "name": "Australian Government Architecture — Relationship Authorisation Manager",
          "jurisdiction": "AU",
          "source": "https://architecture.digital.gov.au/design/relationship-authorisation-manager",
          "tier": "primary"
        },
        {
          "name": "Credential Engine — trust registries for verifiable credential ecosystems",
          "jurisdiction": "International",
          "year": 2025,
          "source": "https://credentialengine.org/2025/06/09/building-trust-in-a-digital-world-scalable-solutions-for-verifiable-credential-ecosystems/",
          "tier": "evidence",
          "anchor": "trust-registries"
        },
        {
          "name": "Agent Identity Protocol (AIP) — arXiv 2603.24775",
          "jurisdiction": "International",
          "year": 2026,
          "source": "https://arxiv.org/abs/2603.24775",
          "tier": "evidence",
          "caveat": "preprint",
          "anchor": "aip"
        },
        {
          "name": "AIP — IETF individual Internet-Draft (draft-prakash-aip)",
          "jurisdiction": "IETF",
          "source": "https://www.ietf.org/archive/id/draft-prakash-aip-00.html",
          "tier": "evidence",
          "caveat": "unadopted-draft"
        }
      ],
      "assurance": "A relying agency needs confidence that an agent's authority is current, scoped to the action at hand, and not revoked, and it must reach that confidence without contacting the user in real time. The agency running the delegation registry, on the RAM model, must keep that record current.",
      "access": "The registry itself is back-end. Its exclusion risk shows up at the front door. When creating or revoking a delegation requires a digital identity gated on biometric verification, it excludes users without reliable connectivity, users whose disability prevents biometric verification, and users who distrust the system enough to avoid it. That denial does the most harm here: a person left unable to stop their own agent.",
      "openings": [
        "Offer more than one way to manage a delegation: web dashboard, phone service, in person.",
        "Notify by SMS or email whenever a delegation is used, created, or modified.",
        "Hold revocation to the lowest assurance bar the system can defend: it must always be easier to stop an agent than to start one."
      ],
      "surface": {
        "instances": [
          {
            "domain": "service",
            "kind": "interactive",
            "component": "DelegationRegistry",
            "annotation": "Tiered delegation roles are presented as a ranked authorization list, with per-agent revocation and a notification to the user each time a delegation is used."
          }
        ]
      },
      "whereThingsGoWrong": "The failure mode is an agent that keeps acting on authority the user has already withdrawn. Real-time revocation checking against a registry means a canceled delegation stops working immediately, so stale authority cannot persist across many users. If a relying party falls back to a cached authorization when the registry is slow or unreachable, a revoked agent keeps acting for as long as that outage lasts. The check only holds when an outage is treated as a refusal, never as a pass.",
      "framing": "A registry an agency can query at the moment an agent acts, so a delegation can be\nchecked without contacting the user, who is usually not there.\n",
      "challenge": "The agency receiving an agent's request cannot see the delegation behind it\ndirectly, and must confirm it before acting on the request.\nThe difficulty is reaching that confirmation at the moment of the request without\ncontacting the user, who will often not be present when their agent acts.\n",
      "precedentsNote": "**[Australia's Relationship Authorisation Manager](#s-ram) (RAM).** RAM is\na delegation registry operated by the ATO that links a person's digital\nidentity, myID, to an Australian Business Number and records who may act\nfor that business. It supports hierarchical roles of principal authority,\nadministrator, and standard user, and serves the ATO, DEWR, and AusCheck.\nAuthority is tied to a verified digital identity, and not to a shared\nusername and password.\n\n**[Credential Engine](#s-trust-registries) on trust registries for verifiable credentials.** A\ntrust framework built on W3C Verifiable Credentials issues tamper-evident\nproofs of authority, with issuer identity registries publishing DIDs for\nrecognized issuers. Delegation happens through credential issuance,\nrevocation through credential status lists, and verification without\ncontacting the issuer in real time. The registry holds who may issue, and\nthe credential carries what was delegated.\n\n**[Agent Identity Protocol](#s-aip) (AIP).** The proposal introduces\nInvocation-Bound Capability Tokens that fuse identity, attenuated\nauthorization, and provenance binding into a single append-only chain. It\ndefines two wire formats, a signed JWT for a single hop and a Biscuit token\nwith Datalog policies for multi-hop delegation, with transport bindings\nacross MCP, A2A, and HTTP. The registry role is played by the token chain\nitself.\n",
      "transferability": "RAM is the closest existing government precedent for a delegation registry, though it handles\nbusiness-to-individual delegation rather than user-to-agent delegation. A government agent\ndelegation registry would need to register agent operators (companies providing AI agent\nservices), on the model of tax agent registration, then bind delegations to verified\nuser identities, support real-time revocation checking, and provide delegation\nverification as a service to relying agencies.\n\nAIP's token-chaining model is particularly relevant for multi-hop delegation: a user\ndelegates to Agent A, which delegates a subset of authority to Agent B for a specific\nsub-task. The Datalog policy language allows attenuation, so each hop can only narrow the\nauthority, never expand it.\n\nThe gap: no existing registry handles the \"agent identity\" problem. Is the delegate a\ncompany (the agent operator), a specific model version, a running instance? RAM identifies\nnatural persons. AIP proposes cryptographic identity binding but has no production\ndeployments.\n"
    },
    {
      "id": "2.6",
      "title": "Binding an agent to a verified identity",
      "territory": 2,
      "slug": "identity-binding-to-verified-identity",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For verifying a person's identity to a defined assurance level."
        },
        {
          "level": "emerging",
          "note": "For modeling a representative acting for a represented person, where Australia's RAM already does this for business delegations."
        },
        {
          "level": "frontier",
          "note": "For binding an agent's delegation to that verified identity."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "Login.gov — our services",
          "jurisdiction": "US",
          "source": "https://www.login.gov/partners/our-services/",
          "tier": "primary",
          "anchor": "logingov"
        },
        {
          "name": "Login.gov developers — integration overview (FedRAMP moderate approved)",
          "jurisdiction": "US",
          "year": 2025,
          "source": "https://developers.login.gov/overview/",
          "tier": "primary"
        },
        {
          "name": "Login.gov — passport-based identity verification",
          "jurisdiction": "US",
          "year": 2025,
          "source": "https://www.login.gov/partners/program-updates/login-gov-begins-passport-based-identity-verification/",
          "tier": "evidence"
        },
        {
          "name": "ATO — Digital ID and RAM",
          "jurisdiction": "AU",
          "source": "https://www.ato.gov.au/online-services/accessing-online-services-with-digital-id-and-ram",
          "tier": "primary",
          "anchor": "ato-digital-id"
        },
        {
          "name": "eIDAS 2.0 (Regulation (EU) 2024/1183)",
          "jurisdiction": "EU",
          "year": 2024,
          "source": "https://eur-lex.europa.eu/eli/reg/2024/1183/oj",
          "tier": "primary",
          "anchor": "eidas-2"
        },
        {
          "name": "EUDI Wallet Architecture and Reference Framework 3.0.0 — Annex 2, Topic 29 (Representation paradigm)",
          "jurisdiction": "EU",
          "year": 2026,
          "source": "https://eudi.dev/3.0.0/annexes/annex-2/annex-2.02-high-level-requirements-by-topic/",
          "tier": "primary",
          "anchor": "eudi-arf"
        },
        {
          "name": "European Commission — OOTS Technical Design Documents 2.3, Representation (March 2025)",
          "jurisdiction": "EU",
          "year": 2025,
          "source": "https://ec.europa.eu/digital-building-blocks/sites/spaces/TDD/pages/887384532/2.3+-+Representation+March+2025",
          "tier": "evidence",
          "anchor": "oots"
        }
      ],
      "assurance": "A relying party needs confidence that the user an agent represents is who they are claimed to be, verified to a defined assurance level, so it can inspect both the agent's identity and the represented user's before acting. The identity provider, the login.gov or myID-equivalent issuer, must hold and attest that verified assurance level.",
      "access": "Identity verification gates subsequent delegations, so exclusions here prevent further access. Biometric checks fail people with certain disabilities or recent facial changes. Document-based proofing fails older adults and anyone without the required papers, denying them the verified identity a delegation must bind to. The user who most needs a carer's help is asked to clear the check alone, and a person under guardianship may hold no documents in their own name at all.",
      "openings": [
        "Offer more than one verification pathway: in-person vouching, telephone verification with knowledge-based questions, or trusted-referee models.",
        "Let a delegated human assist with the verification itself, without holding the user's credentials."
      ],
      "surface": {
        "instances": [
          {
            "domain": "service",
            "kind": "interactive",
            "component": "IdentityBinding",
            "annotation": "The agent's identity and the identity of the person it acts for are shown together, so a verifier can confirm both before granting access."
          }
        ]
      },
      "whereThingsGoWrong": "Without identity binding, an agent can act on an unverified or spoofed identity, opening the door to mass automated action against the wrong people. Binding every delegation to a verified identity at a defined assurance level closes that door.",
      "framing": "Tying every delegation to a user identity verified to a known assurance level.\nWhen a delegation is challenged, the agency can trace it to a person whose\nidentity was verified at a known level.\n",
      "challenge": "As agents act for users across government services, a relying party has no way to confirm\non its own that the user behind a delegation is who they are claimed to be. The difficulty\nis tying a delegation to an identity verified to a defined assurance level, rather than to\na username an agent could present for anyone.\n",
      "precedentsNote": "**[Login.gov](#s-logingov) (United States).** The service offers three\nlevels (authentication, basic identity verification, and enhanced identity\nverification) mapped to the NIST identity and authentication assurance\nlevels, supports SAML and OIDC, and holds a FedRAMP Moderate authorization.\nIt has added passport-based remote identity verification. It supports no\ndelegation and no agent authorization.\n\n**The [ATO's myID and RAM](#s-ato-digital-id) (Australia).** The ATO operates Australia's digital identity system,\nproofing identity by biometric verification against government-held\ndocuments, and RAM records who may act for a business. It is\nrepresentative-and-represented modeling running in production. It does not\nextend to an individual delegating to a software agent.\n\n**[EU Digital Identity Wallet](#s-eidas-2) under eIDAS 2.0.**\nRepresentation is operative in the instrument: Annex VI item 9 lists\n'Powers and mandates to represent natural or legal persons' among the\nminimum attributes a qualified trust service provider must verify against\nan authentic source, and Article 3(5a) defines the user as including 'a\nnatural person representing another natural person or a legal person'.\nQualified Electronic Attestations of Attributes are the vehicle by which\nsuch an attestation carries legal effect. Representation is a named\nattribute class in the Regulation itself.\n\n**[EUDI Architecture and Reference Framework 3.0.0](#s-eudi-arf), Topic\n29.** Annex 2's 'Representation paradigm' topic carries two SHALL requirements: a\nrulebook for representation attestations must specify 'attributes used for\ndefining a validity period, the nature of the representation, and the\noperations the representative is authorised to perform', and those\nattestations must be short-lived or revocable. The binding is specified\ndown to validity period and revocability.\n\n**[The OOTS representation attributes](#s-oots).** The Once-Only Technical\nSystem defines a PowerOfRepresentationScope attribute and pairs a\nrepresentative attribute set with a represented-person set, so a\ncross-border request carries both identities and the scope joining them.\nThe pairing is specified for that system, and the wallet architecture's own\nrequirements for legal-person wallet units are still empty placeholders.\nA production cross-border channel already models the representative and the\nrepresented person as two linked attribute sets.\n",
      "transferability": "Of the three, the EU model is the only one whose representation is specified rather than\nabsent: a representation attestation has its own type, and the rulebook governing it must\nbound the operations the representative may perform. The EU's representation-attestation\nshape could extend to agent delegation: the agent presents a credential attesting to the\nuser's delegation, and the verifying agency can inspect both the agent's identity and the\nuser's identity. But the specification itself stops at one natural person representing\nanother.\n\nLogin.gov and myID currently lack delegation capabilities: they verify \"who you are\" but\nnot \"who you can act for.\" For agent delegation, the identity provider must verify the\nuser's identity, bind the delegation grant to that verified identity, optionally verify\nthe agent operator's identity, and issue a delegation credential or token that relying\nparties can verify. The EUDIW's QEAA model could accommodate this: a Qualified Trust Service\nProvider issues an attestation that \"User X has authorized Agent Operator Y to perform\nactions Z until date W.\"\n"
    },
    {
      "id": "2.7",
      "title": "Step-up re-authorization for sensitive actions",
      "territory": 2,
      "slug": "step-up-re-authorization-for-sensitive-actions",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For demanding stronger authentication at a sensitive action."
        },
        {
          "level": "emerging",
          "note": "As applied to human-agent delegation in tax."
        },
        {
          "level": "frontier",
          "note": "As applied to an AI agent that must confirm asynchronously."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "OpenID Connect Core 1.0 — step-up authentication (acr_values / max_age)",
          "jurisdiction": "International",
          "source": "https://openid.net/specs/openid-connect-core-1_0.html",
          "tier": "primary",
          "anchor": "oidc-stepup"
        },
        {
          "name": "IETF RFC 9470 — OAuth 2.0 Step-Up Authentication Challenge Protocol",
          "jurisdiction": "IETF",
          "source": "https://datatracker.ietf.org/doc/html/rfc9470",
          "tier": "primary",
          "anchor": "rfc-9470"
        },
        {
          "name": "Open Banking UK — Customer Experience Guidelines",
          "jurisdiction": "UK",
          "year": 2026,
          "source": "https://standards.openbanking.org.uk/customer-experience-guidelines/latest/",
          "tier": "primary",
          "anchor": "obuk-cx"
        },
        {
          "name": "HMRC Research Report 754 — granular authorisations for tax agents (MTD ITSA)",
          "jurisdiction": "UK",
          "year": 2024,
          "source": "https://gov.uk/government/publications/exploring-customer-views-on-granular-authorisations-for-tax-agents-within-making-tax-digital-for-income-tax-self-assessment/exploring-customer-views-on-granular-authorisations-for-agents-within-making-tax-digital-for-income-tax-self-assessment",
          "tier": "evidence",
          "anchor": "hmrc-754"
        },
        {
          "name": "OpenID AuthZEN — Access Request and Approval Profile and MCP tool-authorization profile (working group drafts)",
          "jurisdiction": "International (OpenID Foundation)",
          "year": 2026,
          "source": "https://openid.net/openid-foundation-advances-authorization-for-the-agent-era-with-new-authzen-working-group-drafts/",
          "tier": "evidence"
        }
      ],
      "assurance": "For a high-stakes or irreversible action, an agency needs confidence that the user, not the agent alone, authorized this particular step, with the strength of that confirmation proportionate to what is at stake. The agency performing the authentication challenge must run and hold that step-up confirmation itself.",
      "access": "A step-up challenge assumes the user can receive it and answer in time. No smartphone means no push or SMS challenge. A tight response window fails people who need longer to read, move, or decide. In each case, the confirmation step blocks the exact action the user meant to authorize.",
      "openings": [
        "Offer challenge channels beyond the phone: email, a phone call, in person at a shopfront.",
        "Measure response windows in hours rather than minutes for actions that aren't time-critical.",
        "Let the user set a pre-approved actions list during delegation setup, so routine steps don't generate challenges at all.",
        "State plainly in the challenge, whatever channel it arrives by, what the agent is asking to do and what confirming will commit the user to."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "StepUpChallenge",
            "annotation": "Each requested action is routed by its sensitivity, so a routine lookup proceeds on the delegation alone and an irreversible one stops for fresh authentication."
          }
        ]
      },
      "whereThingsGoWrong": "The risk is an agent silently executing high-stakes, irreversible decisions en masse with no human in the loop. Forcing the user to re-authenticate and explicitly confirm such actions reintroduces a human decision point before harm is done. An agent that triggers enough of these challenges can induce alert fatigue, training the user to approve on reflex rather than read. A challenge delivered to a channel the agent also monitors, such as an email inbox it can read, can be intercepted and cleared before the user ever sees it.",
      "framing": "Pausing an agent at the sensitive or irreversible step and putting that one\ndecision back in the user's hands, at a confirmation strength matched to the\nstakes. Routine actions proceed on the standing grant; consequential ones wait\nfor the user.\n",
      "challenge": "As agents act under a standing delegation, some of the actions they take will be sensitive or\nirreversible while most are routine: viewing a tax return status is low-risk; lodging\nan amended return is not. The difficulty is re-inserting a human decision point\nfor the high-stakes actions without forcing the user to confirm every routine one.\n",
      "precedentsNote": "**[OpenID Connect step-up authentication](#s-oidc-stepup).** A step-up maps\nto the NIST authentication assurance levels: a user at AAL1 with a password\nalone is challenged to reach AAL2 with a second factor before a sensitive\naction. In OIDC it is carried by the `acr_values` or `max_age` parameters\non the authorization request, and [RFC 9470](#s-rfc-9470) defines the\nchallenge a resource server returns. Common triggers are high-value\ntransactions, access to personal or medical records, and account\nmodifications.\n\n**[Open Banking UK Strong Customer Authentication](#s-obuk-cx).** PSD2\nmandates Strong Customer Authentication for payment initiation and certain\ndata access, and the bank performs the challenge, not the third-party\nprovider. The Customer Experience Guidelines document the redirect-to-SCA\nstep as it runs in production. The party holding the account confirms the\naction, so the confirmation cannot be produced by the software that asked\nfor it.\n",
      "transferability": "Step-up re-authorization is directly transferable. The pattern: the agent presents its\ndelegation token; the service evaluates the requested action against a sensitivity\nclassification; low-sensitivity actions (view, status check) proceed on the token alone;\nmedium-sensitivity actions (submit, amend) interrupt the agent's flow and contact the user\ndirectly (push, SMS, email) for confirmation; and high-sensitivity actions (irrevocable\ndecisions, large payments) require the user to re-authenticate at a higher assurance level\nand explicitly confirm.\n\nThe HMRC granular-authorization model shows this is already being designed for human tax\nagents, and extending it to AI agents is a natural step.\n\nThe open problem is latency. Step-up authentication in open banking works because the human\nis present at the keyboard. For an AI agent operating asynchronously, a step-up challenge\nintroduces a delay the agent must handle gracefully: pause, notify the user, wait for\nconfirmation, then resume.\n"
    },
    {
      "id": "2.8",
      "title": "Nominated-agent authorization",
      "territory": 2,
      "slug": "tax-agent-authorization-model",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For registered human agents, where client-initiated nomination at typed authority levels runs in production at the ATO, IRS, and HMRC."
        },
        {
          "level": "frontier",
          "note": "For AI agent operators, where the registration, professional standards, and liability scaffolding the model depends on does not yet exist."
        }
      ],
      "status": "published",
      "dependsOn": [
        "2.6"
      ],
      "seeAlso": [],
      "precedents": [
        {
          "name": "ATO — Tax agents",
          "jurisdiction": "AU",
          "source": "https://www.ato.gov.au/online-services/tax-agents",
          "tier": "primary",
          "anchor": "ato-tax-agents"
        },
        {
          "name": "ATO — How to nominate your registered agent",
          "jurisdiction": "AU",
          "source": "https://www.ato.gov.au/businesses-and-organisations/preparing-lodging-and-paying/agent-nomination/how-to-nominate-your-registered-agent",
          "tier": "primary",
          "anchor": "ato-nominate"
        },
        {
          "name": "IRS — Power of Attorney and other authorizations",
          "jurisdiction": "US",
          "source": "https://www.irs.gov/businesses/small-businesses-self-employed/power-of-attorney-and-other-authorizations",
          "tier": "primary",
          "anchor": "irs-poa"
        },
        {
          "name": "HMRC Research Report 754 — granular authorisations for tax agents (MTD ITSA)",
          "jurisdiction": "UK",
          "year": 2024,
          "source": "https://gov.uk/government/publications/exploring-customer-views-on-granular-authorisations-for-tax-agents-within-making-tax-digital-for-income-tax-self-assessment",
          "tier": "evidence",
          "anchor": "hmrc-754"
        }
      ],
      "assurance": "An agency needs the nomination of an agent to be client-initiated, scoped to a typed level of authority, and tied to an accountable operator, so that an agent cannot authorize itself and responsibility for its actions is fixed.",
      "access": "The nomination step contains its own exclusion. Requiring the client to nominate an agent from inside their own authenticated session is a barrier for the exact users who want an agent because they can't operate digital services alone. It leaves them unable to authorize the help they need. A person under guardianship needs the nomination to be makeable by their guardian, in a form the agency recognizes.",
      "openings": [
        "Offer telephone nomination, with identity verified through knowledge-based checks and the agent nominated verbally.",
        "Offer in-person nomination at a government shopfront.",
        "Accept nomination by a recognized intermediary with its own verifiable delegation chain."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "AgentNomination",
            "annotation": "Levels of authority, from full representation down to discussing a single return, are set per agent by the user from their own dashboard."
          }
        ]
      },
      "whereThingsGoWrong": "Where this goes wrong is agents self-authorizing, with no one bearing liability when an automated process fails at scale. Client-initiated nomination through the user's own session prevents self-authorization, and registering the operator as an accountable party fixes responsibility. An operator that hijacks or replays a client's authenticated session can complete the nomination step itself, presenting a self-appointment as though the client had made it. Requiring the nomination to originate inside a fresh, client-controlled session is what closes that path, not just the existence of a nomination step.",
      "framing": "Requiring the user to nominate the agent that will act for them, rather than\nletting the agent nominate itself. The nomination record lets an agency refuse\nany agent the user never appointed.\n",
      "challenge": "Nothing stops a software agent from presenting itself to a government service\nas authorized when no user ever appointed it. The difficulty is\npreventing an agent from authorizing itself and fixing who is responsible when it acts.\nLong-standing tax-agent authorization, refined over decades, is the closest precedent for\nhow to do this.\n",
      "precedentsNote": "**[ATO tax agent authorization](#s-ato-tax-agents).** Tax agents must be\nregistered with the Tax Practitioners Board, which makes them a regulated\nclass of delegate, and clients [nominate their agent](#s-ato-nominate) from\ntheir own authenticated session. Authorization runs until the client\nrevokes it, agents reach ATO services through myID and RAM, and a client\ncan authorize different agents for different roles. The nomination step\nputs the grant on the principal's side of the boundary.\n\n**[IRS Form 2848 and related authorizations](#s-irs-poa).** The IRS types\nauthorization by what it permits: a Power of Attorney for full\nrepresentation, a Tax Information Authorization for view-only access, a\nThird Party Designee to discuss a specific return, and Oral Disclosure for\na single phone conversation. Individual taxpayers can authorize\npractitioners through their online account, and representation is limited\nto attorneys, CPAs, and enrolled agents. The scope of a delegation is a\nnamed type, chosen at the moment of grant.\n\n**[HMRC Making Tax Digital agent authorization](#s-hmrc-754).** HMRC is\ndeveloping multiple-agent functionality under which different agents hold\ndifferent permission scopes for the same taxpayer. It is the closest\nexisting model to a scoped agent delegation, and it sits in research rather\nthan in a shipped service.\n",
      "transferability": "The tax agent model is the strongest existing analogue for AI agent delegation. Transferable\nelements: agent registration/accreditation (AI agent operators could be required to register\nwith a regulatory body analogous to the Tax Practitioners Board, making the operator rather\nthan the software responsible); client-initiated nomination (the user must actively nominate\nthe agent through their own authenticated session, preventing self-authorization); typed\nauthorization levels (view only, submit, represent, with appropriate ceremony for each); and\nmultiple concurrent agents for different services.\n\nCritical gap: tax agents are natural persons who bear professional liability. AI agent\noperators can be corporate entities, but the AI agent itself has no professional standing, no\nliability insurance, and no disciplinary body. The institutional scaffolding (registration,\nprofessional standards, complaints mechanisms) would need to be built for AI agent operators.\n"
    },
    {
      "id": "2.9",
      "title": "User-defined access policies",
      "territory": 2,
      "slug": "user-managed-access",
      "maturity": "emerging",
      "maturityNote": "Emerging for letting a user set standing, conditional rules that an agency evaluates without the user present; the response exists as a worked-out approach but has seen limited adoption.",
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "Justin Richer — UMA 2.0",
          "jurisdiction": "International",
          "source": "https://justinsecurity.medium.com/uma-2-0-437c293c3283",
          "tier": "evidence"
        },
        {
          "name": "Kantara — UMA 2.0 Grant specification",
          "jurisdiction": "International",
          "source": "https://docs.kantarainitiative.org/uma/wg/rec-oauth-uma-grant-2.0.html",
          "tier": "primary",
          "anchor": "kantara-uma"
        },
        {
          "name": "arXiv — From Resource Control to Digital Trust with User-Managed Access",
          "jurisdiction": "International",
          "source": "https://arxiv.org/pdf/2411.05622",
          "tier": "evidence",
          "caveat": "preprint"
        }
      ],
      "assurance": "An agency needs a user to be able to express standing, conditional rules in advance that it can evaluate when an agent later requests access, granting or refusing without the user present.",
      "access": "Standing policies shift the whole burden to setup. Conditional rules are a reasoning task, and a user who sets them wrong grants more access than they meant, or blocks access they intended, usually without ever seeing the mistake. This falls hardest on users with no prior exposure to conditional or boolean logic, who have the least intuition for how a rule they wrote will be evaluated in their absence. The error often surfaces months later, when the agent acts or fails to act.",
      "openings": [
        "Provide government templates for the common cases, so 'I'm authorizing a tax professional' arrives as a pre-built, plain-language policy set.",
        "Hold customization out for those who want it, rather than requiring it of everyone.",
        "Add a readback step that tells the user, in words, what their policy will and won't allow before it takes effect."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "AccessPolicyConsole",
            "annotation": "Conditional access rules, such as tax preparation only and only in business hours, are offered as editable templates rather than left as raw policy to author."
          }
        ]
      },
      "whereThingsGoWrong": "Without server-side policy limits, an agent can expand its reach into unrelated records during an automated run. Pre-set, conditional policies evaluated server-side mean it only ever gets the narrow access the user defined. A request timed to land a minute inside a 'business hours only' window satisfies that condition on paper while doing exactly what the condition was meant to prevent.",
      "framing": "Letting a user write the standing rules for their agent in advance (what it may\ndo, when, and for what purpose) so the service can grant or refuse access later\nwithout the user present. A request outside the rules is refused by the service\nitself, whatever the agent claims the user wanted.\n",
      "challenge": "A user often will not be present when their agent needs to act: a tax agent files months\nafter being authorized, an assistant checks a payment status overnight. Conventional\naccess control assumes someone is there to grant or refuse access in the moment, and\nagents break that assumption at scale.\n\nWhatever the user sets only protects them if they can express it in terms they\nunderstand; a policy console that speaks in raw permission grants moves the risk\nfrom the moment of access to the moment of setup, where errors are harder to notice and\nlast longer.\n",
      "precedentsNote": "**[UMA 2.0](#s-kantara-uma) (User-Managed Access).** The OAuth-based\nprotocol separates the resource owner from the requesting party, so a\nperson can grant access to software that someone else is operating. The\nowner sets sharing policies at a central authorization server, decisions\ncan be made asynchronously with the owner absent, and a policy can carry\nconditions on time and purpose. Delegation is expressed as policy the owner\nholds, and not as a token issued at the moment of asking.\n",
      "transferability": "UMA's model of asynchronous, policy-based access delegation is highly relevant for AI\nagents. The user sets policies in advance (\"my tax agent can view my returns but not\namend them; my AI assistant can check my Centrelink payment status but not change my bank\ndetails\"). The agent requests access, the authorization server evaluates the request against\nthe user's policies, and grants or denies access without the user needing to be\npresent.\n\nLimitations: UMA has seen limited adoption compared to standard OAuth, partly due to its\ncomplexity. Government services would need to invest in the policy management UX, helping\nusers set meaningful policies without overwhelming them.\n"
    },
    {
      "id": "2.10",
      "title": "Healthcare delegation",
      "territory": 2,
      "slug": "healthcare-delegation-models",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "emerging",
          "note": "For capping a delegate with explicit excluded actions and fallbacks, as electronic advance directives do."
        },
        {
          "level": "frontier",
          "note": "As applied to an agent authorized to take high-stakes, irreversible actions."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "CaringInfo — Digital and Video Advance Directives",
          "jurisdiction": "US",
          "source": "https://www.caringinfo.org/planning/advance-directives/digital-video-advance-directives/",
          "tier": "evidence",
          "anchor": "caringinfo"
        },
        {
          "name": "CRISP Health — Advance Directives (Maryland HIE)",
          "jurisdiction": "US",
          "source": "https://www.crisphealth.org/advance-directives/",
          "tier": "primary",
          "anchor": "crisp-hie"
        }
      ],
      "assurance": "When a delegate can take irreversible, high-stakes actions, an agency needs confidence that the delegate cannot exceed the explicit limits the user set, including actions placed wholly out of reach. The clinical or institutional system reading the delegation credential must enforce those excluded actions at the point of action.",
      "access": "People who are ill, aging, or cognitively impaired are the most likely to need a delegate for high-stakes decisions. They are also the least able to complete a complex setup. A person who gives up mid-flow is left with no protection at all.",
      "openings": [
        "Use simplified language throughout, and offer video recording as an alternative to written text.",
        "Let a trusted person assist in setting both the delegation and its excluded actions, and record the assist itself so help doesn't shade into substitution.",
        "Let a user set limits on a good day that hold on a bad one, since capacity fluctuates."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "ProtectedDelegation",
            "annotation": "Decisions the user placed off-limits are enforced wherever the delegation is read, so the delegate cannot take them at any point."
          }
        ]
      },
      "whereThingsGoWrong": "The failure to prevent is an automated agent overstepping into irreversible decisions the user never authorized. Explicit excluded-action lists and hierarchical fallbacks cap what any delegate can do at exactly those points. A related failure sits with the trusted person who helps set the delegation up: assistance can shade into the helper choosing the excluded actions for the person, so the resulting delegation reads as freely given when it was substituted.",
      "framing": "Delegation for the highest-stakes government decisions, the kind that can't be\nundone once acted on, borrowed from healthcare proxies and advance directives.\nServices making irreversible decisions get a delegation model medicine has\nalready tested at those stakes.\n",
      "challenge": "As users delegate to agents for consequential government decisions, an agency must let a\nuser grant high-stakes, irreversible authority while keeping hard limits on what the\ndelegate can do and a fallback when it should not act.\n\nThe difficulty is enforcing those limits and fallbacks reliably at the most extreme end of\nthe delegation risk spectrum. Healthcare proxies and advance directives, built for exactly\nthat end, are the closest precedent.\n",
      "precedentsNote": "**[Electronic advance directives and healthcare proxies](#s-caringinfo)\n(US).** Several US states recognize electronic advance directives, and a\nhealthcare proxy names a specific individual as agent with authority to\nmake healthcare decisions; video directives supplement or replace paper\ndocuments in some jurisdictions. The instrument names a human delegate for\na class of decisions, in advance of the moment the authority is used.\n\n**[CRISP Health advance care plans](#s-crisp-hie) (Maryland).** The state\nHealth Information Exchange has built infrastructure to consume advance\ncare plan documents and display them inside existing electronic health\nrecord systems. A standing delegation is retrievable at the point of the\ndecision, in the clinician's own workflow, rather than held as a document\nthe patient must produce.\n",
      "transferability": "Healthcare delegation patterns are relevant to agent delegation for high-stakes government\ndecisions (benefits applications affecting housing, income, medical treatment access).\nTransferable elements: hierarchical delegation with fallbacks (primary agent, secondary\nagent, with explicit instructions for when delegation should be activated and when overridden);\nscope limitations (even within the delegation, certain decisions may be excluded, as in \"the\nagent may not consent to...\"); and integration with existing institutional workflows (the\ndelegation credential must be consumable by the systems that need to act on it, not held only\nby the delegate).\n\nGap: healthcare proxies are activated by incapacity, a trigger condition. Agent delegation in\ngovernment services is activated by choice (\"I want my agent to handle this\"), not by inability.\nThe trigger model is different, but the safeguard model (scope limitations, excluded actions,\noverride mechanisms) transfers directly.\n"
    },
    {
      "id": "2.11",
      "title": "Managed agent identity",
      "territory": 2,
      "slug": "agent-identity-protocol-and-emerging-frameworks",
      "maturity": "frontier",
      "maturityNote": "Frontier for an identity layer that lets an agency prove an agent's chain of authority and halt it; no identity protocol designed for natural persons supplies this, and the response is undesigned.",
      "status": "published",
      "dependsOn": [
        "2.6"
      ],
      "seeAlso": [],
      "precedents": [
        {
          "name": "Agent Identity Protocol (AIP) — arXiv 2603.24775",
          "jurisdiction": "International",
          "year": 2026,
          "source": "https://arxiv.org/abs/2603.24775",
          "tier": "evidence",
          "caveat": "preprint",
          "anchor": "aip"
        },
        {
          "name": "AIP — IETF individual Internet-Draft (draft-prakash-aip)",
          "jurisdiction": "IETF",
          "source": "https://www.ietf.org/archive/id/draft-prakash-aip-00.html",
          "tier": "evidence",
          "caveat": "unadopted-draft"
        },
        {
          "name": "AI Identity: Standards, Gaps, and... — arXiv 2604.23280",
          "jurisdiction": "International",
          "year": 2026,
          "source": "https://arxiv.org/pdf/2604.23280",
          "tier": "evidence",
          "caveat": "preprint",
          "anchor": "ai-identity-survey"
        },
        {
          "name": "Verifiable Credentials for AI Agents — arXiv 2511.02841",
          "jurisdiction": "International",
          "source": "https://arxiv.org/html/2511.02841v1",
          "tier": "evidence",
          "caveat": "preprint",
          "anchor": "vc-for-agents"
        },
        {
          "name": "Binding Agent ID — arXiv 2512.17538",
          "jurisdiction": "International",
          "source": "https://arxiv.org/pdf/2512.17538",
          "tier": "evidence",
          "caveat": "preprint"
        },
        {
          "name": "Linux Foundation — formation of the Agentic AI Foundation (MCP, goose, AGENTS.md)",
          "jurisdiction": "International",
          "year": 2025,
          "source": "https://www.linuxfoundation.org/press/linux-foundation-announces-the-formation-of-the-agentic-ai-foundation",
          "tier": "primary",
          "anchor": "aaif"
        },
        {
          "name": "Model Context Protocol — documentation",
          "jurisdiction": "International",
          "source": "https://modelcontextprotocol.io/",
          "tier": "primary"
        },
        {
          "name": "Agent2Agent (A2A) protocol — documentation (Linux Foundation)",
          "jurisdiction": "International",
          "source": "https://a2a-protocol.org/latest/",
          "tier": "primary"
        },
        {
          "name": "NIST NCCoE — Software and AI Agent Identity and Authorization (concept paper)",
          "jurisdiction": "US",
          "year": 2026,
          "source": "https://www.nccoe.nist.gov/projects/software-and-ai-agent-identity-and-authorization",
          "tier": "primary",
          "anchor": "nist-nccoe"
        },
        {
          "name": "Estonia — government commitment to AI-agent digital identities ('AI ID codes')",
          "jurisdiction": "Estonia",
          "year": 2026,
          "source": "https://www.valitsus.ee/en/news/prime-minister-michal-estonia-become-first-country-create-digital-identities-ai-agents",
          "tier": "primary",
          "anchor": "estonia-ai-id"
        },
        {
          "name": "Careful adoption of agentic AI services — Five Eyes joint cybersecurity guidance (ASD ACSC, CISA, NSA, CCCS, NCSC-NZ, NCSC-UK)",
          "jurisdiction": "AU/US/CA/NZ/UK",
          "year": 2026,
          "source": "https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/careful-adoption-of-agentic-ai-services",
          "note": "A joint Five Eyes publication recommending each agent be constructed as a distinct principal with a cryptographically anchored identity, held in a trusted registry periodically reconciled against the live set of agents, and access denied to any agent absent from it. Best-practice guidance, not a ratified standard.",
          "tier": "primary"
        },
        {
          "name": "OpenID Foundation — Identity Management for Agentic AI (AIIM whitepaper)",
          "jurisdiction": "International",
          "year": 2025,
          "source": "https://openid.net/wp-content/uploads/2025/10/Identity-Management-for-Agentic-AI.pdf",
          "tier": "primary"
        },
        {
          "name": "IETF OAuth — Identity and Authorization Chaining Across Domains (adopted; with the RFC Editor)",
          "jurisdiction": "IETF",
          "year": 2026,
          "source": "https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-chaining/",
          "tier": "primary"
        },
        {
          "name": "AGNTCY — Agent Badge identity specification (Linux Foundation)",
          "jurisdiction": "International (Linux Foundation)",
          "year": 2026,
          "source": "https://docs.agntcy.org/identity/identity/",
          "tier": "primary"
        }
      ],
      "assurance": "A relying agency needs to confirm what an agent is, who authorized it, and what it may do, without contacting the user. It also needs to be able to prove that chain of authority and halt the agent when necessary. One party must issue and maintain that chain of authority: the agent operator, or an accredited issuer of the agent's identity credential.",
      "access": "Cryptographic identity is invisible by design, so the exclusion risk lives entirely in the management surface. A user who can't parse tokens, chains, or policy languages, which is nearly every user, is left unable to tell what their agent may do, what it has done, or how to stop it. This is felt most when something goes wrong and the evidence sits in a format only specialists read.",
      "openings": [
        "Hold the management interface to three plain-language answers: what this agent can do, what it has done, and how to stop it.",
        "Make the stop control the most prominent of the three, operable by keyboard and assistive technology, and effective without the user understanding anything beneath it."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "AgentControlPanel",
            "annotation": "A single panel answers what this agent can do, what it has already done, and how to stop it."
          }
        ]
      },
      "whereThingsGoWrong": "The failure mode is a cloned or forged agent identity credential presented at the point of a request. Absent a provenance layer to check it against, a relying agency has no signal that distinguishes the look-alike from the agent the user authorized until after it has acted.",
      "framing": "An identity layer for the agent itself, so a relying agency can prove who\nauthorized it, check what it may do, and stop it. An agency can confirm an\nagent's authority, or end it, without asking the user to understand the protocol\nunderneath.\n",
      "challenge": "When a user delegates to an AI agent that then deals with a government service, the agent\nitself has no identity the agency can check independently of the user who deployed it. No\nidentity protocol answers this: OAuth, GNAP, and UMA are all built for natural persons and\nassume a human is operating the client.\n\nWhat is missing is an identity layer for agents as delegates: verifiable provenance a\nrelying agency can check at the moment of the request, and revocation it can act on\nbefore the next one.\n",
      "precedentsNote": "**[Agent Identity Protocol](#s-aip) (AIP).** The proposal introduces\nInvocation-Bound Capability Tokens combining public-key verifiable\ndelegation, holder-side attenuation under which each intermediary can only\nnarrow permissions, chained policy in Datalog, and provenance-oriented\ncompletion records. It defines transport bindings for MCP, A2A, and HTTP.\nIt is the most complete published attempt at a delegation chain an agent\ncan carry.\n\n**The [AI Identity survey](#s-ai-identity-survey), and Verifiable Credentials for AI Agents.** A survey paper maps\ncurrent agent identity standards and the gaps between them, and a companion\nproposal would equip agents with [Decentralized Identifiers and Verifiable\nCredentials](#s-vc-for-agents), naming 'limited support for delegation of\nauthority, insufficient contextualisation of trust decisions, and reliance\non static trust models that fail to adapt dynamically'. The literature\nconverges on delegation as the missing piece, and none of it has been\nadopted.\n\n**[Agent interoperability protocols](#s-aaif) (MCP and A2A).** Both major\ninteroperability protocols now sit under neutral governance, MCP and A2A\nhaving been contributed to the Linux Foundation's Agentic AI Foundation.\nNeither solves agent identity or delegation natively. Both are transport\nlayers an agent identity protocol has to bind to.\n\n**[NIST NCCoE concept paper](#s-nist-nccoe).** A US national standards body\nrecords that no existing identity protocol handles the agent-as-delegate\ncase, and names the standards any agent-identity protocol would build on:\nOAuth and OIDC, SPIFFE and SPIRE, SCIM, NGAC, and NIST SP 800-207 and\n800-63-4. It is a concept paper and request for input, cited for the shape\nof the gap and the standards it names.\n\n**[Estonia's AI-ID commitment](#s-estonia-ai-id).** Estonia has committed\nto a native agent-identity layer that lets an agent act for a person or\ncompany within scope-limited, verifiable, and auditable powers. It is a\ngovernment statement of intent, without legislation or a deployment behind\nit.\n",
      "transferability": "The precedents cited above are at the research and early-specification stage.\nFor government services,\nthe question that matters is less which protocol to adopt than what properties the delegation\ninfrastructure must have: verifiable provenance (any relying party can verify the delegation\nchain from user to agent without contacting the user); attenuation (delegation can be\nnarrowed at each hop but never widened); revocability (revocation must propagate in\nnear-real-time); audit (a complete, tamper-evident record of actions taken under the\ndelegation); and interoperability (works across multiple government services, not locked to a\nsingle system).\n\nGovernment services should track these standards but avoid premature commitment. The prudent\napproach: define the requirements (the five properties above), participate in standards\ndevelopment, and build to an abstraction layer that can adopt whichever protocol matures\nfirst.\n"
    },
    {
      "id": "2.12",
      "title": "Duress-resistant delegation",
      "territory": 2,
      "slug": "duress-resistant-delegation",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "emerging",
          "note": "For reactive financial controls, where a firm can place a temporary hold on a suspected-exploitation transaction and notify a pre-named contact, running in production under securities rules."
        },
        {
          "level": "frontier",
          "note": "For the delegation flow itself, where no digital identity or authorization system tests whether the grant of authority to an agent is freely given."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [
        "2.8"
      ],
      "precedents": [
        {
          "name": "ALRC Report 131 — Elder Abuse: Enduring appointments, Safeguards",
          "jurisdiction": "AU",
          "year": 2017,
          "source": "https://www.alrc.gov.au/publication/elder-abuse-a-national-legal-response-alrc-report-131/5-enduring-appointments/safeguards-8/",
          "tier": "primary",
          "anchor": "alrc-131"
        },
        {
          "name": "FINRA Rule 2165 — Financial Exploitation of Specified Adults",
          "jurisdiction": "US",
          "year": 2022,
          "source": "https://www.finra.org/rules-guidance/rulebooks/finra-rules/2165",
          "tier": "primary",
          "anchor": "finra-2165"
        },
        {
          "name": "CFPB — Trusted contacts guidance for financial institutions",
          "jurisdiction": "US",
          "year": 2021,
          "source": "https://files.consumerfinance.gov/f/documents/cfpb_trusted-contacts-fis_2021-11.pdf",
          "tier": "primary"
        },
        {
          "name": "eSafety Commissioner — From smart cars to tracking devices: technology's increasing role in coercive control and family and domestic violence",
          "jurisdiction": "AU",
          "year": 2023,
          "source": "https://www.esafety.gov.au/newsroom/blogs/from-smart-cars-to-tracking-devices-technologys-increasing-role-in-coercive-control-and-family-and-domestic-violence",
          "tier": "primary",
          "anchor": "esafety-coercive"
        },
        {
          "name": "Digital ID (Accreditation) Rules 2024 — enumerated control domains",
          "jurisdiction": "AU",
          "year": 2024,
          "source": "https://www.legislation.gov.au/F2024L01438/latest/text",
          "tier": "primary",
          "anchor": "digital-id-rules"
        }
      ],
      "assurance": "For a high-consequence delegation, an agency needs confidence that the grant of authority to an agent is freely given, not obtained by coercion, to a degree proportionate to the stakes. Client-initiation from the user's own authenticated session establishes that a real person authorized the agent, but not that they did so freely. The confidence government needs sits above the declarative level, met structurally rather than by self-report alone, and the agency, or the caseworker or intermediary it designates, must hold that structural confirmation.",
      "access": "The cohorts a duress safeguard protects are the same cohorts a clumsy one excludes, so the check must not become the barrier. A person under guardianship or with fluctuating capacity needs the delegation to be makeable by their guardian, in a form the agency recognizes, since they may not be able to pass a free-will test alone. Requiring an independent witness excludes an isolated person who has no one to serve as one. Inserting confirmation ceremony at a moment of crisis deters the person who most needs the help, leaving them denied or redirected to no service at all.",
      "openings": [
        "Make the safeguard proportionate to stakes: no ceremony for low-consequence grants.",
        "Offer assisted confirmation through a trusted intermediary or a caseworker, rather than a private witness the user may not have.",
        "Run the duress-revocation path as a service the user can reach without the abuser present.",
        "Make the confirmation and revocation surfaces operable by keyboard and assistive technology, with their state and its consequence conveyed in plain language."
      ],
      "surface": {
        "instances": [
          {
            "domain": "service",
            "kind": "interactive",
            "component": "DuressSafeguard",
            "annotation": "The stakes of the delegated action set the ceremony, and the user keeps a revocation path they can take without the other party present."
          }
        ]
      },
      "whereThingsGoWrong": "The failure mode is a delegation that is authentic at every technical layer and still not freely given. An elder pressured by a trusted relative, or a person under coercive control, is made to nominate an agent from their own verified session. The nominated agent then uses that authority to drain a benefit, a retirement balance, or a payment. The harm lands on the person least able to absorb it and least able to escape the one who arranged it.\n\nClient-initiation cannot see this, because the coercion sits behind the session. What catches it is a confirmation step run with the user alone, a cooling-off window in which a notified trusted contact can object, and a revocation path the user can reach without contact with the other party.",
      "framing": "Testing that a user's grant of authority to an agent is freely given, not\ncoerced: porting the anti-duress safeguards of fiduciary regimes into the\ndigital delegation flow, proportionate to the stakes of the delegated action.\n",
      "challenge": "As users delegate more, and more consequential, authority to agents, a\ndelegation that is authentic at the session level but obtained under coercion\nbecomes a growing harm. Elder financial abuse and intimate-partner coercive\ncontrol both work by making an authentic account-holder act against their own\ninterest, and the standard safeguard (client-initiated nomination through the\nuser's own authenticated session) is defeated exactly here, because the\nsession itself is coerced. For policymakers the difficulty is that the agency\ncannot tell a free grant from a coerced one at the point it is made, and the\nauthority, once granted, keeps acting out of the agency's sight.\n",
      "precedentsNote": "**Australian enduring powers of attorney ([ALRC Report 131](#s-alrc-131)).**\nAustralian regimes require two independent witnesses, none related to the\nprincipal or the attorney and none a paid carer, who certify that the\nprincipal 'appeared to freely and voluntarily sign' in their presence. Good\npractice adds speaking to the principal without the appointee present. The\nconfirmation is made by someone who does not benefit, in a setting where\nthe person granting authority can speak unobserved.\n\n**[FINRA Rule 2165](#s-finra-2165) temporary holds.** A firm that\nreasonably believes financial exploitation 'has occurred, is occurring, has\nbeen attempted, or will be attempted' may place a temporary hold on a\ndisbursement for 15 business days, extendable to 25 and then 55, and notify\nall authorized parties and a pre-named trusted contact while excluding any\nparty suspected of the exploitation. Exploitation expressly covers control\n'through deception, intimidation or undue influence'. The rule pauses the\ntransaction and leaves the authorization standing.\n\n**[eSafety Commissioner guidance on coercive\ncontrol](#s-esafety-coercive).** Addressing technology's growing role in\ncoercive control and family and domestic violence, the Commissioner calls\nfor emergency lockouts and safe transfers: a documented way to revoke all\naccess and transfer ownership during separation without contact with the\nother party. A national regulator has stated the safe-exit requirement as a\ndesign obligation.\n",
      "transferability": "The analog anti-coercion mechanisms transfer as four proportionate steps, keyed to\nthe consequence of the delegated action rather than applied uniformly.\n\n1. **Independent confirmation** — for a high-consequence grant, a step conducted\n   with the user alone, by a caseworker or recognized intermediary rather than a\n   private witness the isolated user may not have.\n2. **A cooling-off window** — the authority does not take full effect immediately,\n   and a notified trusted contact can object within it, mirroring the objection\n   period fiduciary regimes impose before registration.\n3. **A pre-named trusted contact** — collected at enrollment, contacted when a\n   delegated action trips a reasonable-belief threshold, excluding any party\n   suspected of the coercion.\n4. **A duress-revocation path** — a route to revoke all of an agent's authority\n   that the user can reach without the other party present.\n\nCritical gap: every mechanism above is analog or reactive, and none has been built\ninto a digital delegation flow. The unresolved design problems are the\nreasonable-belief trigger for an automated grant, the false-positive cost of adding\nfriction to a delegation that is in fact free, and doing all of this without\nexcluding the very cohorts the safeguard exists to protect: those who are\nisolated, under guardianship, or in crisis. This is why the delegation-flow application is frontier\nwhile the reactive financial controls it borrows from are not.\n"
    },
    {
      "id": "2.13",
      "title": "Containing a compromised agent",
      "territory": 2,
      "slug": "compromised-agent-containment",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "emerging",
          "note": "For the revocation layer, where token revocation, a continuous-evaluation profile, and a privacy-preserving credential status list are ratified standards, deployable today and not yet routine practice for agent authority."
        },
        {
          "level": "frontier",
          "note": "For verifying that the acting agent is the one the user authorized, where interoperable agent identity is proposed but not yet built."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [
        "2.6",
        "2.7",
        "2.11"
      ],
      "precedents": [
        {
          "name": "RFC 7009 — OAuth 2.0 Token Revocation",
          "jurisdiction": "IETF",
          "year": 2013,
          "source": "https://www.rfc-editor.org/rfc/rfc7009.html",
          "tier": "primary",
          "anchor": "rfc-7009"
        },
        {
          "name": "OpenID CAEP 1.0 — Continuous Access Evaluation Profile",
          "jurisdiction": "OpenID",
          "source": "https://openid.net/specs/openid-caep-1_0-final.html",
          "tier": "primary",
          "anchor": "openid-caep"
        },
        {
          "name": "W3C Bitstring Status List v1.0 (credential revocation)",
          "jurisdiction": "W3C",
          "year": 2025,
          "source": "https://www.w3.org/TR/vc-bitstring-status-list/",
          "tier": "primary",
          "anchor": "bitstring-status-list"
        },
        {
          "name": "OWASP LLM06:2025 — Excessive Agency",
          "jurisdiction": "International",
          "year": 2025,
          "source": "https://genai.owasp.org/llmrisk/llm062025-excessive-agency/",
          "tier": "primary",
          "anchor": "owasp-llm06"
        },
        {
          "name": "MITRE ATLAS — adversary techniques for AI systems",
          "jurisdiction": "International",
          "year": 2026,
          "source": "https://atlas.mitre.org/",
          "tier": "evidence",
          "anchor": "mitre-atlas"
        },
        {
          "name": "IETF draft-klrc-aiagent-auth — AI agent authentication and authorization",
          "jurisdiction": "IETF",
          "year": 2026,
          "source": "https://datatracker.ietf.org/doc/draft-klrc-aiagent-auth/",
          "tier": "evidence",
          "caveat": "unadopted-draft",
          "anchor": "aiagent-auth-draft"
        },
        {
          "name": "Careful adoption of agentic AI services — Five Eyes joint cybersecurity guidance (ASD ACSC, CISA, NSA, CCCS, NCSC-NZ, NCSC-UK)",
          "jurisdiction": "AU/US/CA/NZ/UK",
          "year": 2026,
          "source": "https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/careful-adoption-of-agentic-ai-services",
          "tier": "primary",
          "anchor": "five-eyes-agentic"
        }
      ],
      "assurance": "An agency needs two things when an agent holds standing authority to act for a user: confidence that the agent presenting that authority is the one the user authorized and not a look-alike, and the ability to withdraw a compromised agent's authority in the window that matters, not whenever the credential would have lapsed on its own. The first is a binding between the delegation and a verifiable agent identity; the second is revocation that takes effect within that window. The identity issuer must hold that binding, and the authorization server or agency must operate the propagating revocation.",
      "access": "Containment that strands the user is its own exclusion. Someone who depends on an agent because they cannot operate a service unaided is denied the outcome if a suspected compromise freezes their authority without notice or a route back. A person already wary of the system reads that lockout as the system turning on them.",
      "openings": [
        "Pair containment with an assisted re-authorization route the user can complete through a supported channel.",
        "Keep a first-class non-agent fallback, so a contained agent never means no service.",
        "Degrade gracefully: treat a suspected compromise as grounds for stepped-up confirmation, and keep the underlying entitlement available while confirming.",
        "Make the containment notice and the re-authorization route operable by keyboard and assistive technology, stating what is paused and the way back in plain language."
      ],
      "surface": {
        "instances": [
          {
            "domain": "service",
            "kind": "interactive",
            "component": "AgentContainment",
            "annotation": "Revocation reaches every relying service within a second, while the user sees a plain-language pause with a route back rather than a silent lockout."
          }
        ]
      },
      "whereThingsGoWrong": "The failure mode is a standing delegation that keeps acting after the agent behind it has been taken over, impersonated, or tricked into exceeding its scope. An agent holding authority across several services can be driven to act on all of them before any single action looks wrong, because each action is locally valid while the agent is globally compromised. The user often discovers the harm only once it has compounded. A spoofed agent fails at presentation once its authority is bound to a verifiable agent identity, and revocation that propagates in near real time pulls a compromised agent's authority before the next action rather than after the credential eventually expires.\n\nContainment can itself be turned into the attack: a forged compromise signal, or an institution's own over-caution, cuts a person off from the authority they depend on. That is why a containment event carries a plain-language notice, an assisted route back, and a record the user can contest.",
      "framing": "When a user's delegated agent is hijacked, spoofed, or tricked into acting\nbeyond its scope, containing it: cutting off the agent's standing authority\nbefore the harm compounds.\n",
      "challenge": "As agents hold standing authority and act over time and across services, a\ncompromised or spoofed agent becomes able to act at a distance. It acts without\nnotice, at machine speed. The takeover of an internet-facing agent, the impersonation of a\ntrusted one, and an over-privileged agent tricked into exceeding its scope are all\nrecognized attack classes, and an agent that holds a user's authority is a\nstanding target for them. A compromise that happens once can keep acting for as\nlong as the credential remains valid, because nothing at the point of action\ntells the service it is no longer dealing with the agent the user authorized.\n",
      "precedentsNote": "**OAuth token revocation ([RFC 7009](#s-rfc-7009)), [OpenID\nCAEP](#s-openid-caep), and [W3C Bitstring Status\nList](#s-bitstring-status-list).** RFC 7009 lets a client tell the\nauthorization server that a credential is no longer valid, and on revoking\na refresh token the server should invalidate the tokens issued under the\nsame grant. That does not expire an already-issued short-lived token at the\nservices relying on it, so a continuous-evaluation profile pushes the\nrevocation event to those services, and a status list marks a verifiable\ncredential revoked or suspended. All three are ratified standards.\n\n**[OWASP LLM06 Excessive Agency](#s-owasp-llm06), and [MITRE\nATLAS](#s-mitre-atlas).** OWASP describes the damage an over-privileged\nagent can do when its output is manipulated, and prescribes least\nprivilege, execution in the individual user's context, and authorization\nenforced by the downstream system instead of the agent. MITRE ATLAS\ncatalogs credential abuse against AI systems among its documented adversary\ntechniques. The controls limit how far a compromised agent reaches before\nit is revoked, and the technique catalog is drawn from observed practice.\n\n**[Five Eyes joint guidance on agentic AI\nservices](#s-five-eyes-agentic).** The guidance names the confused-deputy\nrisk, in which a trusted, over-privileged agent is misused to perform\nunauthorized actions, and recommends trigger-action protocols that restrict\nan agent's permissions when unexpected behavior emerges, a prohibition on\nagents altering their own privileges, and trust scoring that drops on\nanomalous behavior. Six national cyber authorities describe the containment\ncontrols, and the risks they set out are illustrative scenarios rather than\ndocumented incidents.\n",
      "transferability": "Containment separates cleanly into a layer that is deployable and a layer that is\nnot. Deployable now: bind an agent's authority to a credential that can be revoked,\nand wire revocation to propagate to relying services in near real time, so pulling a\ncompromised agent's authority is a matter of seconds rather than the life of a\ntoken; hold the agent to least privilege and downstream-enforced authorization so a\nsingle compromise cannot reach every service at once. Not yet deployable: a verifiable\nbinding that lets a relying service confirm the acting agent is the one the user\nauthorized, which depends on agent-identity standards still in draft.\n\nNo documented incident yet shows a government-service user agent being hijacked\nto transact; the observed cases sit in enterprise and developer-tool contexts. The\nhonest framing is that the threat is projected from adjacent domains rather than\nseen in this one, that the containment primitives are real and worth building ahead\nof the incident, and that the identity layer that would complete them is the part\nthe field has not yet solved.\n"
    },
    {
      "id": "2.14",
      "title": "User-set machine-readable terms",
      "territory": 2,
      "slug": "user-set-machine-readable-terms",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "emerging",
          "note": "For the instrument itself, where IEEE 7012-2025 is a published international standard, free to read, with a named lineage and a candidate roster keeper."
        },
        {
          "level": "frontier",
          "note": "As a government-service practice: no deployment reads, evaluates, or agrees to a user's proffered terms, and what happens when a service declines a term is undesigned."
        }
      ],
      "status": "reviewed",
      "dependsOn": [],
      "seeAlso": [
        "2.4",
        "2.1"
      ],
      "precedents": [
        {
          "name": "IEEE 7012-2025 — Machine Readable Personal Privacy Terms",
          "jurisdiction": "International (IEEE)",
          "year": 2025,
          "source": "https://standards.ieee.org/ieee/7012/7192/",
          "tier": "primary",
          "anchor": "ieee-7012"
        },
        {
          "name": "Customer Commons — MyTerms (roster-keeper candidacy)",
          "jurisdiction": "US",
          "year": 2025,
          "source": "https://doc.searls.com/myterms/",
          "tier": "evidence",
          "anchor": "customer-commons"
        },
        {
          "name": "Kantara Initiative — Consent Receipt Specification",
          "jurisdiction": "International",
          "source": "https://kantarainitiative.org/download/consent-receipt-specification/",
          "tier": "primary",
          "anchor": "kantara-receipt"
        }
      ],
      "assurance": "When an interaction proceeds under user-proffered terms, both parties need confidence about the same three things: which standard-form term the person proffered, that the service agreed to it, and that each side holds a durable record of that agreement that matches the other's. The agency operating the service owes the obligation to hold its half of the record and to honor the agreed term in its downstream handling; the roster keeper (the neutral, non-business entity the standard requires) owes the obligation to keep the standard-form texts stable, so a term reference resolves to settled wording rather than to whatever either side later claims it said. The bar is proportionate: a recorded pointer to a roster term, not bespoke contract negotiation, and not a cryptographic proof where a dual-held receipt is enough.",
      "access": "The risk is that setting terms becomes a second gate. A person without an agent, without the reading level or vocabulary to weigh standard-form terms, or acting through an assisted or non-digital channel will not proffer anything, and is handled on whatever the service imposes. A person with low trust in the system is a particular concern, since they are the most likely to want their own terms and the least likely to have the tooling to express them.",
      "openings": [
        "Hold the no-terms default to the same outcome, on terms no worse than today's baseline.",
        "Let an assisted channel record a proffered term on a person's behalf.",
        "Give each roster term a plain-language rendering a person can read before choosing it.",
        "Treat any terms-choosing control as a novel agent surface: operable by keyboard and assistive technology, its state and consequence conveyed in plain language."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "ProfferedTerms",
            "annotation": "A person chooses their own standard-form term before the interaction proceeds, and both sides keep a matching record of what was agreed."
          }
        ]
      },
      "whereThingsGoWrong": "Without the pattern, the failure is symmetrical and leaves no trace: users' agents click-accept the service's terms at machine speed, the service ignores anything the user's side proffers, and both sides hold records of an agreement that never meaningfully happened: acceptance no one read, with better logging. The adversarial readings run through each party. A service can perform agreement while mapping every proffered term onto its existing policy, so the terms change nothing (the institution gaming its own commitment); a captured or partial roster keeper can tilt the standard forms toward one side while wearing neutrality; and a person's own agent can proffer terms the person never chose, which is why the record both sides keep has to show the term as the person selected it, not as the agent negotiated it. Mis-implemented, the pattern becomes a new gate: a service that refuses interactions on any terms mismatch has turned an optional instrument of user power into a reason to turn people away.",
      "framing": "Letting a person state their own terms for how their data and interactions are\nhandled, in a machine-readable form chosen from a neutral roster, so that a\nservice (and the agents on both sides) can read the terms, agree to them, and\nkeep a shared record of the agreement.\n",
      "challenge": "As agent use grows, one-way consent stops being stable in either direction.\nToday the service proffers a standard-form contract and the person clicks\naccept, because there is nothing else to do. An agent that mechanically accepts\nwhatever a service proffers turns that click-through into acceptance no one\nread, executed at machine speed. And an agent that presents its principal's own\nterms makes individual-side terms feasible for the first time, because a\nmachine can proffer, read, and record them at no marginal cost. Government\nservices will therefore start receiving interactions that arrive with a user's\nproffered terms. An agency with no way to read them will re-impose its own\ndefaults, leaving no record that terms were ever proffered. The record of what\nwas agreed then stays one-sided at exactly the moment agreement records start\nto matter for accountability.\n",
      "precedentsNote": "**[IEEE 7012-2025](#s-ieee-7012), machine-readable personal privacy\nterms.** The standard makes the individual the first party: terms are\nchosen from a roster of standard-form agreements kept by an independent,\nneutral non-business entity on the Creative Commons model, machines on both\nsides read and agree, and the agreement is recorded and kept by both. It\ninverts the click-through, and it is published rather than proposed.\n\n**[Customer Commons](#s-customer-commons) as roster keeper.** The standard names no keeper\nof the roster, and Customer Commons, whose lineage chaired the working\ngroup, positions itself as one under the MyTerms banner. The candidacy rests on Customer Commons' own publications, which makes it\nreal as a claim and ungoverned as an institution. Which roster a government service recognizes is a policy\ndecision the standard leaves open.\n\n**The [Kantara consent receipt](#s-kantara-receipt), with the direction reversed.** A dual-held agreement record reverses the direction of a consent receipt,\nand the receipt structure is settled practice. The record half of user-set terms has\ninfrastructure already, extended from recording the service's terms to\nrecording the person's.\n",
      "transferability": "The standard is published and the record-keeping half rides on settled\nconsent-receipt practice, so the mechanics travel. What has not traveled anywhere\nyet is the service side, and that is most of the pattern: no government\ndeployment reads or agrees to proffered terms, no policy names which roster a\nservice recognizes, and nothing settles what a service does when it declines a\nterm: refuse the interaction, negotiate, or fall back to its own defaults with\nthe refusal recorded. The roster keeper's neutrality is asserted, not governed.\nAdoption is months old, so the honest posture is that this pattern names a\ndirection the instrument now makes possible; no agency yet operates it.\n"
    },
    {
      "id": "3.1",
      "title": "Review before commit checkpoint",
      "territory": 3,
      "slug": "draft-review-before-submit-checkpoint",
      "maturity": "emerging",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For human-in-the-loop review screens, a settled pattern across government and commercial services."
        },
        {
          "level": "emerging",
          "note": "For agent-specific review that shows data provenance for each answer, which is still taking shape."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "GOV.UK check your answers",
          "jurisdiction": "UK",
          "source": "https://design-system.service.gov.uk/patterns/check-answers/",
          "tier": "primary",
          "anchor": "govuk-check"
        },
        {
          "name": "Scottish Government Design System — Check answers",
          "jurisdiction": "UK",
          "source": "https://designsystem.gov.scot/patterns/check-answers",
          "tier": "primary",
          "anchor": "scotgov-check"
        },
        {
          "name": "Intuit Content Design — Review before [action]",
          "source": "https://contentdesign.intuit.com/ai/ux-patterns/",
          "tier": "evidence",
          "anchor": "intuit-review"
        },
        {
          "name": "myTax Australia pre-lodgment review",
          "jurisdiction": "AU",
          "source": "https://www.ato.gov.au/individuals-and-families/your-tax-return/how-to-lodge-your-tax-return/lodge-your-tax-return-online-with-mytax",
          "tier": "primary",
          "anchor": "mytax"
        },
        {
          "name": "NHS Design System — Check answers",
          "jurisdiction": "UK",
          "source": "https://service-manual.nhs.uk/design-system/patterns/check-answers",
          "tier": "primary",
          "anchor": "nhs-check"
        },
        {
          "name": "DRCF — The Future of Agentic AI (foresight paper)",
          "jurisdiction": "UK",
          "year": 2026,
          "source": "https://www.drcf.org.uk/publications/papers/thefutureofagenticai",
          "tier": "evidence",
          "anchor": "drcf"
        }
      ],
      "assurance": "Before a consequential action becomes binding, the user must be able to confirm what the agent is about to do, on what data, and what it chose to include, to a confidence that catches an error before it becomes part of the official record. The agency operating the service must provide that checkpoint and ensure no consequential action proceeds without it.",
      "access": "The checkpoint only protects users who can use it. A review screen dense with legal or financial phrasing gets skimmed or can be misinterpreted. A struggling or time-poor reader, or someone reading the service in a second language, can mistakenly confirm incorrect information into an official record.",
      "openings": [
        "Layer the disclosure: a user summary by default, expandable detail, and the full draft on request.",
        "Label every item in plain language, with a clearly signposted change affordance beside each answer.",
        "Add no countdown that pressures the review.",
        "Let a trusted person review with the user, by phone readback or shared access, without taking over the delegation.",
        "Make the review screen reachable by keyboard, with each answer's source and change control announced to assistive technology."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "DraftReview",
            "annotation": "No consequential agent action is binding until the person has reviewed it, so the agent's work is presented for approval with each item's source named."
          }
        ]
      },
      "whereThingsGoWrong": "The failure mode is consequential notices issued with no review checkpoint, so miscalculations reach users unseen. A mandatory draft-review before any notice creates a human verification point that surfaces errors before they are sent.\n\nA checkpoint can also fail while technically present: a review screen skimmed by habit, or an agent configured to auto-confirm the draft on the user's behalf, closes the pause without a human ever reading it. The confirmation record can then be turned against the user: a checkbox ticked by reflex becomes evidence that the user reviewed what they never read, and responsibility for the agent's error settles on the person least equipped to have caught it.\n\nThe checkpoint stays a safeguard rather than a liability shield only when the service runs its own validation before the screen is shown and draws the eye to the answers it is least sure of. One confirm-all attestation is not proof of review.",
      "framing": "A mandatory pause before a consequential agent action becomes binding, so a\nmistake can be caught before it takes effect.\n",
      "challenge": "As agent submission becomes routine, the moment to review what an agent will do\n(submit a form, authorize a payment, share data, or accept a decision) before it\nbecomes binding disappears by default. Nothing in an automated flow naturally\npauses for the user unless the service designs the pause in. Without the\ncheckpoint, errors propagate into official records with no moment of human\nverification.\n",
      "precedentsNote": "**[GOV.UK 'Check your answers'](#s-govuk-check).** The Design System\nmandates a check-your-answers page immediately before the confirmation\nscreen for every transactional service, using a summary list for each group\nof answers with a change link beside each item. It is mandatory for\nservices meeting the UK Government Service Standard, and the\n[Scottish](#s-scotgov-check) and [NHS](#s-nhs-check) design systems carry\nthe same pattern. A review step before commitment is a design-system\nrequirement across three UK public-sector systems.\n\n**[Intuit's review-before-action pattern](#s-intuit-review).** Intuit's\ncontent design system documents a contextual reminder placed near\nAI-generated content: 'I drafted your email using your past campaigns and\nbrand settings. Review before sending.' The reminder names the data the\nsystem drew on, which gives the person grounds to assess what they are\napproving.\n\n**[myTax pre-lodgment review](#s-mytax) (ATO).** myTax pre-fills\ninformation from employers, banks, health funds, and share registries, then\npresents a review screen before lodgment where the person can see and amend\nwhat was pulled in. The checkpoint sits on a government transaction whose\ninputs the person did not enter.\n\n**[DRCF on agentic AI](#s-drcf).** The UK's four digital regulators jointly\nname action bundling and choice outsourcing as an emerging risk: an agent\nexecuting pull-data, accept-terms, pay, share, and confirm as a single\nstep, so the discrete decisions never surface. Four regulators have named\nthe bundling itself as the hazard.\n",
      "transferability": "Directly transferable but requires adaptation. When a human fills a form, the\ncheck-your-answers page reflects what they entered. When an agent fills a form, the review\npage must additionally surface: (a) what data the agent used, (b) what inferences or\ncalculations it made, and (c) what it chose not to include.\n\nThe Intuit pattern is the closest existing model for this agent-specific variant because it\nnames the data sources; the GOV.UK pattern supplies the structural template. The combination\nof GOV.UK's layout with Intuit's provenance labeling is the starting point.\n"
    },
    {
      "id": "3.2",
      "title": "Confirmation receipt showing what happened",
      "territory": 3,
      "slug": "confirmation-receipt-with-action-record",
      "maturity": "emerging",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For the confirmation receipt, a settled pattern across government and commercial services."
        },
        {
          "level": "emerging",
          "note": "For agent attribution on receipts, recording which agent acted and under what delegation, where agent-delegation identity protocols are proposed but not yet a ratified standard, and no receipt implementation is cited here."
        },
        {
          "level": "frontier",
          "note": "For cryptographic receipt integrity on government agent actions, which remains undesigned."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [
        "2.4"
      ],
      "precedents": [
        {
          "name": "GOV.UK confirmation pages",
          "jurisdiction": "UK",
          "source": "https://design-system.service.gov.uk/patterns/confirmation-pages/",
          "tier": "primary",
          "anchor": "govuk-confirm"
        },
        {
          "name": "ONS Design System — Confirmation page",
          "jurisdiction": "UK",
          "source": "https://service-manual.ons.gov.uk/design-system/patterns/confirmation-page",
          "tier": "primary",
          "anchor": "ons-confirm"
        },
        {
          "name": "ATO lodgment receipt (Online Services for Business)",
          "jurisdiction": "AU",
          "source": "https://www.ato.gov.au/online-services/businesses-and-organisations-online-services/lodgments-in-online-services-for-business",
          "tier": "evidence",
          "anchor": "ato-receipt"
        },
        {
          "name": "EUR-Lex — PSD2, Directive (EU) 2015/2366",
          "jurisdiction": "EU",
          "source": "https://eur-lex.europa.eu/eli/dir/2015/2366/oj/eng",
          "tier": "primary",
          "anchor": "psd2"
        },
        {
          "name": "NIST IR 8202 — Blockchain Technology Overview",
          "jurisdiction": "US",
          "year": 2018,
          "source": "https://nvlpubs.nist.gov/nistpubs/ir/2018/NIST.IR.8202.pdf",
          "tier": "primary",
          "anchor": "nist-8202"
        },
        {
          "name": "Agent Identity Protocol (AIP) preprint",
          "source": "https://arxiv.org/abs/2603.24775",
          "tier": "evidence",
          "anchor": "aip"
        }
      ],
      "assurance": "A durable, human-readable receipt records what was filed, when, by whom (or by what agent), under what delegation, and on what data. The agency issuing the receipt must retain it and make it retrievable to the user on request.",
      "access": "The receipt is evidence, and losing it costs the user when a dispute comes. A user on a shared or public device, with no inbox or storage of their own, can lose the receipt. A user who can't understand what the record says can't use it as evidence either.",
      "openings": [
        "Issue the receipt in more than one form: on-screen, email, PDF, SMS summary, or paper on request.",
        "State in plain language what was filed and by what authority.",
        "Keep every receipt retrievable from the service later, so the moment of confirmation is never the only chance to hold the proof.",
        "Make the receipt screen operable by keyboard and screen reader, with the filing confirmation and reference number announced as they appear, not only displayed.",
        "Pre-populate dispute affordances from the action record, so the user who most struggles to narrate history never has to."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "ActionReceipt",
            "annotation": "Every agent action produces a durable, attributable record, issued to the user as a confirmation they can keep and cite later."
          }
        ]
      },
      "whereThingsGoWrong": "Where this goes wrong is an agent action filed with no durable record, leaving the user unable to prove what was submitted, when, or under what authority once a dispute arises. A receipt can also satisfy the letter of this requirement while failing its point: one that gives a reference number but omits the data used or the delegation it acted under gives the user nothing to anchor a dispute to.",
      "framing": "A durable, human-readable receipt for every action an agent takes, serving as the\nshared record a user and an agency can each check if they later disagree about\nwhat happened.\n",
      "challenge": "As agents file actions on a user's behalf at growing scale, each one settles into\nan official record the moment it is submitted. The user needs a durable,\nhuman-readable account of what was filed, when, by whom (or by what), and on what\nbasis, so that proof of lodgment and the anchor for any later dispute survive the\ntransaction. The record here is the action, the single filed transaction; the\nrecord of the authority it was filed under lives with the delegation itself, and\na dispute usually needs both.\n",
      "precedentsNote": "**[GOV.UK confirmation pages](#s-govuk-confirm).** A confirmation page must\ncarry a reference number where one applies, what happens next and when,\nservice contact details, links to related services, a feedback link, and a\nway to save the record. The [ONS design system](#s-ons-confirm) carries the\nsame requirements. The design system specifies the contents centrally, so each service\ninherits them.\n\n**[ATO lodgment receipt](#s-ato-receipt).** On lodging through myTax the\nATO emails a lodgment receipt carrying a unique receipt ID, and business\nlodgment confirmation screens can be printed or saved as PDF. The record\nleaves the agency's interface and reaches the person's own.\n\n**[PSD2 transaction information](#s-psd2).** The Directive mandates\ndetailed transaction information to consumers, which makes a legitimate\ncharge easier to identify, and Strong Customer Authentication leaves an\nevidence trail behind each payment. One artifact serves as both receipt and\ndispute defense.\n\n**[NIST IR 8202](#s-nist-8202) on blockchain receipts.** Smart contracts\ncreate periodic cryptographic receipts carrying a hash of the transaction\ndata. Hashing makes tampering detectable without trusting the issuer's own\nrecord, at the cost of infrastructure a submission channel does not have.\n",
      "transferability": "The GOV.UK and ATO patterns transfer directly as structural templates. For agent-mediated\nactions, the receipt must additionally record: (a) that an agent acted (not the user\ndirectly), (b) the identity or class of the agent, (c) the delegation authority under which\nit acted, and (d) the data sources it relied upon.\n\nBlockchain-style cryptographic hashing of receipts is worth considering for high-stakes\nfilings where receipt integrity may later be disputed: the user and the government each\nhold a hash that proves the receipt has not been altered.\n"
    },
    {
      "id": "3.3",
      "title": "Audit trail with role-based views",
      "territory": 3,
      "slug": "structured-audit-trail-with-role-based-views",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For logging requirements, well defined across regulated domains such as HIPAA and electronic court filing."
        },
        {
          "level": "emerging",
          "note": "For tagging entries as automated versus human decisions, which is beginning to appear."
        },
        {
          "level": "frontier",
          "note": "For user-legible audit views and role-based presentation, which remain undesigned."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "45 CFR § 164.312 — Technical safeguards, including audit controls (eCFR)",
          "jurisdiction": "US",
          "source": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312",
          "tier": "primary",
          "anchor": "hipaa-312"
        },
        {
          "name": "NAIC Model Bulletin — Use of Artificial Intelligence Systems by Insurers",
          "jurisdiction": "US",
          "year": 2023,
          "source": "https://content.naic.org/sites/default/files/inline-files/2023-12-4%20Model%20Bulletin_Adopted_0.pdf",
          "tier": "primary",
          "anchor": "naic"
        },
        {
          "name": "PACER — File a Case",
          "jurisdiction": "US",
          "source": "https://pacer.uscourts.gov/file-case",
          "tier": "primary",
          "anchor": "pacer"
        },
        {
          "name": "US Courts — Electronic Filing (CM/ECF)",
          "jurisdiction": "US",
          "source": "https://www.uscourts.gov/court-records/electronic-filing-cm-ecf",
          "tier": "primary"
        },
        {
          "name": "IEEE 7001-2021 — Transparency of Autonomous Systems",
          "jurisdiction": "International (IEEE)",
          "year": 2021,
          "source": "https://standards.ieee.org/ieee/7001/6929/",
          "tier": "primary",
          "anchor": "ieee-7001"
        }
      ],
      "assurance": "Each of an agent's actions must be confirmable after the fact, at the grain each audience needs: enough for a user to recognize what happened, enough for a case officer to see the decision points, and enough for an auditor or ombudsman to trace the full chain. The agency operating the service must retain that record and be able to produce it to each audience on request.",
      "access": "If the record can only be read by a specialist, the people it is meant to protect cannot check it. A user who cannot read the record cannot find an error in it that is costing them. Someone else must be able to check it for them, with consent and without a full delegation.",
      "openings": [
        "Offer an assisted route where a caseworker or trusted person walks the record through with the user.",
        "Design for legibility rather than volume.",
        "Make the role switch operable by keyboard and assistive technology, with each view's scope announced."
      ],
      "surface": {
        "instances": [
          {
            "domain": "service",
            "kind": "interactive",
            "component": "AuditTrail",
            "annotation": "One audit record is re-projected per audience, so a user, a caseworker, and an investigator read the same event at the grain each of them needs."
          }
        ]
      },
      "whereThingsGoWrong": "Without adequate logging of the basis for each determination, systemic errors cannot be reviewed or traced. The regulatory-trace view lets that review happen; without it, an unlawful pattern surfaces far too late, if at all.",
      "framing": "One complete log of everything an agent did, projected into a different view for\neach reader who needs to check it. A disputed action can be reconstructed months\nlater from one authoritative record rather than from competing recollections.\n",
      "challenge": "A complete log of all agent actions is necessary for accountability but useless if\npresented as a raw event stream. Different audiences need different views: the user\nneeds a legible summary; the case officer needs decision points; the auditor and the\nombudsman both need the full trace, which is also the chain of accountability.\n",
      "precedentsNote": "**[HIPAA audit controls](#s-hipaa-312), 45 CFR § 164.312(b).** Covered\nentities must implement mechanisms that 'record and examine activity in\ninformation systems that contain or use electronic protected health\ninformation'. OCR guidance elaborates this into the fields practitioners\nlog, and § 164.316 sets a six-year retention period. The regulation itself\nenumerates no fields and does not say 'all activity'.\n\n**[NAIC model bulletin](#s-naic) on insurer AI.** The bulletin, since\nissued by many US state insurance regulators, expects insurers to run a\nwritten program for responsible AI use covering governance, risk-management\ncontrols, and internal audit, including data and record retention\nsufficient to document an AI-supported decision. The insurer must produce\nthat documentation when the regulator examines them. Retention is specified\nby what a later examination needs to reconstruct.\n\n**[PACER and CM/ECF](#s-pacer) (US federal courts).** The Case\nManagement/Electronic Case Files system creates a filing trail for every\ndocument, carrying a timestamp, the filer's identity, and a docket entry\nvisible to all parties. Filing runs continuously with automatic\ntimestamping. The trail is visible to the parties, and not only to the\noperator.\n\n**[IEEE 7001-2021](#s-ieee-7001), transparency of autonomous systems.**\nClause 5 grades transparency from 0 to 5 and sets the level separately for\nfive audience groups: users; the general public and bystanders; validation\nand certification agencies and auditors; incident investigators; and expert\nadvisors in administrative actions or litigation. The ceiling differs by\ngroup and the categories are independent, so meeting a level for one\nimplies nothing about another. The standard specifies what each audience\nmust be able to see, and not how to render it.\n",
      "transferability": "The HIPAA model provides the most detailed precedent for what to log. The insurance model\nadds regulator-facing documentation of decisions made or supported by an AI system,\nessential when an agent acts.\n\nThe design challenge is the view layer: raw HIPAA-style logs are written for compliance\nofficers, not users. None of the cited precedents offer a user-facing view; that gap has\nto be designed fresh.\n"
    },
    {
      "id": "3.4",
      "title": "Reasons for decision",
      "territory": 3,
      "slug": "reasons-for-decision",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For administrative-law reasons requirements and GDPR automated-decision rights, which are settled law."
        },
        {
          "level": "emerging",
          "note": "For AI Act interface-level oversight requirements, still taking shape."
        },
        {
          "level": "frontier",
          "note": "For agent-generated explanations that satisfy legal reasons standards, which remain undesigned."
        }
      ],
      "status": "published",
      "dependsOn": [
        "3.1"
      ],
      "seeAlso": [],
      "precedents": [
        {
          "name": "Administrative Review Tribunal Act 2024 (Cth) — Part 10 Div 3, ss 266–272 (statement of reasons)",
          "jurisdiction": "AU",
          "year": 2024,
          "source": "https://www.legislation.gov.au/C2024A00040/latest/text",
          "tier": "primary",
          "anchor": "art-act"
        },
        {
          "name": "Administrative Review Tribunal",
          "jurisdiction": "AU",
          "source": "https://www.art.gov.au/",
          "tier": "primary"
        },
        {
          "name": "EUR-Lex — GDPR, Regulation (EU) 2016/679 (Article 22)",
          "jurisdiction": "EU",
          "source": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng",
          "tier": "primary",
          "anchor": "gdpr-22"
        },
        {
          "name": "AI and Article 22 — meaningful human review (DPO Centre)",
          "jurisdiction": "EU",
          "source": "https://www.dpocentre.com/blog/ai-and-article-22-the-need-for-meaningful-human-review/",
          "tier": "evidence"
        },
        {
          "name": "EUR-Lex — Regulation (EU) 2024/1689 (Article 14, Human Oversight)",
          "jurisdiction": "EU",
          "year": 2024,
          "source": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng",
          "tier": "primary",
          "anchor": "ai-act-14"
        },
        {
          "name": "EU AI Act — Article 14 (Human Oversight)",
          "jurisdiction": "EU",
          "source": "https://artificialintelligenceact.eu/article/14/",
          "tier": "evidence"
        },
        {
          "name": "EU AI Act human oversight needs (IAPP)",
          "jurisdiction": "EU",
          "source": "https://iapp.org/news/a/eu-ai-act-shines-light-on-human-oversight-needs",
          "tier": "evidence"
        },
        {
          "name": "Royal Commission into the Robodebt Scheme — Report (Recommendations 17.1, 17.2)",
          "jurisdiction": "AU",
          "year": 2023,
          "source": "https://robodebt.royalcommission.gov.au/publications/report",
          "tier": "primary",
          "anchor": "robodebt-report"
        },
        {
          "name": "Robodebt report calls for ADM review body (iTnews)",
          "jurisdiction": "AU",
          "source": "https://www.itnews.com.au/news/robodebt-report-calls-for-automated-decision-making-review-body-597734",
          "tier": "evidence"
        },
        {
          "name": "Automated decision-making transparency (Keypoint Law)",
          "jurisdiction": "AU",
          "source": "https://www.keypointlaw.com.au/keynotes/automated-decision-making-using-personal-information-increasing-transparency-and-accountability-to-avoid-robodebt-2-0/",
          "tier": "evidence"
        },
        {
          "name": "Amershi et al. — Guidelines for Human-AI Interaction (CHI 2019)",
          "jurisdiction": "US",
          "year": 2019,
          "source": "https://dl.acm.org/doi/10.1145/3290605.3300233",
          "note": "Guideline G11, 'Make clear why the system did what it did', a peer-reviewed, empirically validated design anchor for the explanation affordance, sitting beside the administrative-law and Article 22 sources here. Validated against 2018-era recommendation and classification interfaces rather than autonomous agents.",
          "tier": "primary"
        }
      ],
      "assurance": "When an agent makes or recommends a decision, the affected person can obtain articulable reasons that meet administrative-law and automated-decision standards: surfaced at the review checkpoint before submission, and durable, citable, and contestable afterwards. The deciding agency must be able to produce and stand behind those reasons on request.",
      "access": "Reasons exist so the affected person can contest the decision. A benefits decision often lands on people already in hardship. Reasons phrased as scores, features, or statutory shorthand leave exactly the people decisions hit hardest unable to work out what to challenge before the window to appeal closes.",
      "openings": [
        "Give a plain-language reason by default ('decided X because of Y, having considered Z'), with the fuller statement of reasons expandable and available on request.",
        "Translate into the user's preferred language.",
        "Signpost the avenue to human intervention beside the reasons, rather than burying it in appeal fine print.",
        "Make the reasons panel operable by keyboard and screen reader, announcing the plain-language reason when it appears rather than leaving it inside collapsed detail."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "ReasonsPanel",
            "annotation": "The legal duty to give reasons for a decision becomes a structured explanation, shown before submit and kept for any later dispute."
          }
        ]
      },
      "whereThingsGoWrong": "The failure is a consequential decision issued without legally adequate reasons, so its flaws stay hidden from scrutiny. Surfacing the reasons makes an unlawful or unjustified basis identifiable early rather than after widespread harm. A reasons requirement can also be satisfied hollowly: an agent that returns the same templated line for every decision in a category meets the form of a reason while giving the person nothing to contest.",
      "framing": "Making an agent's decision state reasons the affected person can understand and\nuse, to the standard administrative law already demands of human decision-\nmakers. A person contesting the decision can argue against its actual grounds\ninstead of guessing at them.\n",
      "challenge": "When an AI agent makes or recommends a decision that affects a user, the user has a\nright to know why, in terms they can assess and contest. Administrative law already sets the\nstandard for adequate reasons for a government decision, and lets an affected person demand\nthem; the open question is whether reasons generated by an agent can meet that standard.\n\nAn agent's natural output, a confidence score or a feature list, meets none of the tests a\nlater dispute would apply.\n",
      "precedentsNote": "**[Administrative Review Tribunal Act 2024](#s-art-act), the duty to give\nreasons.** The duty is request-triggered: a person whose interests are\naffected by a reviewable decision 'may request the decision-maker to give\nthe person a statement of reasons for the decision' (s 268(1)), and s\n269(2) requires that statement within 28 days. Notice arrives unasked; reasons do not. A second 28-day window runs the\nother way, letting the decision-maker refuse a request made late. Where the statement\ngiven is inadequate, s 271 lets the person apply to the Tribunal for a\nbetter one.\n\n**[GDPR Article 22](#s-gdpr-22), the explanation right and its carve-out.**\nData subjects have the right not to be subject to solely automated\ndecisions with legal or similarly significant effects, and where that\napplies they also gain rights to human intervention, to express a view, and\nto contest. The triad attaches where the decision rests on consent or\ncontract; where a government automated-decision statute supplies the basis\ninstead, the Regulation asks only that the authorizing law provide suitable\nsafeguards. Articles 13-15 require 'meaningful information about the logic\ninvolved', which a review that signs off without checking the reasoning\ndoes not supply.\n\n**[EU AI Act Article 14](#s-ai-act-14), human oversight of high-risk AI.**\nHigh-risk systems must be designed with interface tools that support\neffective oversight, and for biometric identification no action may be\ntaken unless verified by at least two qualified persons. The obligation\nfalls on the system's design, and not on the officer using it.\n\n**[Robodebt Royal Commission](#s-robodebt-report) recommendations 17.1 and\n17.2.** Recommendation 17.1 calls for a clear path to review for those\naffected, departmental advice that automated decision-making is in use with\na plain-language explanation of how it works, and business rules and\nalgorithms available for independent expert scrutiny. Recommendation 17.2\ncalls for a body with power to monitor and audit automated decision-making\nfor its technical aspects, fairness, and usability. An Australian royal\ncommission set the explanation duty out as a recommendation to government.\n",
      "transferability": "The administrative-law reasons requirement translates with one gap worth designing into\nrather than around. In the statute the reasons are request-triggered: notice of the decision\ngoes out unasked, but the statement of reasons arrives only if the person knows to ask, in\nwriting, inside the window. A duty a person has to invoke protects mainly the people already\nequipped to invoke it, which is the wrong distribution for a decision that lands on someone\nin hardship. An agent-mediated service can close that gap, generating the statement at the\nmoment of decision rather than waiting for a request most people never make. GDPR and the AI\nAct add that the interface itself must support meaningful oversight: not just provide reasons\nafter the fact, but allow intervention before the decision takes effect.\n\nFor an agent pattern library, this means the agent must explain its reasoning in terms the\nuser can assess. Whether an agent can generate an explanation that satisfies an\nadministrative tribunal is untested.\n"
    },
    {
      "id": "3.5",
      "title": "Recourse and dispute resolution",
      "territory": 3,
      "slug": "recourse-and-dispute-affordances",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For chargeback and ombudsman models, long-standing recourse mechanisms grounded in Regulation Z, PSD2, and ombudsman accountability practice."
        },
        {
          "level": "emerging",
          "note": "For GDPR contest affordances on automated decision-making, which are beginning to appear."
        },
        {
          "level": "frontier",
          "note": "For agent-action-anchored dispute flows in government services, which remain undesigned."
        }
      ],
      "status": "published",
      "dependsOn": [
        "3.2",
        "3.3"
      ],
      "seeAlso": [
        "3.10"
      ],
      "precedents": [
        {
          "name": "Chargeback (Wikipedia)",
          "source": "https://en.wikipedia.org/wiki/Chargeback",
          "tier": "evidence"
        },
        {
          "name": "Fair Credit Billing Act (Wikipedia)",
          "jurisdiction": "US",
          "source": "https://en.wikipedia.org/wiki/Fair_Credit_Billing_Act",
          "tier": "evidence"
        },
        {
          "name": "Regulation Z, 12 CFR 1026.13 — billing-error resolution (CFPB)",
          "jurisdiction": "US",
          "year": 1968,
          "source": "https://www.consumerfinance.gov/rules-policy/regulations/1026/13/",
          "tier": "primary",
          "anchor": "reg-z"
        },
        {
          "name": "PSD2 — Directive (EU) 2015/2366",
          "jurisdiction": "EU",
          "year": 2015,
          "source": "https://eur-lex.europa.eu/eli/dir/2015/2366/oj/eng",
          "tier": "primary",
          "anchor": "psd2"
        },
        {
          "name": "Office of the Ombudsman Malta — Accountability",
          "jurisdiction": "MT",
          "source": "https://ombudsman.org.mt/news-and-events/accountability-the-second-principle/",
          "tier": "evidence",
          "anchor": "ombudsman-mt"
        },
        {
          "name": "Transparency International — Complaint Mechanisms Guide",
          "source": "https://knowledgehub.transparency.org/assets/uploads/kproducts/ti_document_-_guide_complaint_mechanisms_final.pdf",
          "tier": "evidence"
        },
        {
          "name": "EUR-Lex — GDPR, Regulation (EU) 2016/679 (Article 22)",
          "jurisdiction": "EU",
          "source": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng",
          "tier": "primary",
          "anchor": "gdpr-22"
        }
      ],
      "assurance": "Every disputed action must be traceable to its own action record, and answered within a defined time bound. The service provider holds the obligation to meet that bound.",
      "access": "Recourse is where exclusion compounds. A user disputing an agent's error is often already in hardship or distress, which makes language and literacy barriers, unreliable connectivity, and the lack of someone able to act on their behalf even more costly. Some users give up at an engaged phone line. Others get routed into a months-long process while the error stands.",
      "openings": [
        "Give assisted channels (phone, in person, advocate-lodged) equal standing and the same time bound as the digital route.",
        "Make the dispute affordance on the receipt operable by keyboard and screen reader, with its filed state announced, so raising a dispute doesn't depend on a control only some users can see or click."
      ],
      "surface": {
        "instances": [
          {
            "domain": "service",
            "kind": "interactive",
            "component": "DisputeAffordance",
            "annotation": "A dispute is anchored to a specific action on the record, so raising one starts from the agency's own account of what happened rather than from a blank form."
          }
        ]
      },
      "whereThingsGoWrong": "Where this goes wrong is recourse that is effectively inaccessible, trapping users in engaged phone lines while errors stand, or met with a boilerplate acknowledgment that closes the clock without addressing the dispute's substance. Anchoring disputes to specific action records with time-bound response obligations forces earlier correction.",
      "framing": "A path from any single agent action to a dispute about it, so an affected person\ncan raise a dispute without first reconstructing what the agent did.\n",
      "challenge": "As agents complete more of a user's actions without a person reviewing each one,\nthe things that can go wrong multiply, but the path back from any one of them to\nsomeone who will look at it does not get easier to find. The dispute must be\nanchored to the specific action record, so the user never has to re-narrate the\nentire history to be heard.\n",
      "precedentsNote": "**[Regulation Z billing-error resolution](#s-reg-z), with\n[PSD2](#s-psd2).** Card holders hold reversal rights: the issuer must\nacknowledge a dispute within 30 days, investigate, and within 90 days\ncorrect or explain. Pre-dispute resolution services settle issues before\nthey reach a formal chargeback. The clock and the acknowledgment are\nspecified, so the person knows what is owed to them and by when.\n\n**[The Office of the Ombudsman, Malta](#s-ombudsman-mt).** The model requires\nthe public body to explain what it did and why once a complaint is lodged,\nand the ombudsman assesses whether the decision was reasonable and lawful\nand can surface systemic problems. Recommendations are not binding. The\nexplanation duty is triggered by the complaint, and not by the decision\nthat prompted it.\n\n**[GDPR Article 22](#s-gdpr-22) contest rights.** Article 22 provides the\nright to contest an automated decision and to express one's own point of\nview, where the legal basis is consent or contract; where a government\nautomated-decision statute is the basis instead, the contest right is left\nto whatever safeguards that law provides. Either way it requires concrete\naffordances: a way to initiate a contest, a channel to add information, and\na mechanism to receive a revised decision.\n",
      "transferability": "The chargeback model is particularly instructive: the dispute is anchored to a specific\ntransaction with a unique identifier, the burden shifts to the service provider to\ninvestigate, and there are time-bound response obligations.\n\nWhat the chargeback model assumes, and government agent actions currently lack, is a\nunique, universal transaction identifier and an issuer with an independent incentive to\ninvestigate quickly. A government agency defending its own agent's action does not have\nthat same institutional separation, so the burden-shift has to be designed in rather than\ninherited. The ombudsman model adds the requirement that disputes can surface systemic\nissues, not just individual errors.\n"
    },
    {
      "id": "3.6",
      "title": "Showing liability at the point of action",
      "territory": 3,
      "slug": "liability-surfacing-at-the-point-of-action",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For professional intermediary liability models, which are well settled."
        },
        {
          "level": "emerging",
          "note": "For AI Act provider and deployer liability allocation, still taking shape."
        },
        {
          "level": "frontier",
          "note": "For user-facing liability disclosure at the point of agent action, which remains undesigned."
        }
      ],
      "status": "published",
      "dependsOn": [
        "3.1"
      ],
      "seeAlso": [],
      "precedents": [
        {
          "name": "EUR-Lex — Regulation (EU) 2024/1689 (AI Act)",
          "jurisdiction": "EU",
          "source": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng",
          "tier": "primary",
          "anchor": "ai-act"
        },
        {
          "name": "EUR-Lex — PSD2, Directive (EU) 2015/2366 (SCA and liability)",
          "jurisdiction": "EU",
          "source": "https://eur-lex.europa.eu/eli/dir/2015/2366/oj/eng",
          "tier": "primary",
          "anchor": "psd2-sca"
        },
        {
          "name": "ATO — Lodge your tax return",
          "jurisdiction": "AU",
          "source": "https://www.ato.gov.au/individuals-and-families/your-tax-return/how-to-lodge-your-tax-return/lodge-your-tax-return-online-with-mytax",
          "tier": "primary",
          "anchor": "ato-lodge"
        }
      ],
      "assurance": "The liability allocation shown to the user must be accurate and enforceable, not a plausible-sounding statement with no backing regime. It must match the legal framework that applies to that action. The agency accepting the agent-mediated action must confirm that match before the checkpoint displays the allocation.",
      "access": "A liability statement written for lawyers excludes users twice over. A user who accepts exposure they didn't understand pays for it when the error lands. A user frightened off by legal-sounding text is deterred from help they were entitled to use.",
      "openings": [
        "Put a plain-language liability line at the checkpoint ('if this contains errors, here is who is responsible'), with the full allocation expandable rather than default.",
        "Translate into the user's preferred language, and state the consequence concretely (who pays, who fixes it, who to contact) rather than as a limitation-of-liability clause.",
        "Make the liability line and its expandable detail operable by keyboard and screen reader, so the allocation reaches someone who can't see that fuller detail is collapsed."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "LiabilityStatement",
            "annotation": "Who carries the cost if the agent gets it wrong is stated in plain language at the moment of authorization, rather than discovered afterwards."
          }
        ]
      },
      "whereThingsGoWrong": "The failure mode is no clear accountability for an incorrect automated decision, often with the onus of proof reversed onto the user. A disclosed liability allocation at the point of action makes accountability legible before harm occurs. A disclosure can also satisfy the form and not the substance: a liability line that names a responsible party in general terms, with no enforceable process behind it, leaves the user no better off once the error lands.",
      "framing": "A plain-language statement, shown before the user authorizes an agent's action, of\nwho is responsible if it goes wrong. The user decides whether to proceed with that\nanswer already in view.\n",
      "challenge": "As agents take on more actions with legal or financial consequences, more of\nthose moments will pass with no one having said who bears the liability if it\ngoes wrong.\n\nThe exposure could fall on the user for having delegated, on the agent provider that built\nand operated the agent, or on the government for accepting an agent-mediated submission, and\nthese claims compete with no settled answer. Leaving the allocation ambiguous at this moment\nis harmful.\n",
      "precedentsNote": "**[Regulation (EU) 2024/1689](#s-ai-act), provider and deployer\nobligations.** The Act\nseparates the provider of a system, who designs it, from the deployer, who\nuses it, and gives each distinct obligations on oversight, documentation,\nand risk management. The allocation is written to be surfaced.\n\n**[PSD2 authentication liability shift](#s-psd2-sca).** Liability for a\nfraudulent transaction turns on whether Strong Customer Authentication was\nproperly applied, and a merchant or payment provider that fails to apply it\nbears the loss. The allocation is fixed before the transaction, and not\nargued afterward.\n\n**[ATO tax agent lodgment responsibility](#s-ato-lodge).** A registered tax\nagent lodging for a client bears professional responsibility for the\naccuracy of the lodgment, subject to the information the client provided,\nand ATO systems record whether a return was self-lodged or agent-lodged.\nThe record carries who acted, which is what any later allocation of\nresponsibility rests on.\n",
      "transferability": "The tax agent model is the closest analogue: a professional intermediary acting on delegated\nauthority with defined professional responsibilities. For AI agents, the liability framework\ndoes not yet exist in most jurisdictions, but the interaction pattern should surface whatever\nframework applies.\n\nAt minimum, the review checkpoint needs to state that allocation before the action is\nauthorized. The PSD2 liability-shift model suggests the framework should be pre-determined\nand disclosed, not litigated after the fact.\n"
    },
    {
      "id": "3.7",
      "title": "Reversibility and undo",
      "territory": 3,
      "slug": "reversibility-and-the-undo-problem",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For compensating transactions in software, a long-documented architecture pattern, and amendment processes in government such as tax return corrections: the latter now anchored to the ATO's own amendment process and its statutory time limits, the software side still resting on architecture guidance and research rather than a deployment record."
        },
        {
          "level": "frontier",
          "note": "For reversibility signaling on agent-mediated government actions, which remains undesigned."
        }
      ],
      "status": "published",
      "dependsOn": [
        "3.1"
      ],
      "seeAlso": [],
      "precedents": [
        {
          "name": "Compensating Transaction pattern — Azure Architecture Center",
          "source": "https://learn.microsoft.com/en-us/azure/architecture/patterns/compensating-transaction",
          "tier": "evidence",
          "anchor": "compensating-txn"
        },
        {
          "name": "Recovery-Oriented Computing — Patterson et al. (Berkeley/Stanford)",
          "source": "https://people.eecs.berkeley.edu/~pattrsn/papers/ROC_ASPLOS_draft4.pdf",
          "tier": "evidence",
          "anchor": "roc"
        },
        {
          "name": "Amershi et al. — Guidelines for Human-AI Interaction (CHI 2019)",
          "jurisdiction": "US",
          "year": 2019,
          "source": "https://dl.acm.org/doi/10.1145/3290605.3300233",
          "note": "Guideline G9, 'Support efficient correction': make it easy to edit, refine, or recover when the system is wrong. A peer-reviewed anchor for the user-facing correction affordance, distinct from the backend recovery mechanisms the other sources here describe. Validated against 2018-era, non-agentic interfaces.",
          "tier": "primary"
        },
        {
          "name": "Amend your tax return — Australian Taxation Office",
          "jurisdiction": "AU",
          "source": "https://www.ato.gov.au/individuals-and-families/your-tax-return/amend-your-tax-return",
          "tier": "primary",
          "anchor": "ato-amend"
        },
        {
          "name": "Making a submission to a committee inquiry — aph.gov.au",
          "jurisdiction": "AU",
          "source": "https://www.aph.gov.au/Parliamentary_Business/Committees/House/Making_a_submission",
          "tier": "primary",
          "anchor": "aph-submission"
        }
      ],
      "assurance": "The reversibility classification assigned to an action must be accurate before the agent is allowed to proceed on it: telling a user an irreversible action can be undone is worse than giving no classification at all. The agency that owns the action must verify the classification before the checkpoint shows it to the user.",
      "access": "A user who misses the warning or does not fully grasp it is left holding the consequence of an action that cannot be undone. A user authorizing under time pressure, reading the badge through a screen reader, or reading the service in a language other than the one the badge is written in, must grasp that 'irreversible' means this exact consequence. If they don't, the consequence lands the moment the action is taken.",
      "openings": [
        "Express the classification in plain language with the consequence attached: 'this can be amended within 28 days', 'this cannot be undone'.",
        "Never signal reversibility by color alone.",
        "Make the badge readable by assistive technology, legible at high zoom, translated into the user's preferred language, and stated in words wherever it appears."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "ReversibilityPreview",
            "annotation": "An action's legal reversibility is shown as a plain-language badge before the user authorizes the agent to take it."
          }
        ]
      },
      "whereThingsGoWrong": "Where this goes wrong is a reversal process so protracted and burdensome that even determinations identified as incorrect persist. Pre-signaling notices as 'amendable' with a streamlined correction path reduces that harm. The badge itself can mislead: an agent or agency that labels an irreversible action as amendable, whether by error or to move the user past hesitation, obtains the authorization without the user ever weighing the actual consequence.",
      "framing": "A label on every agent action for how much of it can be walked back: reversible,\namendable, compensable, or irreversible. A user learns that an action can't be\nundone while there is still time to decline it.\n",
      "challenge": "The more government actions agents take on a user's behalf, the more of what\nthey do will land on the irreversible side of the line before the user has had\na chance to weigh in. Some government actions (lodging a tax return, filing a\nform) can be amended. Others (paying a fee, submitting a statutory\ndeclaration) cannot be simply reversed. The user needs to understand the\nreversibility of an action before the agent takes it.\n",
      "precedentsNote": "**[The compensating transaction pattern](#s-compensating-txn) (Azure\nArchitecture Center).** A\ncompensating transaction semantically undoes a completed one by executing\nits logical inverse, so a debit of one hundred is undone by a credit of one\nhundred. It works where the system models actions as events with inverse\noperations.\n\n**[Recovery-oriented computing](#s-roc), Patterson et al.** Patterson and colleagues argue\nfor system-wide undo covering configuration and application management, on\nthe principle that systems should be designed to recover from errors and\nnot only to prevent them. Recovery is treated as a first-class design\ntarget.\n\n**[Amending an Australian tax return](#s-ato-amend).** A return can be\namended after lodgment within statutory time limits, producing a corrected\nversion while the original filing stays on the record. The ATO documents\nthe request route, the time limits, and the before-you-amend steps. It is\ncorrect-and-resubmit, and the original action is never removed.\n\n**[Submissions to an Australian House committee](#s-aph-submission), the\ncounter-case.** Once a submission to a House of Representatives committee\ninquiry is accepted it is protected from legal action for its content and\ncannot be withdrawn or altered without the committee's permission, with a\nsupplementary submission the route for adding material. Some records lock\non lodgment by design.\n",
      "transferability": "Government actions have real-world consequences that cannot always be compensated: a benefit\npayment to the wrong account, a statutory deadline missed by an erroneous filing, a privacy\nbreach from an agent disclosing to the wrong service. Of every pattern in the library, this\none transfers least cleanly. The pattern library should categorize agent actions by\nreversibility:\n\n- **Fully reversible:** draft saved but not submitted; form pre-filled but not lodged.\n- **Amendable:** filed but correctable within a window (tax amendments, change of details).\n- **Compensable:** cannot be undone but can be offset (an overpayment can be refunded).\n- **Irreversible:** cannot be undone (statutory declarations, privacy disclosures, missed deadlines).\n\nThe compensating-transaction pattern proves that reversibility can be modeled and executed\nsystem-side; it says nothing about how that classification should be communicated to a user\nbefore they authorize the action. That user-facing half of the pattern has to be designed\nfresh, not adapted from the software original.\n"
    },
    {
      "id": "3.8",
      "title": "Circuit breaker for agent actions",
      "territory": 3,
      "slug": "systemic-error-detection-and-circuit-breaker",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For the primitives, which already run in finance, aviation, payments, and comment-system anomaly detection."
        },
        {
          "level": "emerging",
          "note": "For bulk-submission safeguards, beginning to appear in administrative-law guidance (e.g. ACUS Recommendation 2021-1)."
        },
        {
          "level": "frontier",
          "note": "As a control plane for fleets of user-acting government agents, where the trigger metric, threshold-setting, and halt-authority governance are all still undesigned."
        }
      ],
      "status": "published",
      "dependsOn": [
        "3.3",
        "3.5"
      ],
      "seeAlso": [],
      "precedents": [
        {
          "name": "SEC / Investor.gov — Stock Market Circuit Breakers (market-wide 7/13/20%; Limit Up-Limit Down)",
          "jurisdiction": "US",
          "year": 2012,
          "source": "https://www.investor.gov/introduction-investing/investing-basics/glossary/stock-market-circuit-breakers",
          "tier": "primary",
          "anchor": "sec-breakers"
        },
        {
          "name": "FAA NOTAM Statement — nationwide ground stop, 11 January 2023",
          "jurisdiction": "US",
          "year": 2023,
          "source": "https://www.faa.gov/newsroom/faa-notam-statement",
          "tier": "primary",
          "anchor": "faa-notam"
        },
        {
          "name": "ACUS Recommendation 2021-1 — Managing Mass, Computer-Generated, and Falsely Attributed Comments",
          "jurisdiction": "US",
          "year": 2021,
          "source": "https://www.acus.gov/document/managing-mass-computer-generated-and-falsely-attributed-comments",
          "tier": "primary",
          "anchor": "acus"
        },
        {
          "name": "NY OAG — Fake Comments report (~18M of 22M FCC comments fake)",
          "jurisdiction": "US",
          "year": 2021,
          "source": "https://ag.ny.gov/press-release/2021/attorney-general-james-issues-report-detailing-millions-fake-comments-revealing",
          "tier": "primary"
        },
        {
          "name": "European Payments Council — SEPA Direct Debit (8-week / 13-month refund; scheme-level reversal)",
          "jurisdiction": "EU",
          "year": 2023,
          "source": "https://www.europeanpaymentscouncil.eu/what-we-do/sepa-direct-debit",
          "tier": "primary",
          "anchor": "sepa"
        },
        {
          "name": "Royal Commission into the Robodebt Scheme — Report (the cost of no circuit breaker)",
          "jurisdiction": "AU",
          "year": 2023,
          "source": "https://robodebt.royalcommission.gov.au/publications/report",
          "tier": "primary",
          "anchor": "robodebt-report"
        },
        {
          "name": "Post Office Horizon IT Inquiry — Volume 1 final report",
          "jurisdiction": "UK",
          "year": 2025,
          "source": "https://www.postofficehorizoninquiry.org.uk/volume-1-post-office-horizon-it-inquirys-final-report",
          "tier": "primary",
          "anchor": "horizon"
        },
        {
          "name": "Schmitz, Rystrom & Batzner — Oversight Structures for Agentic AI in Public-Sector Organizations (REALM 2025)",
          "jurisdiction": "DE",
          "year": 2025,
          "source": "https://aclanthology.org/2025.realm-1.21/",
          "note": "A six-interview study of German civil servants, finding that unit-siloed public-sector governance cannot scale with agent-generated event frequency, and that halt-and-reset authority likely has to be diffused to operational units. A small single-country study (n=6), and one data point rather than settled fact.",
          "tier": "evidence"
        }
      ],
      "assurance": "Government needs confidence that a systemic agent fault, the kind that comes from a shared upstream dependency rather than one transaction, is detected and halted before it reaches population scale, rather than surfacing in a Royal Commission years later. It is the constructive counterpart to the failure documented in the Robodebt case study. The agency deploying the agent fleet, or its platform operator, must hold that detection and halt capability, and be answerable for it.",
      "access": "At population scale, the access failure is redress that depends on self-detection. Users with unreliable connectivity, language or literacy barriers, or those under cognitive load or distress are least able to spot and dispute an error. A systemic fault harms them longest, since remediation that waits for disputes reproduces the same exclusion across a whole population.",
      "openings": [
        "Make remediation proactive: notify affected users without their having to ask, pre-populate reversal from action records, and send notices in plain language across formats.",
        "Keep a fallback channel, human-processed or non-agent digital, moving urgent transactions while a fleet is suspended, so the halt strands nobody."
      ],
      "surface": {
        "instances": [
          {
            "domain": "service",
            "kind": "interactive",
            "component": "CircuitBreakerConsole",
            "annotation": "An error rate crossing a declared threshold suspends the agent automatically, and the remediation reaches every user the failure touched, not only those who complained."
          }
        ]
      },
      "whereThingsGoWrong": "This is the control that would have stopped Robodebt, the automated welfare debt-recovery scheme that raised approximately 794,000 debts against approximately 526,000 income support recipients before it was abandoned, ending in $1.751 billion of debt written off and $746 million refunded to some 381,000 people. A continuously measured aggregate error rate and the authority to halt the scheme would have caught the fault before it reached users. The Post Office Horizon inquiry examined the same shape in the UK: a system producing adverse outcomes at scale, over years, with no mechanism to halt it once the pattern of error was visible. The signal itself can be gamed: an agency that narrows what counts as an 'error', or delays a halt decision to keep the reported rate inside its own declared band, can meet the letter of the control while the fault keeps running underneath it.",
      "framing": "A population-level circuit breaker for fleets of agents, catching and halting a\nrepeating fault before each affected person has to notice their own case.\n",
      "challenge": "As government comes to rely on fleets of agents to handle more interactions, a\nsingle shared fault can mis-file across *thousands* of users before anyone\nnotices. That fault might sit in one agent, a model update, a prompt change, or\na whole platform.\nSingle-action accountability controls secure the correctness of one agent\naction at a time, but none of them catches a failure at that scale.\n\nEach individual action can pass its local review checkpoint while the fleet is systematically\nwrong, because the fault lives in a shared upstream dependency (a model version, a prompt, a\nchanged API mapping, a corrupted reference dataset) rather than in any one transaction. The\nharm is the aggregate, and by the time it surfaces through individual disputes the damage is\npopulation-scale.\n\nNo population-level check currently exists: nothing watches the aggregate action stream, so a\nsystemic fault runs to completion before anyone with the authority to stop it even sees the\npattern.\n",
      "precedentsNote": "**[SEC market-wide circuit breakers](#s-sec-breakers).** US equity markets\nhalt trading market-wide at declines of 7, 13, and 20 percent, with Limit\nUp-Limit Down bands constraining individual securities. The halt is\nautomatic, and it stops the venue rather than each participant separately.\n\n**[FAA nationwide ground stop](#s-faa-notam).** The FAA halted all US\ndepartures after a NOTAM system failure, stopping new operations while the\nfault was diagnosed. A safety regulator stopped a national system on its\nown authority once it could no longer trust the data that system ran on.\n\n**[ACUS Recommendation 2021-1](#s-acus) and [SEPA Direct Debit\nreversal](#s-sepa).** ACUS recommends safeguards for mass,\ncomputer-generated, and falsely attributed comments, and the SEPA scheme\nallows a direct debit to be refunded within eight weeks unconditionally and\nwithin thirteen months where it was unauthorized. Both put the reversal at\nthe scheme level, and not in the hands of each participant.\n",
      "transferability": "Four design primitives transfer cleanly from finance, aviation, payments and rulemaking:\n\n- **Anomaly detection** on the aggregate action stream (per agent, version, model release, service)\n  for spikes in rejections, reversals, downstream-error returns, dispute initiation, or distributional\n  drift in submitted values.\n- **Rate-of-error thresholds** pre-declared as numeric bands (the SEC's explicit 7/13/20% model) so a\n  class of agent action is throttled or paused automatically and contestably, not at discretion.\n- **Automatic suspension (\"kill switch\"),** on the model of an aviation ground stop, to pause a\n  misbehaving agent, version or whole fleet within minutes and re-validate the shared dependency\n  before resuming.\n- **Mass remediation or rollback,** a SEPA-style scheme-level reversal that identifies every action by\n  the implicated agent or version in the affected window, notifies affected users, and reverses or\n  re-processes in bulk.\n\nThe unresolved part is *what to measure and at what threshold*: \"agent error\" is multi-dimensional and\npartly only knowable downstream, so the trigger metric, the false-positive cost of halting a fleet that\nis actually fine, and the governance of who may pull (and reset) the switch are genuine design problems\nwith no production precedent in civic technology.\n"
    },
    {
      "id": "3.9",
      "title": "Notice of automated action before effect",
      "territory": 3,
      "slug": "notice-of-automated-action-before-effect",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For the decision-level automation mention, operating in France since 2016 (CRPA article L311-3-1) and in Canada's Directive on Automated Decision-Making, which requires plain-language notice at every impact level."
        },
        {
          "level": "emerging",
          "note": "For statutory notice duties with commencement dates: EU AI Act Article 26(11), deferred to 2 December 2027, and Australia's entity-level Australian Privacy Principles (APP) 1.7-1.9 disclosure from 10 December 2026, with Australia's post-Royal Commission automated decision-making (ADM) framework still in policy development."
        },
        {
          "level": "frontier",
          "note": "As a pre-effect gate, pairing the mention with a machine-readable record and making notice the condition of the action taking effect, which no surveyed jurisdiction requires."
        }
      ],
      "status": "reviewed",
      "dependsOn": [],
      "seeAlso": [
        "3.1",
        "3.4",
        "4.8"
      ],
      "precedents": [
        {
          "name": "Royal Commission into the Robodebt Scheme — Report (recommendations 17.1 and 17.2)",
          "jurisdiction": "AU",
          "year": 2023,
          "source": "https://robodebt.royalcommission.gov.au/publications/report",
          "tier": "primary",
          "anchor": "robodebt-report"
        },
        {
          "name": "Australian Government response to the Robodebt Royal Commission (PM&C)",
          "jurisdiction": "AU",
          "year": 2023,
          "source": "https://www.pmc.gov.au/resources/government-response-royal-commission-robodebt-scheme",
          "tier": "primary",
          "anchor": "govt-response"
        },
        {
          "name": "Légifrance — Code des relations entre le public et l'administration, article L311-3-1",
          "jurisdiction": "FR",
          "year": 2016,
          "source": "https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000033205535",
          "tier": "primary",
          "anchor": "crpa"
        },
        {
          "name": "Conseil constitutionnel — Decision no. 2020-834 QPC (Parcoursup algorithms)",
          "jurisdiction": "FR",
          "year": 2020,
          "source": "https://www.conseil-constitutionnel.fr/en/decision/2020/2020834QPC.htm",
          "note": "Treats the CRPA L311-3-1 obligations as duties a Parcoursup admissions-secrecy provision had to satisfy, upholding that provision only subject to a stated condition. Cited for the existence of the obligation, not for the content of the reservation.",
          "tier": "primary",
          "anchor": "cc-2020-834"
        },
        {
          "name": "Treasury Board of Canada — Directive on Automated Decision-Making, Appendix C (notice and explanation rows)",
          "jurisdiction": "CA",
          "source": "https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592",
          "tier": "primary",
          "anchor": "tbs-directive"
        },
        {
          "name": "EUR-Lex — Regulation (EU) 2024/1689 (AI Act), Articles 6, 26(11) and 86",
          "jurisdiction": "EU",
          "year": 2024,
          "source": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng",
          "note": "Dates as amended by the Digital Omnibus on AI: Article 26(11) is deferred to 2 December 2027, that date only. Article 86 was not deferred, yet its right attaches only to decisions based on an Annex III high-risk system's output, and that classification applies from the same date. Neither duty applies before then.",
          "tier": "primary",
          "anchor": "ai-act-26"
        },
        {
          "name": "European Commission AI Act Service Desk — Article 26",
          "jurisdiction": "EU",
          "source": "https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-26",
          "note": "The Commission's own hosting of the official text and per-article commentary; corroborates the Article 26(11) wording. Cite it or EUR-Lex for text; never rely on Commission timeline pages for high-risk application dates, which have run stale.",
          "tier": "evidence"
        },
        {
          "name": "Privacy and Other Legislation Amendment Act 2024 (Cth), as passed — APP 1.7-1.9",
          "jurisdiction": "AU",
          "year": 2024,
          "source": "https://parlinfo.aph.gov.au/parlInfo/search/display/display.w3p;query=Id:%22legislation/bills/r7249_aspassed/0000%22",
          "tier": "primary",
          "anchor": "privacy-amendment"
        },
        {
          "name": "ATO — View of Decision, Pintarich v Deputy Commissioner of Taxation [2018] FCAFC 79",
          "jurisdiction": "AU",
          "year": 2018,
          "source": "https://www.ato.gov.au/law/view/document?docid=LIT/ICD/TAD41of2017/00001",
          "tier": "primary"
        }
      ],
      "assurance": "Government needs to be able to show, for every adverse state-initiated agent action, that the affected person received a proposed-action notice before the action took effect. The notice has to include four things: an explicit statement on the decision itself that an automated process produced it, plain-language reasons naming the data relied on, the date the action will take effect, and a machine-readable copy of the record that the person's own agent can check. The agency operating the initiating agent owes the duty to issue the notice, to hold evidence of its delivery, and to keep the stated basis consistent with the record it discloses.",
      "access": "The notice model fails the people who are hardest to notify: those without a stable address or a monitored digital inbox, those who do not read the service language, and those in crisis for whom a legalistic letter with a deadline is unreadable. For them, notice-before-effect degrades into effect-without-notice, the exact outcome the pattern exists to prevent, and a machine-readable record chiefly serves whoever already has an agent to parse it.",
      "openings": [
        "Make the human-readable, plain-language notice the primary artifact, with the machine-readable record as its attachment rather than its substitute.",
        "Deliver through every channel in use: mail, phone, in person, assisted digital.",
        "Start the response window from confirmed delivery rather than dispatch.",
        "Route the unreachable to a human officer before effect, instead of converting an unanswered notice automatically into enforcement.",
        "Write the notice to read at a general literacy level, in community languages, and work with assistive technology, so a person can understand and answer it without any agent at all."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "ProposedActionNotice",
            "annotation": "Nothing takes effect before the person has been told, so the agency issues a proposed-action notice carrying the reasons and the date the action lands if unanswered."
          }
        ]
      },
      "whereThingsGoWrong": "Without the notice, the person discovers the action as its consequence: a garnisheed payment, a blocked service, a demand with interest already running. The pattern's own signal can also be gamed by the issuing side. An agency can bury the automation mention in boilerplate so it informs no one. It can also issue notices at machine speed with response windows no human can meet. That turns notice-before-effect into a compliance stamp on effect-first operation, with the notice itself invoked as a liability shield ('we told you'). At fleet scale the stakes compound: one faulty rule can put thousands of proposed debts with due dates into circulation before the first contest lands, and the record already shows a single automated template, used tens of thousands of times in a year, that the state declined to stand behind.",
      "framing": "A notice the state's agent must issue before an adverse automated action\ntakes effect, stating in plain language that automation acted and what it\nrelied on. It gives the affected person, and their own agent, a chance to\nsee and respond to a decision before it takes hold, instead of learning\nabout it only after the fact.\n",
      "challenge": "As government deploys agents that initiate adverse action, raising a debt,\nissuing a penalty, triggering enforcement, the first a person hears of it will\nbe a demand with a due date. When a person's agent acts on the state, a review\ncheckpoint can stand between draft and submission; when the direction\nreverses, the state's agent will act first and the person will discover the\nconsequence afterward. The scale is already on record from before agents: a\nsingle automated letter template was used 82,217 times in the twelve months to\nOctober 2018, and the state was not bound by what its own letter said.\n\nThe disclosure duties now arriving stop at the entity level: a privacy policy\nor a departmental website tells the population that automation exists\nsomewhere in the service. Nothing tells the person, on the decision that names\nthem, that automation acted on them, why, and on what data, while there is\nstill time to answer back. As initiating fleets scale, that gap becomes the\ndefault experience of adverse government action.\n",
      "precedentsNote": "**[Robodebt Royal Commission](#s-robodebt-report) recommendations 17.1 and\n17.2.** The final report set the baseline for automated government action:\na clear path to review for those affected, departmental advice that\nautomated decision-making is in use with a plain-language explanation of\nhow it works, business rules and algorithms open to independent expert\nscrutiny, and a dedicated body to monitor and audit them. The [Government\nresponse](#s-govt-response) accepted, or accepted in principle, all 56\nrecommendations it addressed. The implementing framework remains in policy\ndevelopment.\n\n**[France, CRPA article L311-3-1](#s-crpa), the mention on the decision\nitself.** The article requires an individual decision taken on the basis of\nalgorithmic processing to carry an explicit mention informing the person,\nwith the rules defining the processing and the principal characteristics of\nits implementation communicated on request. The [Conseil\nconstitutionnel](#s-cc-2020-834) treats these as live obligations that\nother provisions must affirmatively satisfy. It is a mandatory line on the\nadverse decision itself.\n\n**[Canada's Directive on Automated Decision-Making](#s-tbs-directive),\nnotice scaled to impact.** The Directive requires plain-language notice at\nevery impact level, through all service delivery channels in use, and from\nLevel II up a detailed plain-language explanation accompanies any decision\nthat denies a benefit or service or involves a regulatory action. Notice is\nproportioned to consequence on a published scale.\n\n**[EU AI Act Articles 26(11) and 86](#s-ai-act-26).** Article 26(11)\nrequires deployers of Annex III high-risk systems that make or assist\ndecisions about natural persons to inform those persons, and Article 86\ngrants a right to explanation for decisions based on such a system's\noutput. Article 6(3) makes an Annex III system always high-risk where it\nprofiles natural persons, which places data-matching debt recovery inside\nthe classification. Neither duty is in force yet.\n\n**[Australia, APP 1.7-1.9](#s-privacy-amendment), the entity-level\ncontrast.** The Privacy and Other Legislation Amendment Act 2024 requires\nprivacy policies to disclose the kinds of decisions made or substantially\nassisted by computer programs. It tells the population that automation\nexists, and never tells the person that automation acted on them.\n",
      "transferability": "The mention itself transfers directly: France has operated it on individual\ndecisions since 2016, and Canada's Directive shows how to scale the notice and\nexplanation burden to the consequence of the decision, the same proportionate\nposture the library asks of every pattern. The Royal Commission recommendations\ntranslate the duty into the exact vocabulary of an initiating government agent:\nsay that automation is used, explain it plainly, and keep a review path open.\n\nWhat breaks in transit is timing. Every surveyed precedent attaches the notice\nto the decision as issued or after it: the French mention rides on a decision\nalready taken, Canada's explanation accompanies the decision, and the AI Act\nduties inform a person already subject to the system. None makes notice a\nprecondition of the action taking effect, and none contemplates a\nmachine-readable record addressed to the person's own agent. The pre-effect\ngate, delivery verification at fleet speed, and the record format a user's\nagent can check against its own receipts remain undesigned.\n"
    },
    {
      "id": "3.10",
      "title": "Contest before consequence",
      "territory": 3,
      "slug": "contest-before-consequence",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For the pause and burden-shift primitives, already operating: Services Australia's discretionary six-month debt-recovery pause, and chargeback regimes' provider-side burden shift on a stated clock."
        },
        {
          "level": "emerging",
          "note": "For contest rights on automated decisions: the GDPR Article 22 triad where it applies, and Colorado's enacted, later reworked, notice-and-appeal design."
        },
        {
          "level": "frontier",
          "note": "As the default itself, which no surveyed jurisdiction has adopted, leaving its interaction with revenue protection and mass-contest gaming an open design problem."
        }
      ],
      "status": "reviewed",
      "dependsOn": [
        "3.9"
      ],
      "seeAlso": [
        "3.5",
        "3.7"
      ],
      "precedents": [
        {
          "name": "Services Australia — Explanations and formal reviews of a Centrelink decision",
          "jurisdiction": "AU",
          "source": "https://www.servicesaustralia.gov.au/explanations-and-formal-reviews-centrelink-decision?context=64107",
          "tier": "primary",
          "anchor": "sa-review"
        },
        {
          "name": "Services Australia — If you disagree with or can't repay a Centrelink debt",
          "jurisdiction": "AU",
          "source": "https://www.servicesaustralia.gov.au/if-you-disagree-or-cant-repay-centrelink-debt?context=60271",
          "tier": "primary",
          "anchor": "sa-debt"
        },
        {
          "name": "EUR-Lex — GDPR, Regulation (EU) 2016/679, Article 22",
          "jurisdiction": "EU",
          "year": 2016,
          "source": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng",
          "tier": "primary",
          "anchor": "gdpr-22"
        },
        {
          "name": "CJEU — Case C-634/21, SCHUFA Holding (Scoring), 7 December 2023",
          "jurisdiction": "EU",
          "year": 2023,
          "source": "https://infocuria.curia.europa.eu/tabs/affair?sort=AFF_NUM-DESC&searchTerm=%2522C%252D634%252F21%2522&publishedId=C-634%2F21",
          "tier": "primary",
          "anchor": "schufa"
        },
        {
          "name": "Regulation Z, 12 CFR 1026.13 — billing-error resolution (CFPB)",
          "jurisdiction": "US",
          "source": "https://www.consumerfinance.gov/rules-policy/regulations/1026/13/",
          "tier": "primary",
          "anchor": "reg-z"
        },
        {
          "name": "Colorado General Assembly — SB 24-205, Consumer Protections for Artificial Intelligence",
          "jurisdiction": "US (CO)",
          "year": 2024,
          "source": "https://leg.colorado.gov/bills/sb24-205",
          "note": "Repealed and reenacted by SB 26-189, signed 14 May 2026 and effective 1 January 2027, before its own compliance date. It sits at evidence weight despite being legislation, because it never operated.",
          "tier": "evidence",
          "anchor": "sb-24-205"
        }
      ],
      "assurance": "Government needs confidence that lodging a contest suspends the adverse effect, and that the suspension is verifiable rather than asserted: the enforcement state recorded as suspended from the moment of lodgment, no recovery, garnishee or interest running while review is open, and a human review answered within a declared time bound that sits on the agency's clock, not the person's. The agency operating the initiating agent holds the suspension record, the review clock, and the obligation to show that neither slipped.",
      "access": "A request-based pause excludes exactly the people least able to work a system: those who do not know the pause exists, cannot name it in the service language, or are too deep in hardship to negotiate while repayments continue. They are deterred from contesting, or reach a worse outcome at equal effort, paying first and arguing later.",
      "openings": [
        "Trigger the suspension on lodgment itself, with nothing extra to know or request.",
        "Count a contest as lodged however it arrives, by phone, in person, on paper, through an advocate, or from the person's own agent, each with the same suspensive effect and the same clock.",
        "Charge nothing for a contest that fails: a fee, a mark, or a harsher recovery schedule reintroduces the deterrence the pattern exists to remove.",
        "Make the contest control on the notice operable by keyboard and assistive technology, announcing its state ('lodged, recovery paused, decision due by…') non-visually and in plain language."
      ],
      "surface": {
        "instances": [
          {
            "domain": "policy",
            "kind": "interactive",
            "component": "ContestSuspension",
            "annotation": "Contesting a decision suspends its enforcement by default, and the confirmation says plainly what has stopped and when a decision is due."
          }
        ]
      },
      "whereThingsGoWrong": "Without suspension, contest becomes paperwork running beside enforcement: the person repays a debt that review later finds wrong, and the correction arrives after the hardship it should have prevented. The mechanism can also be gamed from both directions. The operator's version is a pause in name only, recovery suspended while interest keeps accruing with no notice to the person, or a review clock met with a boilerplate confirmation that restarts enforcement without engaging the substance. The adversarial version is scripted mass contests lodged across a caseload to suspend recovery wholesale, a denial-of-recovery attack whose predictable institutional response, narrowing the suspension for everyone, lands on the legitimate contester. Severity scales with the fleet: a suspension rule that fails undetected at volume leaves thousands repaying disputed demands, which is the harm the pattern was built to interrupt.",
      "framing": "A \"contest this\" control on the notice a government agent sends before\nan adverse decision takes effect, suspending enforcement the instant\nit's used: no recovery, no penalty, no interest while a time-bound\nhuman review runs. A person can push back before the decision takes\nhold instead of after, and a service team runs the review against a\nfixed clock rather than an open-ended pause.\n",
      "challenge": "As state agents initiate adverse action at machine speed, the review that\nanswers a contest will keep running at human speed, and the gap between the\ntwo clocks will be borne by the person: repaying a debt while disputing it,\naccruing interest while a review queue clears, losing a service while an\nerror is examined. A dispute path that opens only after the consequence\nlands does not close that gap; nothing in it stops the demand while the\nquestion is decided.\n\nWhere a pause exists today it is granted on request, which converts\na safeguard into a knowledge test: the person must know a pause exists, ask\nfor it correctly, and ask in time. As initiating fleets scale, a\nrequest-based pause guarantees that the people who never learn to ask absorb\nthe consequences of every error that review would have caught.\n",
      "precedentsNote": "**[Services Australia review and repayment pause](#s-sa-review).** A person\ncan ask for an explanation or formal review of a Centrelink debt decision,\nwith an explanation call targeted within 14 days and a formal review at 49\ndays, and can ask for [repayments to be paused](#s-sa-debt), generally for\nsix months, while it runs. The suspensive step exists and operates at\nservice scale. It is a discretionary grant the person must know to request,\nand not a default consequence of lodging the contest.\n\n**[GDPR Article 22](#s-gdpr-22), the contest triad and its law-authorized\ncarve-out.** Article 22 grants human intervention, the right to express a\nview, and the right to contest, but only where the decision rests on\ncontract or explicit consent; for decisions authorized by law the triad\ndoes not attach, and the authorizing law need only provide 'suitable\nmeasures' of its own. In [Case C-634/21, SCHUFA](#s-schufa) the CJEU pulled\nupstream scoring engines into the Article 22 regime. A state can legislate\nitself out of the contest right, and where the regime does apply it reaches\nthe engine upstream of the officer who signs.\n\n**[Regulation Z billing-error resolution](#s-reg-z).** A billing-error\ndispute must be acknowledged within 30 days and resolved within 90, and the\ndisputed amount is not collectible while the investigation runs. The burden\nshifts to the provider and the consequence is suspended for exactly as long\nas a bounded clock runs.\n\n**[Colorado SB 24-205](#s-sb-24-205), the stalled statutory route.** The\nact legislated notice of consequential decisions, an opportunity to correct\nthe data relied on, and 'an opportunity to appeal, via human review if\ntechnically feasible, an adverse consequential decision'. It never\noperated: its compliance date was postponed, and it was repealed and\nreenacted by SB 26-189, which kept the notice and a request-based human\nreview. It is a design precedent for the contest-and-correction bundle,\nnever citable as operating practice.\n",
      "transferability": "The pause primitive already runs inside a high-volume payments agency, so the\noperational objection (that recovery systems cannot tolerate suspension) is\nanswered by an existing deployment. The chargeback model supplies the missing\nspine: anchor the contest to the identified action, shift the investigation\nburden to the operator, suspend collection for the life of a bounded clock.\n\nWhat breaks in transit is the trigger and the incentive. The operating pause\nis discretionary and knowledge-gated where this pattern needs it automatic on\nlodgment. The card issuer investigating a chargeback is institutionally\nseparate from the merchant it investigates; an agency reviewing its own\nagent's action is not, so the burden-shift and the clock have to be designed\nin and externally auditable rather than inherited from market structure. And\nthe undesigned core is the default itself: no jurisdiction has yet\nbalanced default suspension against revenue protection, urgency carve-outs,\nand the gaming risk of contest-as-denial-of-recovery. The card claims the\nduty is designable, and says plainly that nobody has designed it yet.\n"
    },
    {
      "id": "3.11",
      "title": "Symmetric duties on the state's agent",
      "territory": 3,
      "slug": "symmetric-duties-on-the-states-agent",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For the components, each already mandated in its home instrument: Canada's Directive requiring a human final decision at impact Levels III-IV with approval escalating to Treasury Board, and model-litigant obligations binding the Commonwealth's conduct for decades, now located in the Legal Services Directions 2025."
        },
        {
          "level": "emerging",
          "note": "For the legal footing, in policy development since the 2024-25 consultation: Australia's post-Royal Commission ADM framework, the reform that would give a duty set like this statutory force."
        },
        {
          "level": "frontier",
          "note": "As a symmetric duty set on an initiating state agent, imposed nowhere surveyed: the receipt, liability, reversibility and onus duties, with Australian statute currently defending the opposite position."
        }
      ],
      "status": "reviewed",
      "dependsOn": [],
      "seeAlso": [
        "3.2",
        "3.6",
        "3.7",
        "3.8"
      ],
      "precedents": [
        {
          "name": "Treasury Board of Canada — Directive on Automated Decision-Making, Appendix C ('Ensuring human involvement'; 'Approval for the system to operate')",
          "jurisdiction": "CA",
          "source": "https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592",
          "tier": "primary",
          "anchor": "tbs-directive"
        },
        {
          "name": "Legal Services Directions 2025, Division 2 of Part 5 — model-litigant obligations",
          "jurisdiction": "AU",
          "year": 2025,
          "source": "https://www.legislation.gov.au/F2017L00369/latest",
          "note": "The obligations reportedly moved from the 2017 Directions' Appendix B to Division 2 of Part 5 of the 2025 Directions, with substance 'largely unchanged'. That characterization rests on secondary law-firm analysis and has not been confirmed against either instrument's primary text, and the linked register entry is the superseded series.",
          "tier": "primary",
          "anchor": "lsd-2025"
        },
        {
          "name": "Migration Act 1958 s 495A — computer-program decisions deemed the Minister's",
          "jurisdiction": "AU",
          "source": "https://www5.austlii.edu.au/au/legis/cth/consol_act/ma1958118/s495a.html",
          "tier": "primary",
          "anchor": "migration-495a"
        },
        {
          "name": "Migration Act 1958 s 495B — gated, no-duty-to-consider substitution of a more favorable decision",
          "jurisdiction": "AU",
          "source": "https://www5.austlii.edu.au/au/legis/cth/consol_act/ma1958118/s495b.html",
          "tier": "primary",
          "anchor": "migration-495b"
        },
        {
          "name": "Social Security (Administration) Act 1999 s 6A — computer-program decisions deemed the Secretary's",
          "jurisdiction": "AU",
          "source": "https://classic.austlii.edu.au/au/legis/cth/consol_act/ssa1999338/s6a.html",
          "tier": "primary",
          "anchor": "ssa-6a"
        },
        {
          "name": "ATO — View of Decision, Pintarich v Deputy Commissioner of Taxation [2018] FCAFC 79",
          "jurisdiction": "AU",
          "year": 2018,
          "source": "https://www.ato.gov.au/law/view/document?docid=LIT/ICD/TAD41of2017/00001",
          "tier": "primary",
          "anchor": "pintarich"
        },
        {
          "name": "AUSPUBLAW — Automated Processes and Administrative Law: The Case of Pintarich",
          "jurisdiction": "AU",
          "year": 2018,
          "source": "https://www.auspublaw.org/blog/2018/11/the-case-of-pintarich",
          "note": "Covers Kerr J's dissent, which held that the legal conception of a decision cannot be static and must allow for decisions made independently of human mental input.",
          "tier": "evidence"
        },
        {
          "name": "Norton Rose Fulbright — Overview of the Commonwealth's model litigant obligations",
          "jurisdiction": "AU",
          "source": "https://www.nortonrosefulbright.com/en/knowledge/publications/811b0b24/an-overview-of-the-commonwealths-model-litigant-obligations",
          "tier": "evidence",
          "anchor": "nrf-model-litigant"
        },
        {
          "name": "Royal Commission into the Robodebt Scheme — Report",
          "jurisdiction": "AU",
          "year": 2023,
          "source": "https://robodebt.royalcommission.gov.au/publications/report",
          "tier": "primary"
        }
      ],
      "assurance": "Government needs to be able to show, for every state-initiated agent action: a receipt delivered to the affected person recording what acted, on what data, under what authority; a named accountable owner for the action class; a verified reversibility classification; and, above a declared impact threshold, a human who made the final decision. Human involvement must be defined before deployment, not asserted after. In any contest the onus sits with the agency: it must not require the person to prove what the agency's own records already show. The deploying agency and its responsible officers hold these records and duties; a deeming provision that attributes the decision to a minister does not discharge any of them.",
      "access": "The asymmetry lands hardest on the people least equipped to answer the state at its own speed: proving a negative from years-old payslips excludes people without stable records, people without the literacy or numeracy for a reconciliation exercise, and people with no advocate or agent to reconstruct a history. Under onus reversal their silence is read as admission and their situation matures into a presumed debt; they are denied the outcome, or reach a worse one at equal effort than anyone with representation.",
      "openings": [
        "Shift the burden at the policy level: the agency absorbs the verification cost, checks its own holdings before demanding anything, and treats a non-response as a reason to reach the person, never as proof.",
        "Issue the receipt in plain language across channels, so a person without any agent can still see what acted on them and why.",
        "Weigh the person's circumstances (hardship, vulnerability, irreversibility) in the impact threshold that triggers a mandatory human decision, never only the dollar value."
      ],
      "surface": {
        "instances": [
          {
            "domain": "policy",
            "kind": "interactive",
            "component": "DutySchedule",
            "annotation": "The duties an agency owes a person are published as a schedule its own agent fleet has to meet, action class by action class."
          }
        ]
      },
      "whereThingsGoWrong": "Absent the duty set, the failure documented in the Robodebt case study recurs in agentic form: the onus reversed onto the person, no record of what acted or on what basis, no named owner, and correction so burdensome that even identified errors stand, this time at machine speed. The Royal Commission's record shows approximately 794,000 debts raised across approximately 526,000 recipients as the cost of the last unaccountable run. The duties can also be met on paper and defeated in substance: receipts generated but never delivered or never legible; a 'human final decision' that is a batch approval of hundreds of outputs an hour; an impact-classification exercise that scores the fleet's actions just under the threshold so the human-decision rule never triggers; model-litigant undertakings honored in litigation but ignored in the automated recovery pipeline that precedes it. Each is the institution gaming its own commitment. That is why the duties bind at the point of action, with records a person or auditor can check, rather than as posture.",
      "framing": "Holding any agent the state operates to the duty set expected of a\nperson's agent (a receipt for every action, a disclosed liability\nallocation, a verified reversibility classification), and often to a\nhigher standard. It gives a policymaker one duty schedule to hold\ngovernment automation to, and gives the service team building a\nstate-side agent the accountability bar to design against before a\ndispute tests it.\n",
      "challenge": "As government deploys agents that initiate adverse action, the duties\nwill run one way. A person's agent is expected to produce action\nreceipts, disclose a liability allocation, and classify reversibility\nbefore it acts on the state; the state's agent, acting with more power\nover the same person, owes none of these duties anywhere in statute.\nAustralian law runs the other way.\nDeeming provisions attribute a computer's output to the minister while\nimposing no duty toward the person acted on. One of them disclaims any\nobligation to correct a certified computer malfunction even when the\naffected person asks. And case law lets the state disown its own automated\nletter because no human 'mental process' stood behind it. The person must\ntreat every automated notice as real; the state need not.\n\nAs initiating fleets scale, that asymmetry stops being a legal curiosity and\nbecomes the operating structure of government: machine-speed demands from an\nactor that keeps no receipt the person can see, names no owner, and answers\nfor nothing.\n",
      "precedentsNote": "**[Canada's Directive on Automated Decision-Making](#s-tbs-directive),\nAppendix C.** At impact Levels I-II 'the system may make decisions and\nassessments without direct human involvement'; at Levels III-IV 'the final\ndecision must be made by a human' and decisions 'cannot be made without\nhaving clearly defined human involvement during the decision-making\nprocess'. Approval for the system to operate escalates with impact,\nreaching Treasury Board itself at Level IV. A government mandates human\ndecisions for its own high-impact automation, on the same impact scale as\nits notice and explanation duties.\n\n**[Legal Services Directions 2025](#s-lsd-2025), model-litigant\nobligations.** The Commonwealth's model-litigant obligations bind only the\nstate's side of a dispute, because of the power asymmetry: acting honestly and fairly; never requiring the other party to prove a\nmatter the Commonwealth knows to be true; never taking advantage of a\nclaimant who lacks the resources to litigate; and apologizing where the\nCommonwealth has acted wrongfully. A Commonwealth instrument already binds\nthe state alone to a duty set, on the reasoning that its power over the\nother party is the greater.\n\n**[Migration Act 1958 ss 495A and 495B](#s-migration-495a), and [Social\nSecurity (Administration) Act 1999 s 6A](#s-ssa-6a).** Sections 495A and 6A deem a computer program's output to be the minister's\nor the secretary's decision, which solves attribution for the state while\nimposing no notice, explanation, or contest duty toward the person.\n[Section 495B](#s-migration-495b) allows a more favorable substitution only\nafter a formal certificate that the program malfunctioned, imposes no duty\nto consider one even when the affected person asks, and overrides any\ncontrary law. The statute is explicit that the state need not fix its own\nknown automated errors.\n\n**[Pintarich v Deputy Commissioner of Taxation](#s-pintarich) [2018] FCAFC\n79.** A computer-generated ATO letter ostensibly waived most of the\ninterest on a tax debt, and the Full Federal Court majority held that no\ndecision had been made absent a human mental process, so the taxpayer could\nnot hold the Commonwealth to its own automated communication. The ATO's\nView of Decision records that the template was used 82,217 times in the\ntwelve months to October 2018. The risk of the state's automated output\nfalls on the person who receives it.\n",
      "transferability": "Two components transfer as working practice. The model-litigant obligations\nprove that duty sets binding only the state's side, justified by the power\nasymmetry, are a settled Australian instrument; this card extends their logic\nupstream from litigation conduct to the point of automated initiation. Canada's\nAppendix C proves an impact-scaled mandatory-human-decision rule can operate\ninside a government at directive level, with an escalating approval chain to\nmatch.\n\nWhat breaks in transit: the model-litigant obligations attach when a dispute\nexists, not when an agent acts, so the transposition is an extension the\ninstrument's text does not yet make; and Canada's Directive is internal\nadministrative policy, a discipline on departments rather than a right the\naffected person can enforce. The receipt, liability and reversibility mirrors\nhave no state-side instrument in any surveyed jurisdiction, and the Australian\ndeeming provisions actively occupy the ground with the opposite rule. The\naggregate half of the duty belongs to a fleet-level circuit breaker that\ncatches the systemic fault; this card holds the state's agent to account one\naffected person at a time.\n"
    },
    {
      "id": "4.1",
      "title": "Showing confidence and uncertainty",
      "territory": 4,
      "slug": "confidence-uncertainty-surfacing",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For confidence surfacing in clinical decision support and weather forecasting, where the response and the theory of appropriate reliance are mature."
        },
        {
          "level": "emerging",
          "note": "For government digital services generally, where no specific guidance requiring confidence display is cited here; the healthcare and forecasting patterns above are the nearest documented analog."
        },
        {
          "level": "frontier",
          "note": "As applied to a user-facing government determination, where the response remains unproven."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "Lee, J.D. & See, K.A. — Trust in automation: Designing for appropriate reliance",
          "jurisdiction": "US",
          "year": 2004,
          "source": "https://journals.sagepub.com/doi/10.1518/hfes.46.1.50_30392",
          "tier": "primary",
          "anchor": "lee-see"
        },
        {
          "name": "Enhancing Clinician Trust in AI Diagnostics: A Dynamic Framework for Confidence Calibration and Transparency (PMC)",
          "year": 2025,
          "source": "https://www.ncbi.nlm.nih.gov/pmc/articles/PMC12428550/",
          "tier": "evidence",
          "anchor": "clinician-trust"
        },
        {
          "name": "Amershi et al. — Guidelines for Human-AI Interaction (CHI 2019)",
          "jurisdiction": "US",
          "year": 2019,
          "source": "https://dl.acm.org/doi/10.1145/3290605.3300233",
          "note": "Guideline G2, 'Make clear how well the system can do what it can do,' from an 18-guideline set validated by 49 practitioners against 20 AI products, a peer-reviewed anchor for surfacing error rates and confidence. Validated against 2018-era classification and recommendation interfaces, not autonomous agents, so it transfers as a principle and carries no evidence tested on agents.",
          "tier": "primary",
          "anchor": "amershi"
        }
      ],
      "assurance": "Government needs the certainty behind a determination to be legible and accurate before anyone relies on it, so reliance can be calibrated rather than driven by over-trust or blanket rejection. The agency issuing the determination must hold and expose that confidence calibration alongside it.",
      "access": "A user who can't see a color band, or doesn't read percentages and traffic-light conventions, gets none of the meaning the indicator conveys. They may over-rely on a guess or reject a sound determination that a better-served user would have calibrated correctly.\n\nThe routing behind the band excludes differently. A person whose circumstances are complex or atypical, several income sources, a thin record, a name the system matches inconsistently, scores low confidence more often and is redirected to the human-review queue. When that queue runs slower than the automated path, the people hardest to score wait longest for the same outcome.",
      "openings": [
        "Pair every confidence signal with a plain-language equivalent ('we're fairly sure about this, but a person will double-check') and a next step the user can act on.",
        "Hold the human-review path to the same timeliness standard as the automated one, with both processing times published.",
        "Convey the same meaning non-visually: every badge needs an accessible name, and the band must stay legible at high zoom."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "ConfidenceTriage",
            "annotation": "The system's own certainty about a determination is shown to the user in bands, each one paired with what happens next at that level."
          }
        ]
      },
      "whereThingsGoWrong": "The failure mode is an automated estimate issued with false certainty, masking determinations that should never have stood. Surfacing low confidence on such an estimate, tied to mandatory human review, flags exactly those determinations before they go out at scale. The confidence score itself can be gamed by the agency that relies on it: a threshold loosened to shrink the review queue reports higher certainty than the estimate supports, and the display never reveals the difference.",
      "framing": "Showing how sure the agent is, in terms a user can act on: a confidence band tied\nto what happens next, so a firm determination and a best guess never look alike. A\nuser can tell when an answer needs checking before they act on it.\n",
      "challenge": "Agents that produce determinations of varying certainty are now widely available, and as\ngovernment services run on them they will issue far more of these determinations than any\ncaseworker did. Presenting them all with uniform authority drives either uncritical\nacceptance (automation bias) or blanket rejection (automation aversion).\n\nWhen the certainty behind an output is invisible, a user cannot tell a confident\ndetermination from a guess, so they cannot calibrate how far to rely on it.\n",
      "precedentsNote": "**[Lee and See on trust in automation](#s-lee-see).** The framework defines\ncalibration as the correspondence between a person's trust in an automated\nsystem and that system's actual capabilities, and names miscalibration in\nboth directions: overtrust produces misuse, distrust produces disuse. It\nasks for two further properties, resolution, or how precisely a judgment of\ntrust differentiates levels of capability, and temporal and functional\nspecificity, so that trust attaches to a particular function at a\nparticular moment. Calibration alone is not the requirement.\n\n**[Clinician trust in AI diagnostics](#s-clinician-trust).**\nClinical systems have developed confidence-visualization patterns:\ncolor-coded bands, uncertainty intervals alongside predictions, and\nlow-certainty labels that trigger escalation. Clinicians are generally\nreceptive to evidence-based AI tools, and override rates stay high where\ncalibration is poor.\n\n**[Amershi et al., Guidelines for Human-AI Interaction](#s-amershi).** The guideline directs a\nsystem to make clear how well it can do what it can do, from a set\nvalidated with practitioners against real interfaces. The capability claim\nis treated as part of the interface, and not as documentation sitting\nbeside it.\n",
      "transferability": "**High transferability.** Government services regularly produce determinations of\nvarying certainty (eligibility assessments, risk classifications, benefit\ncalculations), so surfacing confidence is directly applicable. The healthcare\nparallel is apt: clinicians and caseworkers both need to know when to rely on a\nsystem versus apply professional judgment. The color-coded band pattern is\nsimple and well understood.\n\n**Key adaptation:** government confidence signals have to be tied to a next step\nthe user can act on (\"This assessment has medium confidence; a human officer\nwill review before any decision takes effect\"), not displayed as passive\ninformation the user can do nothing with.\n"
    },
    {
      "id": "4.2",
      "title": "Trust marks and certification",
      "territory": 4,
      "slug": "trust-marks-certification-ui",
      "maturity": "emerging",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For generic security seals, where market research shows the trust-mark response is widely recognized by users, and certifiable AI standards (ISO/IEC 42001, NIST AI RMF) exist that could back an AI-specific mark."
        },
        {
          "level": "emerging",
          "note": "For AI-specific certification, where an evidence-linked mark for a government AI service remains largely conceptual, with no widely adopted visual scheme yet rendering one for users."
        }
      ],
      "status": "published",
      "dependsOn": [
        "8.1"
      ],
      "seeAlso": [],
      "precedents": [
        {
          "name": "Baymard Institute — Which Site Seal do People Trust the Most?",
          "source": "https://baymard.com/blog/site-seal-trust",
          "tier": "evidence",
          "anchor": "baymard-seals"
        },
        {
          "name": "CXL Research — Which Site Seals Create The Most Trust?",
          "source": "https://cxl.com/research-study/trust-seals/",
          "tier": "evidence"
        },
        {
          "name": "ISO/IEC 42001:2023 — AI Management System",
          "jurisdiction": "ISO",
          "year": 2023,
          "source": "https://www.iso.org/standard/42001",
          "tier": "primary",
          "anchor": "iso-42001"
        },
        {
          "name": "NIST AI Risk Management Framework",
          "jurisdiction": "US",
          "year": 2023,
          "source": "https://www.nist.gov/itl/ai-risk-management-framework",
          "tier": "primary",
          "anchor": "nist-airmf"
        },
        {
          "name": "DTA pilots new AI assurance framework",
          "jurisdiction": "AU",
          "source": "https://www.dta.gov.au/articles/dta-pilots-new-ai-assurance-framework",
          "tier": "primary",
          "anchor": "dta-assurance"
        },
        {
          "name": "digital.gov.au — APS AI Plan 2025: Trust",
          "jurisdiction": "AU",
          "year": 2025,
          "source": "https://www.digital.gov.au/policy/ai/australian-public-service-ai-plan-2025/trust",
          "tier": "primary",
          "anchor": "aps-ai-plan"
        }
      ],
      "assurance": "Government needs the properties it claims for an AI service (human review before effect, tested for bias, no personal records in training data) to be auditable rather than merely asserted. A user can then rely on a standards claim without re-establishing trust from scratch at each interaction. The certifying body or the deploying agency must keep that audit evidence current and reachable.",
      "access": "A symbol without a text alternative certifies nothing to a screen-reader user. If certification costs what only well-funded agencies can pay, the services relied on by smaller agencies' communities end up looking untrustworthy for reasons that have nothing to do with how they're governed.",
      "openings": [
        "Render every claim text-first, stating in plain language what it certifies and linking to its evidence in an accessible form.",
        "Price certification so the long tail of services can reach it.",
        "Show restraint in proliferation: seal blindness returns every user to judging from scratch."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "TrustMark",
            "annotation": "A certification claim is shown as a mark that links to the evidence behind it, rather than as a free-standing badge."
          }
        ]
      },
      "whereThingsGoWrong": "Without certified, auditable evidence of genuine human review, its absence stays invisible, so a determination can imply oversight that never happened. A trust mark backed by auditable evidence turns that absence into a visible certification gap rather than a hidden policy failure. The mark itself can be gamed: an agency can display it without meeting the standard it claims, or a certifying body that is under-resourced or captured by the agencies it certifies can renew it without a fresh assessment.",
      "framing": "A trust mark for government AI services that certifies a defined standard the\nservice is held to. The mark names what it stands for, so a user knows at a\nglance what kind of claim it's making.\n",
      "challenge": "As more government services run on AI, and the tools to build and certify them\nare now widely available, a user has no repeatable, verifiable signal that a\ngiven service meets a defined standard for privacy, security, accuracy, and\nfairness. Without one, each interaction forces an individual trust judgment from\nscratch. That burden scales with the number of agent-run services, and it depresses\nadoption of the ones that are in fact well-governed.\n",
      "precedentsNote": "**[Baymard Institute on e-commerce trust seals](#s-baymard-seals).** In a Baymard Institute\nstudy of 2,510 US respondents, the Norton Secured Seal took about 36\npercent of the votes when people were asked which seal gave them the best\nsense of trust when purchasing online. The study measured which mark feels reassuring, and no effect on what\nanyone did. Users with little understanding of TLS are responding to a\nbrand they recognize.\n\n**[ISO/IEC 42001:2023](#s-iso-42001), AI management systems.** The standard\nprovides a certifiable framework covering trustworthiness, transparency,\nexplainability, and accountability, demonstrated through model cards and\nexplainability records. Certification attaches to the management system,\nand not to any one model's output.\n\n**[NIST AI Risk Management Framework](#s-nist-airmf).** The voluntary\nframework organizes trustworthy AI around seven characteristics and four\nfunctions, and a later Generative AI Profile extended it to generative\nrisks. Conformance can serve as a trust signal, and there is no\ncertification scheme behind it.\n\n**[Australian DTA AI assurance framework](#s-dta-assurance).** The DTA is\npiloting an assurance framework and has set a Standard for AI Transparency\nStatements, and the [APS AI Plan](#s-aps-ai-plan) names trust as a pillar.\nThe assurance apparatus is in pilot, and the transparency statement is the\npart already required.\n",
      "transferability": "**Medium transferability with significant caveats.** The trust-seal pattern is\nwell-proven for reducing purchase abandonment, but government differs: users\noften have no alternative provider, so the seal functions less as a competitive\ndifferentiator and more as an accountability signal. The e-commerce research also\nexposes a core weakness: seals create *perceived* security, not necessarily\n*actual* security.\n\nFor government AI agents, trust marks should certify verifiable properties\n(\"decisions are reviewed by a human before taking effect\"; \"tested for bias\nagainst [protected attributes]\"; \"training data does not include your personal\nrecords\").\n\n**Key adaptation:** government trust marks should link directly to the underlying\nevidence (algorithmic transparency records, audit reports, bias-testing results),\ntransforming them from passive symbols into active transparency instruments.\nThis makes the pattern dependent on a certification regime to certify against.\n"
    },
    {
      "id": "4.3",
      "title": "Graduated delegation",
      "territory": 4,
      "slug": "graduated-delegation",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For the theory of graduated, non-binary delegation, fully established via Parasuraman, Sheridan & Wickens; no primary source here documents an enterprise-grade AI-agent autonomy framework already in production."
        },
        {
          "level": "frontier",
          "note": "As a user-facing response in government services: no government has yet put a production-grade, user-controlled autonomy dial in front of the public for AI agents."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "CSA — Autonomy Levels for Agentic AI",
          "year": 2026,
          "source": "https://cloudsecurityalliance.org/blog/2026/01/28/levels-of-autonomy",
          "tier": "evidence"
        },
        {
          "name": "SAE J3016 — Taxonomy and Definitions for Terms Related to Driving Automation Systems",
          "jurisdiction": "Global",
          "year": 2021,
          "source": "https://www.sae.org/standards/content/j3016_202104/",
          "tier": "primary",
          "anchor": "sae-j3016"
        },
        {
          "name": "Parasuraman, Sheridan & Wickens — A model for types and levels of human interaction with automation",
          "year": 2000,
          "source": "https://doi.org/10.1109/3468.844354",
          "tier": "primary",
          "anchor": "psw-2000"
        },
        {
          "name": "The Agentic Trust Framework: Zero Trust Governance for AI Agents (Woodruff, via CSA blog)",
          "year": 2026,
          "source": "https://cloudsecurityalliance.org/blog/2026/02/02/the-agentic-trust-framework-zero-trust-governance-for-ai-agents",
          "tier": "evidence",
          "anchor": "csa-atf"
        },
        {
          "name": "Agentic Trust Framework specification (GitHub)",
          "source": "https://github.com/massivescale-ai/agentic-trust-framework",
          "tier": "evidence"
        },
        {
          "name": "Nielsen Norman Group — Progressive Disclosure (Jakob Nielsen)",
          "year": 2006,
          "source": "https://www.nngroup.com/articles/progressive-disclosure/",
          "tier": "evidence",
          "anchor": "nngroup-disclosure"
        },
        {
          "name": "Yocco, V. — Designing For Agentic AI: Practical UX Patterns (Smashing Magazine)",
          "year": 2026,
          "source": "https://www.smashingmagazine.com/2026/02/designing-agentic-ai-practical-ux-patterns/",
          "tier": "evidence",
          "anchor": "yocco-patterns"
        },
        {
          "name": "Careful adoption of agentic AI services — Five Eyes joint cybersecurity guidance (ASD ACSC, CISA, NSA, CCCS, NCSC-NZ, NCSC-UK)",
          "jurisdiction": "AU/US/CA/NZ/UK",
          "year": 2026,
          "source": "https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/careful-adoption-of-agentic-ai-services",
          "tier": "primary",
          "anchor": "five-eyes-agentic"
        },
        {
          "name": "DRCF — The Future of Agentic AI (foresight paper)",
          "jurisdiction": "UK",
          "year": 2026,
          "source": "https://www.drcf.org.uk/publications/papers/thefutureofagenticai",
          "note": "A joint paper from the UK's four digital regulators (CMA, FCA, ICO, Ofcom) setting out five levels of agent autonomy (Tool, Assistant, Operator, Collaborator, Autonomous Actor), with the top two rungs described as largely theoretical. An official cross-regulator articulation of the level-based model, but a foresight document by its own admission, not policy; do not read it as evidence that any deployment sits at a given rung.",
          "tier": "evidence"
        },
        {
          "name": "CAISI — evaluation of DeepSeek AI models (agent hijacking)",
          "jurisdiction": "US",
          "year": 2025,
          "source": "https://www.nist.gov/news-events/news/2025/09/caisi-evaluation-deepseek-ai-models-finds-shortcomings-and-risks",
          "tier": "primary"
        }
      ],
      "assurance": "Government needs an agent's autonomy over a user's affairs to be bounded and earned rather than granted wholesale: a user should be able to start with minimal involvement and expand it on demonstrated use. The agency's agent-platform operator enforces the capability boundaries at the platform layer, rather than leaving them to each deployment.",
      "access": "Cautious users, and those who distrust automation, are deterred if the dial pressures them toward automated action. They will reach a worse outcome at equal effort if the conservative level they chose gets constrained service.",
      "openings": [
        "Default every user to the most conservative level, rather than requiring them to opt down.",
        "Offer a 'just do it the normal way' escape hatch at every level, routing to existing non-agent channels at equal standing.",
        "Refuse gamification, which would dress delegation up as achievement and pressure people into more automation than they want.",
        "Announce the dial's current level, and the consequence of changing it, to assistive technology."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "DelegationLadder",
            "annotation": "The risk of a service action sets the delegation level offered, and that level defaults to the most conservative option."
          }
        ]
      },
      "whereThingsGoWrong": "The failure to prevent is unsupervised, fully automated issuance of high-consequence decisions. When public-facing agents are capped at supervised levels, the technical boundary keeps a human in the loop where it matters. The level itself can be pushed past what a user chose: a provider can silently default a returning user to a higher level after a period of inactivity, or treat non-response at a checkpoint as consent to proceed at the next level up.",
      "framing": "How much autonomy a user grants an agent over their affairs, growing only as\ntrust is earned rather than handed over all at once. At every point, the user\ndecides how far it goes.\n",
      "challenge": "Agents capable of acting across a whole government service, not just answering questions, are\nnow widely available. As they take on more of a service, government has to decide how much\nautonomy to grant one over a user's affairs, and how a user earns or contracts that\nautonomy.\n\nGranting the full range at once overwhelms cautious users and exposes everyone to\nhigh-consequence actions before trust is established, while granting too little under-serves\nconfident ones.\n",
      "precedentsNote": "**[Parasuraman, Sheridan and Wickens](#s-psw-2000).** The model identifies\nfour classes of automatable function: information acquisition, analysis,\ndecision selection, and action implementation. It establishes that\nautomation is 'not all or none, but can vary across a continuum of levels',\nand that one system can automate each class to a different degree. That is\nthe theoretical basis for granular delegation.\n\n**[CSA Agentic Trust Framework](#s-csa-atf).** The specification applies\nzero-trust principles through a four-level maturity model with one\noperating mode each: Intern observes and reports, Junior recommends and\ngets approval, Senior acts and notifies, Principal runs autonomously. Its\nstated rule is that 'Agents earn autonomy through demonstrated\ntrustworthiness. They do not receive it by default.'\n\n**[Nielsen Norman Group on progressive disclosure](#s-nngroup-disclosure),\nadapted to agents.**\nRevealing complexity incrementally, whether step by step, conditionally, or\ncontextually, has been carried into agent interfaces with each step\nreaffirming trust before the person proceeds. Yocco's [autonomy\ndial](#s-yocco-patterns) lets a person trust an agent for low-stakes tasks\nwhile demanding confirmation for high-stakes ones.\n\n**[Five Eyes joint guidance on agentic AI\nservices](#s-five-eyes-agentic).** Six national cyber authorities recommend\nphased deployment, in which an agent's access and autonomy rise\nprogressively while human oversight is maintained. Graduated autonomy\ncarries government security backing, and not only the industry frameworks\nabove it.\n",
      "transferability": "**High transferability; among the most directly applicable patterns here.**\nGovernment services naturally decompose into risk tiers: checking a payment date\nis low-stakes, updating bank details is medium, lodging an appeal is high. A\ngraduated delegation model maps cleanly onto this existing risk architecture.\n\n**Proposed government adaptation:**\n\n| Level | Agent capability | Human involvement | Example |\n|-------|-----------------|-------------------|---------|\n| Level 0: Informational | Answer factual questions from published guidance | None required | \"When is the next payment date?\" |\n| Level 1: Guided | Pre-fill forms, suggest next steps | User reviews and confirms every action | \"You may be eligible for X. Shall I start the application?\" |\n| Level 2: Supervised | Execute multi-step workflows | User approves at defined checkpoints | Change-of-address across linked services, confirming each service |\n| Level 3: Delegated | Act within defined parameters without per-action approval | Exception-based review; audit trail | Adjust payment schedule within legislated parameters |\n| Level 4: Autonomous | Initiate and complete complex transactions | Post-hoc audit; override available | Not recommended for government services at current maturity |\n\n**Critical constraint:** full delegation remains feasible for only a small minority\nof tasks. Most government AI-agent interactions should operate at Levels 0–2.\n"
    },
    {
      "id": "4.4",
      "title": "Transparency by default",
      "territory": 4,
      "slug": "transparency-by-default-disclosure",
      "maturity": "emerging",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For algorithmic transparency recording, where the UK ATRS is production-grade and mandatory."
        },
        {
          "level": "emerging",
          "note": "For real-time agent transparency, where regulation now demands it but the interaction patterns are still forming."
        },
        {
          "level": "frontier",
          "note": "For adaptive, user-preference-driven disclosure."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "EU AI Act, Article 50 — Transparency obligations",
          "jurisdiction": "EU",
          "source": "https://artificialintelligenceact.eu/article/50/",
          "tier": "evidence",
          "anchor": "ai-act-50"
        },
        {
          "name": "EU AI Act, Article 13",
          "jurisdiction": "EU",
          "source": "https://artificialintelligenceact.eu/article/13/",
          "tier": "evidence"
        },
        {
          "name": "GOV.UK — Algorithmic Transparency Recording Standard Hub",
          "jurisdiction": "UK",
          "source": "https://www.gov.uk/government/collections/algorithmic-transparency-recording-standard-hub",
          "tier": "primary",
          "anchor": "atrs"
        },
        {
          "name": "OECD.AI — Designing transparency for government AI (UK ATRS)",
          "source": "https://oecd.ai/en/wonk/uk-algorithmic-transparency-recording-standard",
          "tier": "evidence"
        },
        {
          "name": "digital.gov.au — Standard for AI transparency statements",
          "jurisdiction": "AU",
          "source": "https://www.digital.gov.au/ai/ai-in-government-policy/standard-ai-transparency-statements",
          "tier": "primary",
          "anchor": "au-transparency-standard"
        },
        {
          "name": "DTA — AI Adoption: Built on trust, people, and tools",
          "jurisdiction": "AU",
          "source": "https://www.dta.gov.au/articles/ai-adoption-built-trust-people-and-tools",
          "tier": "primary"
        },
        {
          "name": "Yocco, V. — Identifying Necessary Transparency Moments In Agentic AI (Part 1)",
          "year": 2026,
          "source": "https://www.smashingmagazine.com/2026/04/identifying-necessary-transparency-moments-agentic-ai-part1/",
          "tier": "evidence",
          "anchor": "yocco-moments"
        },
        {
          "name": "IEEE 7014-2024 — Ethical Considerations in Emulated Empathy",
          "jurisdiction": "International (IEEE)",
          "year": 2024,
          "source": "https://standards.ieee.org/ieee/7014/7648/",
          "tier": "primary"
        }
      ],
      "assurance": "Government needs a user to be able to tell that they're dealing with AI, at the time it matters and not after the fact, so they can calibrate trust in what the agent is doing while it does it. The agency or service operator running the agent must trigger that disclosure at the decision point.",
      "access": "A dense transparency notice gets skimmed or abandoned by the people it should protect. A disclosure gate that demands acknowledgment before service deters them from the service itself.",
      "openings": [
        "Make disclosures scannable and skippable without penalty, and never gate access behind acknowledgment.",
        "Offer more than one format (text, audio, simplified visual), and let the user set a transparency level: brief, standard, detailed.",
        "Make the moment reachable by keyboard alone and dismissible without losing the user's place in the task.",
        "Treat transparency as no kind of liability shield: 'we told you it was AI' can never diminish the agency's duty of care to the person who couldn't parse the telling."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "TransparencyMoments",
            "annotation": "A standing transparency record is paired with disclosures that appear at the decision points where they can change what the user does."
          }
        ]
      },
      "whereThingsGoWrong": "Where this goes wrong is an invalid determination method kept out of sight from the people it bills. Mandatory upfront and event-driven disclosure of how a determination was reached exposes flawed logic instead of burying it. The disclosure requirement itself can be met in form only: a notice can satisfy the mandatory-disclosure rule to the letter while its length and jargon tell the person reading it nothing they can act on.",
      "framing": "Telling the user they are dealing with AI, what it can do, and what it is doing\nright now, at the moments that matter rather than in a terms page. The standing\nrecord lets an auditor confirm, after the fact, that the user was told.\n",
      "challenge": "Users cannot calibrate trust in what they cannot see. When an AI agent acts on a\ngovernment service, users need to know: that they are interacting with AI (not a human), what\nthe agent can and cannot do, what data it accesses, how it reaches decisions, and what\nrecourse exists if something goes wrong.\n\nDisclosure that sits buried in terms and conditions, or arrives as a technical data\nsheet, does neither job: the user has to meet it before relying on the agent, and\nhas to be able to read it once they do.\n",
      "precedentsNote": "**[EU AI Act Article 50](#s-ai-act-50), transparency obligations.** AI\nsystems interacting directly with people must disclose their AI nature in a\nclear and distinguishable manner, at the latest at the time of the first\ninteraction. High-risk systems must be sufficiently transparent for\ndeployers to interpret their outputs appropriately, under Article 13. The\ndisclosure is timed to the first interaction, and not left to the interface\nto place.\n\n**[UK Algorithmic Transparency Recording Standard](#s-atrs).** The template\nruns in two tiers: Tier 1 is a plain-language summary for the public, Tier\n2 is technical detail for specialists. It is mandatory for UK central\ngovernment, with more than 125 records published, and was co-designed with\nthe people who use it. One artifact serves two audiences at different\ndepths.\n\n**[Australian Standard for AI Transparency\nStatements](#s-au-transparency-standard).** Agencies must publish their\napproach to AI adoption in a consistent format, and the DTA is planning an\naddendum addressing agents that initiate actions. The statement is\nentity-level, and the addendum is the part that would reach an acting\nagent.\n\n**Yocco on [necessary transparency moments in agentic\nAI](#s-yocco-moments).** Yocco argues transparency\nshould be event-driven, surfaced at decision points, capability boundaries,\nand error conditions, rather than gathered on a static disclosure page.\nPlacing disclosure at the moment of consequence is what separates it from a\npage nobody opens.\n",
      "transferability": "**High transferability for the mechanism.** Proactive, comprehensible disclosure\nof an agent's nature and reach maps onto any government service, and a direct\ngovernment precedent already exists: the UK's two-tier transparency record (public\nsummary plus technical detail) is immediately adaptable elsewhere. A requirement\nfor upfront AI disclosure at first interaction sets a regulatory baseline that\nservices should meet or exceed.\n\n**Key adaptation for agents specifically:** static transparency records\n(ATRS-style) are necessary but insufficient for agents, which act dynamically.\nAgent transparency requires real-time disclosure: \"I am now accessing your tax\nrecords to check eligibility\" or \"I am about to submit this form on your behalf;\nthis action cannot be undone.\" The \"transparency moments\" framework provides the\ndesign vocabulary for this.\n"
    },
    {
      "id": "4.5",
      "title": "Communicating the level of automation",
      "territory": 4,
      "slug": "automation-level-communication",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For automation-level labeling in adjacent domains (automotive autonomy levels, open-banking consent), where the response is proven."
        },
        {
          "level": "frontier",
          "note": "As a public-facing scheme for government AI services, which remains proposed rather than operated."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "Parasuraman, R. & Riley, V. — Humans and Automation: Use, Misuse, Disuse, Abuse",
          "year": 1997,
          "source": "https://journals.sagepub.com/doi/10.1518/001872097778543886",
          "tier": "primary",
          "anchor": "parasuraman-riley"
        },
        {
          "name": "SAE J3016 — Taxonomy and Definitions for Terms Related to Driving Automation Systems",
          "jurisdiction": "Global",
          "year": 2021,
          "source": "https://www.sae.org/standards/content/j3016_202104/",
          "tier": "primary",
          "anchor": "sae-j3016"
        },
        {
          "name": "Open Banking Standards — Authentication Methods",
          "jurisdiction": "UK",
          "source": "https://standards.openbanking.org.uk/customer-experience-guidelines/authentication-methods/latest/",
          "tier": "primary",
          "anchor": "obuk-auth"
        },
        {
          "name": "ArXiv — Identity Management for Agentic AI",
          "source": "https://arxiv.org/pdf/2510.25819",
          "tier": "evidence",
          "caveat": "preprint",
          "anchor": "agentic-identity"
        },
        {
          "name": "OAIC — APP 1.7-1.9 automated-decision transparency (Privacy and Other Legislation Amendment Act 2024)",
          "jurisdiction": "Australia",
          "year": 2025,
          "source": "https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-1-app-1-open-and-transparent-management-of-personal-information",
          "tier": "primary",
          "anchor": "app-17"
        },
        {
          "name": "AI Playbook for the UK Government (GDS / DSIT)",
          "jurisdiction": "UK",
          "year": 2025,
          "source": "https://www.gov.uk/government/publications/ai-playbook-for-the-uk-government",
          "note": "The Accountability-and-responsibility section sets an answerability, auditability, and liability triad for government AI use and frames AI output as 'a statistically informed guess, not fact', an official UK articulation of where the automation boundary sits. Principle-level guidance, prescribing no concrete labeling scheme.",
          "tier": "primary"
        }
      ],
      "assurance": "Government needs a user to be able to tell how much of a given action a human decides versus a machine, in terms they can grasp without technical literacy. The label then addresses both misuse (over-reliance) and disuse (under-use) rather than leaving reliance to guesswork. The service or agency deploying the agent must assign that label and keep it accurate as the automation changes.",
      "access": "An abstract scheme like 'Level 2 supervised automation' means nothing to a stressed or low-literacy user. A label can be technically accurate and still leave someone's reliance miscalibrated if they can't parse it. That means they may follow a machine decision believing a person checked it first, or avoid a service altogether that a machine could have handled safely.",
      "openings": [
        "Use concrete, action-oriented language: 'a person will check this before it's final'.",
        "Test comprehension with low digital literacy, cognitive disability, and limited-English cohorts.",
        "Give an example of what each level means for this specific service, rather than in the abstract."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "AutomationLabel",
            "annotation": "How much of this action was automated is stated as one of three plain labels, shown before the user consents to it."
          }
        ]
      },
      "whereThingsGoWrong": "The failure mode is an automated decision presented as if a human exercised judgment, hiding the absence of meaningful review. Labeling determinations honestly as 'AI-decided' makes that absence legible to the people affected. The label itself can be gamed downward: a service can mark an action 'AI-recommended' when a reviewer only glances at the output, borrowing the credibility of the lighter label without doing the review it implies.",
      "framing": "Naming how much of an action a machine decides, in a plain label a user can\ngrasp at a glance. A user reading the label knows whether a person or a machine\nsettled the outcome they're about to rely on.\n",
      "challenge": "As agents capable of varying degrees of automation are deployed across government\nservices, the degree will differ from one service and action to the next, and the\ntools to build them are now widely available. Without a shared frame for naming\nthat degree, the same agent behavior reads as helpful efficiency to one user\nand as threatening opacity to another. Neither can tell how much a human\ndecides.\n",
      "precedentsNote": "**[Parasuraman and Riley](#s-parasuraman-riley) on use, misuse, disuse, and\nabuse.** The paper names four ways people and automation combine: use is\nvoluntary activation or disengagement, misuse is over-reliance producing\nmonitoring failures and decision bias, disuse is neglect commonly caused by\nalarms that fire falsely, and abuse is automating a function without regard\nfor the consequences for the person left holding what remains. Abuse is a\ndesigner's and manager's failure rather than an operator's, and the paper\nfinds it promotes the other two. Misuse and disuse are both addressable\nthrough clear automation-level signaling.\n\n**[SAE J3016](#s-sae-j3016) as a communication device.** Beyond its\ntechnical function, the levels framework succeeded as a communication tool:\n'Level 2' or 'Level 4' conveys meaningful information to non-experts.\n'Level 1: AI assists, you decide' is more comprehensible than 'supervised\nmachine-learning-augmented decision support'. A numbered scale survives\ntranslation into ordinary speech.\n\n**[APP 1.7-1.9](#s-app-17), automated-decision transparency.** The Privacy\nand Other Legislation Amendment Act 2024 legislates an automation-level\ndisclosure: a privacy policy must state which decisions are made solely by\na computer program and which are substantially assisted by one. The\ntrigger, decisions that 'significantly affect the rights or interests of an\nindividual', is broader than the GDPR Article 22 test of solely automated\nprocessing. The duty is up-front policy disclosure, and not a per-decision\nstatement of reasons.\n",
      "transferability": "**High transferability.** Government services suit a simple, public-facing\nautomation-level vocabulary. A three-level scheme is likely sufficient:\n\n- **\"AI-assisted\":** a human makes the decision; the AI helps gather and organize information.\n- **\"AI-recommended\":** the AI proposes a decision; a human reviews and approves it.\n- **\"AI-decided\":** the AI decides within defined rules; a human is available for review on request.\n\nThe open-banking consent pattern transfers well: before any agent action with\nconsequences, show the user what the agent will do, what data it will access,\nand offer explicit consent or decline.\n"
    },
    {
      "id": "4.6",
      "title": "Signaling human-in-the-loop oversight",
      "territory": 4,
      "slug": "human-in-the-loop-oversight-signaling",
      "maturity": "emerging",
      "maturityLevels": [
        {
          "level": "emerging",
          "note": "For the regulatory basis, where EU AI Act Article 14 and the Australian ADM consultation demand exactly this response."
        },
        {
          "level": "frontier",
          "note": "For credible implementation, where signaling real review rather than assurance theater remains undesigned."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "EU AI Act — Regulation (EU) 2024/1689, Article 14",
          "jurisdiction": "EU",
          "year": 2024,
          "source": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng",
          "tier": "primary",
          "anchor": "ai-act-14"
        },
        {
          "name": "University of Queensland — How to avoid algorithmic decision-making mistakes: lessons from Robodebt",
          "jurisdiction": "AU",
          "source": "https://stories.uq.edu.au/momentum-magazine/robodebt-algorithmic-decision-making-mistakes/index.html",
          "tier": "evidence",
          "anchor": "uq-lessons"
        },
        {
          "name": "Oxford Blavatnik School — Australia's Robodebt scheme: A tragic case of public policy failure",
          "jurisdiction": "AU",
          "source": "https://www.bsg.ox.ac.uk/blog/australias-robodebt-scheme-tragic-case-public-policy-failure",
          "tier": "evidence"
        },
        {
          "name": "Attorney-General's Department — Consultation paper: Use of automated decision-making by government",
          "jurisdiction": "AU",
          "source": "https://consultations.ag.gov.au/integrity/adm/user_uploads/consultation-paper-use-of-automated-decision-making-by-government.pdf",
          "tier": "primary",
          "anchor": "agd-consultation"
        },
        {
          "name": "Parasuraman, R. & Riley, V. — Humans and Automation: Use, Misuse, Disuse, Abuse",
          "year": 1997,
          "source": "https://journals.sagepub.com/doi/10.1518/001872097778543886",
          "tier": "primary",
          "anchor": "parasuraman-riley"
        },
        {
          "name": "Cloud Security Alliance — survey: 82% of enterprises have unknown AI agents",
          "jurisdiction": "Global",
          "year": 2026,
          "source": "https://cloudsecurityalliance.org/press-releases/2026/04/21/new-cloud-security-alliance-survey-reveals-82-of-enterprises-have-unknown-ai-agents-in-their-environments",
          "note": "Conducted by CSA in January 2026 with 418 IT and security professionals, and commissioned by Token Security, a vendor selling agent-identity products. A sponsored survey measuring the problem its sponsor sells against. Read the 82% as an indication that unmanaged agents are common, rather than as a calibrated rate.",
          "tier": "evidence",
          "anchor": "csa-survey"
        },
        {
          "name": "AI Playbook for the UK Government (GDS / DSIT)",
          "jurisdiction": "UK",
          "year": 2025,
          "source": "https://www.gov.uk/government/publications/ai-playbook-for-the-uk-government",
          "note": "Principle 4 and the Human-oversight section: UK GDPR Article 22 prohibits decisions based solely on automated processing that have legal or similarly significant consequences, requiring human input that is 'meaningful' and calibrated to impact and the need for specialist knowledge. An official UK-government statement of the oversight threshold, though general guidance rather than a shipped signaling pattern.",
          "tier": "primary"
        },
        {
          "name": "Schmitz, Rystrom & Batzner — Oversight Structures for Agentic AI in Public-Sector Organizations (REALM 2025)",
          "jurisdiction": "DE",
          "year": 2025,
          "source": "https://aclanthology.org/2025.realm-1.21/",
          "note": "A small single-country qualitative study (n=6), and one data point.",
          "tier": "evidence",
          "anchor": "schmitz"
        },
        {
          "name": "Digital Omnibus on AI — Regulation (EU) 2026/1744",
          "jurisdiction": "EU",
          "year": 2026,
          "source": "https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng",
          "tier": "primary",
          "anchor": "digital-omnibus"
        }
      ],
      "assurance": "Government needs a named human to remain answerable for a decision that affects a user, and needs that fact to be verifiable rather than assumed, so a user can see that the oversight is genuine review.",
      "access": "Users have a right to reach a human who can override the machine. However, an override pathway that assumes digital literacy denies human review to those who can't operate it. If the escalation mechanism is contained in a web form, it excludes those with low digital literacy.",
      "openings": [
        "Make the override process no harder than accepting the agent's output.",
        "Provide escalation that requires no digital literacy: telephone, in-person service centers.",
        "Disclose review-quality metrics ('decisions of this type receive an average of X minutes of officer review'), so an informed decision can be made."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "OversightSignal",
            "annotation": "Accountable human review is signaled before, during, and after the decision, naming the role that carried it out."
          }
        ]
      },
      "whereThingsGoWrong": "The harm to prevent flows from removing meaningful human review from automated decisions. Theater takes a specific shape here: an officer can open and close a case within seconds while the system still logs it as reviewed, and a metric that counts reviews rather than their duration or outcome will not catch the difference. A duration metric can be gamed in turn, a case held open until the threshold passes, so review time only means something when read alongside outcomes, such as the share of recommendations varied on review.\n\nCredible human-oversight signaling, with genuine metric-disclosed review and an accessible override, counters that harm directly, provided the signal reflects real oversight rather than theater.",
      "framing": "Making it clear, at every point in an agent-run decision, that a person\nreviews it. A user can tell whether that review is real.\n",
      "challenge": "Agents that can make a determination, or feed one to a caseworker, are now widely available,\nand as government runs high-stakes decisions through them the share of decisions touched by\nautomation grows. Whether a human still genuinely oversees each one, and who that human is,\nbecomes hard to tell from the outside.\n\nWhen that oversight is assumed rather than made legible, an approval given without real\nscrutiny looks the same as real review to the user it affects.\n",
      "precedentsNote": "**[EU AI Act Article 14](#s-ai-act-14).** High-risk AI systems must 'be\ndesigned with human-machine interface tools enabling effective oversight'.\nThe [Digital Omnibus](#s-digital-omnibus) deferred the Annex III compliance\ndeadline, so the forcing function is adopted law without a near-term date.\n\n**The [Attorney-General's Department consultation](#s-agd-consultation) on\nautomated decision-making.** The Attorney-General's Department\nconsulted on a framework requiring risk assessments before deployment,\nstronger safeguards for high-stakes decisions, a named human accountable\nwith power to review and override, and an entitlement to timely review of\nhigh-risk automated decisions. The named accountable human with override\npower is the concrete element.\n\n**[Parasuraman and Riley](#s-parasuraman-riley), with deployment data.**\nThe human-factors literature holds that automation serves people well only\nwhere reliance on it is calibrated, which makes human-AI collaboration\nrather than full automation the appropriate model. Oversight tooling lags\ndeployment: a [Cloud Security Alliance survey](#s-csa-survey) of 418 IT and\nsecurity professionals found 82 percent of enterprises already have\nunmanaged or unknown AI agents in their environments.\n\n**[Schmitz et al. on public-sector oversight structures](#s-schmitz), REALM.**\nInterviews with German civil servants found existing oversight is episodic\nand event-triggered rather than continuous, and that governance has to\ndiffuse toward the operational staff doing the work. The study describes an organizational condition, which no signal in the\ninterface reaches.\n",
      "transferability": "**Directly applicable, and treated as a requirement rather than an option where\nautomated decisions have caused documented harm.** Any government AI agent that\nmakes or contributes to decisions affecting users has to communicate the nature\nand extent of human oversight. In several jurisdictions this is a legal and\nethical requirement.\n\n**Proposed signaling pattern:**\n\n- **Before agent action:** \"This recommendation will be reviewed by [role] before any decision takes effect.\"\n- **During agent action:** \"Processing your information now. A [role] will review the outcome.\"\n- **After agent action:** \"Your [application/claim/request] has been reviewed by [named officer/role]. Here is the outcome and how to request further review.\"\n\nThe key principle is that intervention \"should not feel like an emergency\nfeature\": pause, edit, undo, and override should be integrated into primary\nworkflows, not hidden behind escalation procedures.\n"
    },
    {
      "id": "4.7",
      "title": "Earned trust and reversible delegation",
      "territory": 4,
      "slug": "earned-trust-reversible-delegation",
      "maturity": "frontier",
      "maturityNote": "For structured earned-trust frameworks, proposed for enterprise agent contexts by vendor and preprint sources with no adopted standard or documented deployment cited here, and not yet adapted to government-user interactions, where the power asymmetry differs from employer-employee or business-customer relationships.",
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "Agentic Trust Framework (Woodruff, via CSA blog)",
          "year": 2026,
          "source": "https://cloudsecurityalliance.org/blog/2026/02/02/the-agentic-trust-framework-zero-trust-governance-for-ai-agents",
          "tier": "evidence",
          "anchor": "csa-atf"
        },
        {
          "name": "ArXiv — Identity Management for Agentic AI",
          "source": "https://arxiv.org/pdf/2510.25819",
          "tier": "evidence",
          "caveat": "preprint",
          "anchor": "agentic-identity"
        },
        {
          "name": "DSB — CDR CX Guidelines: 90-day Notifications",
          "jurisdiction": "AU",
          "year": 2026,
          "source": "https://cx.dsb.gov.au/notifications/90-day-notifications",
          "tier": "primary",
          "anchor": "cdr-90day"
        }
      ],
      "assurance": "Government needs delegation to an agent to expand only on demonstrated use and to contract the moment a user wants it to. The agent must be demoted when it crosses a boundary, and revocation must be at least as easy as granting it. The platform or service operator must enforce that demotion and guarantee revocation parity.",
      "access": "A user whose agent has already acted badly, or who no longer wants it acting for them, is the one most likely to need this exit. If the non-agent pathway is slower or thinner, the right to revoke becomes a penalty for revoking. A trust history used as a precondition denies service to newcomers outright.",
      "openings": [
        "Start every user at the most conservative delegation level, regardless of any system-side trust assessment.",
        "Let users set their own delegation preferences independently of system recommendations.",
        "Guarantee the non-agent channel genuine parity of service quality and timeliness, so withdrawing the agent never costs the user the service."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "EarnedTrustControl",
            "annotation": "The delegation widens as the agent earns trust and contracts the moment the user asks, with leaving no harder than joining."
          }
        ]
      },
      "whereThingsGoWrong": "Where this goes wrong is a person caught in an erroneous automated process with no exit. Instant, penalty-free revocability and conservative defaults give that person a way to withdraw the agent and reach a human without losing service. The guarantee itself can be undermined without being formally broken: a system can re-offer the expanded scope on the next visit as though the revocation never happened, or bury the revoke control deep enough that only a persistent user finds it.",
      "framing": "Delegation that expands on demonstrated use and contracts the moment the user\nwants it gone. A user can withdraw delegation at any point without losing access\nto the outcome they came for.\n",
      "challenge": "Agents that can hold standing delegation and act over time are now widely\navailable. As government lets users delegate more to them, the amount of\nauthority a user has handed over deepens. That authority can outrun or outlast\nthe trust that justified it: an agent that keeps an expanded scope after a bad\nexperience, or one still acting under authority the user no longer wants it to\nhave.\n",
      "precedentsNote": "**[CSA Agentic Trust Framework](#s-csa-atf) maturity model.** The Intern,\nJunior, Senior, and Principal rungs treat trust as progressive and\nevidence-based: an agent earns greater autonomy through demonstrated trustworthiness rather\nthan time served, and can be demoted when it violates a trust boundary.\nDemotion is written into the model at every rung.\n\n**[CDR 90-day notifications](#s-cdr-90day) (Australia).** Under CDR Rule\n4.20, once 90 days have passed since the consumer gave a consent, amended\nit, used their dashboard, or was last notified, the data recipient must\nnotify them that the consent is still current, naming who holds it, for\nwhat purpose, and how to review it, and must deliver that notice outside\nthe consumer dashboard. Standard consents are capped at 12 months. A\nstanding authority the person has stopped thinking about is treated as a\nstate to be surfaced.\n\n**[Identity management for agentic AI](#s-agentic-identity).** The paper\nbinds a trust or delegation state to agent identity, so a level that\nexpands and contracts stays attached to the agent it describes. It is a\nproposal, with no deployment behind it.\n",
      "transferability": "**High transferability.** Pairing trust that an agent earns through use with\ndelegation a user can revoke instantly maps directly to government AI agents,\nand both halves have precedent (earned-trust maturity models in enterprise\ngovernance, instant revocability in open banking). A user who has successfully\nused an agent to check payment dates might let it pre-fill a renewal form. If the\npre-fill contains errors, they should be able to narrow the agent's scope at once\nor exit to a non-agent channel entirely.\n\n**Key design requirement:** revoking delegation must never result in service\ndegradation. A user who chooses not to use the AI agent must receive the same\nservice quality and timeliness as one who does. Otherwise, graduated delegation\nbecomes graduated coercion.\n"
    },
    {
      "id": "4.8",
      "title": "Declared automation on outbound decisions",
      "territory": 4,
      "slug": "declared-automation-on-outbound-decisions",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For the per-decision mention, in force and judicially enforced in France since 2016 under CRPA article L311-3-1, treated by the Conseil constitutionnel in 2020 as an obligation other provisions must satisfy."
        },
        {
          "level": "emerging",
          "note": "For the dated statutory duties either side of it: Australia's entity-level APP 1.7-1.9 disclosure commencing 10 December 2026, and EU AI Act Article 26(11), deferred to 2 December 2027."
        },
        {
          "level": "frontier",
          "note": "As a calibration instrument, stating the level of automation behind each decision in the service's own graded vocabulary, with a machine-readable duplicate for the person's agent, which no jurisdiction yet operates."
        }
      ],
      "status": "reviewed",
      "dependsOn": [
        "4.5"
      ],
      "seeAlso": [
        "4.4",
        "3.9"
      ],
      "precedents": [
        {
          "name": "Légifrance — Code des relations entre le public et l'administration, article L311-3-1",
          "jurisdiction": "FR",
          "year": 2016,
          "source": "https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000033205535",
          "tier": "primary",
          "anchor": "crpa"
        },
        {
          "name": "Conseil constitutionnel — Decision no. 2020-834 QPC (Parcoursup algorithms)",
          "jurisdiction": "FR",
          "year": 2020,
          "source": "https://www.conseil-constitutionnel.fr/en/decision/2020/2020834QPC.htm",
          "tier": "primary",
          "anchor": "cc-qpc"
        },
        {
          "name": "Privacy and Other Legislation Amendment Act 2024 (Cth), as passed — APP 1.7-1.9",
          "jurisdiction": "AU",
          "year": 2024,
          "source": "https://parlinfo.aph.gov.au/parlInfo/search/display/display.w3p;query=Id:%22legislation/bills/r7249_aspassed/0000%22",
          "tier": "primary",
          "anchor": "app-17"
        },
        {
          "name": "EUR-Lex — Regulation (EU) 2024/1689 (AI Act), Article 26(11)",
          "jurisdiction": "EU",
          "year": 2024,
          "source": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng",
          "note": "Deferred by the Digital Omnibus on AI to 2 December 2027, that date only. It is confined to Annex III systems, so the 2028 Annex I date never reaches it.",
          "tier": "primary",
          "anchor": "ai-act-26"
        },
        {
          "name": "Treasury Board of Canada — Directive on Automated Decision-Making (notice rows, all impact levels)",
          "jurisdiction": "CA",
          "source": "https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592",
          "tier": "primary",
          "anchor": "tbs-directive"
        }
      ],
      "assurance": "A person, and the agent reading on their behalf, needs to be able to tell from the decision artifact itself whether automation made the decision, materially shaped it, or merely assisted. The artifact should say which of these, using the same automation vocabulary the service publishes elsewhere. That per-decision declaration then has to be checkable against the agency's entity-level disclosures. The agency issuing the decision holds the duty to place the declaration on every outbound decision, to keep it accurate as the automation behind the decision class changes, and to keep it consistent with what its privacy policy and transparency statements claim.",
      "access": "When a declaration uses technical or legal vocabulary, it excludes readers with low literacy or numeracy, limited English, or cognitive load, at exactly the moment an adverse decision arrives. For them the mention becomes one more line of boilerplate, and their reliance stays miscalibrated at equal effort. A machine-readable declaration on its own tilts the other way, serving only whoever already has an agent to parse it.",
      "openings": [
        "Make the human-readable line primary and concrete: 'this assessment was produced automatically; no officer reviewed it before it was sent'.",
        "Render that line identically across every channel the decision travels, including phone scripts and paper.",
        "Comprehension-test it with low-literacy, limited-English, and cognitive-accessibility cohorts.",
        "Treat the machine-readable duplicate as an addition for the person's agent, never a substitute for the line a person can read.",
        "Make sure screen readers reach the declaration wherever it renders."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "AutomationDeclaration",
            "annotation": "Each decision carries its own declaration of what was automated and whether an officer reviewed it, rather than pointing at the policy behind it."
          }
        ]
      },
      "whereThingsGoWrong": "Undeclared, people rely on machine output as if a person had weighed their circumstances, and the absence of review is invisible until an error surfaces downstream. The declaration can be forged in the flattering direction: a decision stamped as officer-reviewed on the strength of a seconds-long open-and-close, borrowing the label's credibility for output no one weighed. It can also decay while every line stays honest: the per-decision declaration and the entity-level disclosures drift out of sync as the automation behind a decision class changes, until the person's agent reads one story on the decision and another in the policy. Keeping the declaration accurate, and the two layers consistent, is the duty that closes both gaps.",
      "framing": "The outbound decision itself declares what was automated and to what\ndegree, in a form both the person and their agent can read. Reliance can\nthen be calibrated decision by decision.\n",
      "challenge": "As agents come to issue more of government's outbound decisions, the person\nholding one will be less and less able to tell, from the artifact itself,\nwhether and how far automation produced it. The disclosure duties now\narriving are entity-level: a privacy policy states the kinds of decisions a\ncomputer program makes somewhere in the organization, a fact the person will\nnever connect to the letter in their hand. Reliance then miscalibrates in\nboth directions at once: machine output is trusted as if an officer weighed\nit, or every notice is distrusted because none says who decided.\n\nThe first reader of an outbound decision may be the\nperson's own agent, deciding whether to flag, contest, or act on it. A declaration\nburied in prose serves that reader as poorly as boilerplate serves a human\none; without a per-decision, machine-checkable declaration, the receiving\nagent must guess at the very fact it needs to calibrate.\n",
      "precedentsNote": "**[France, CRPA article L311-3-1](#s-crpa), the mention on the individual\ndecision.** The article requires an individual decision taken on the basis\nof algorithmic processing to include an explicit mention informing the\nperson, with the processing rules and the principal characteristics of its\nimplementation communicated on request. The [Conseil\nconstitutionnel](#s-cc-qpc) treats the obligation as live law that an\nadmissions-secrecy provision had to satisfy. Decision-level declaration is\noperating practice in one jurisdiction.\n\n**[Australia, APP 1.7-1.9](#s-app-17), the entity-level baseline.** The\nPrivacy and Other Legislation Amendment Act 2024 requires a privacy policy\nto disclose the kinds of personal information used by computer programs\nthat make decisions, the kinds of decisions made solely by them, and the\nkinds substantially assisted. A policy-level disclosure tells the\npopulation that automation exists. It cannot tell the person that\nautomation produced the decision they are holding.\n\n**[EU AI Act Article 26(11)](#s-ai-act-26), deployer notice to the\nperson.** Deployers of Annex III high-risk systems that make or assist\ndecisions about natural persons must inform those persons that they are\nsubject to the system. It is adopted law with a commencement date, and\noperating practice nowhere.\n\n**[Canada's Directive on Automated Decision-Making](#s-tbs-directive),\nnotice through every channel.** The Directive requires plain-language\nnotice that a decision will be undertaken wholly or in part by an automated\nsystem, at every impact level, through all service delivery channels in\nuse. Channel parity is written into the duty rather than left to\nimplementation.\n",
      "transferability": "The French mention proves the per-decision declaration is administrable at\nnational scale: the line has been mandatory on every covered decision since\n2016, and the constitutional court has enforced the obligation's presence\nrather than treating it as decoration. Canada's channel rule and Australia's solely-versus-substantially\ndistinction both transfer directly as content for the declaration: together\nthey supply the where (every channel, every covered decision) and the what\n(which grade of automation acted).\n\nWhat breaks in transit is the reader. Every existing instrument addresses a\nhuman reader; none contemplates the person's own agent as the first consumer\nof the declaration, so the machine-readable duplicate, its format, and its\nbinding to the human-readable line are undesigned. The declaration also does\nonly its own job: it states that and how far automation acted. The\nreasons behind the decision, any path to contest it, and whether it\narrives before or after the decision takes effect are a separate duty\nthis declaration feeds into, not something it provides itself.\n"
    },
    {
      "id": "5.1",
      "title": "Rate limits per verified person",
      "territory": 5,
      "slug": "per-verified-human-rate-limits",
      "maturity": "emerging",
      "maturityLevels": [
        {
          "level": "emerging",
          "note": "For the response in production: the NIH per-investigator cap has run since September 2025, explicitly motivated by AI-generated volume."
        },
        {
          "level": "frontier",
          "note": "For identity-bound caps across user-facing services, where threshold calibration and exemption design remain untested."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "NIH application cap (NOT-OD-25-132)",
          "jurisdiction": "US (NIH)",
          "year": 2025,
          "source": "https://grants.nih.gov/grants/guide/notice-files/NOT-OD-25-132.html",
          "tier": "primary",
          "anchor": "nih-cap"
        },
        {
          "name": "NIH Extramural Nexus — the Grant Support Index and the Next Generation Researchers Initiative",
          "jurisdiction": "US (NIH)",
          "year": 2026,
          "source": "https://grants.nih.gov/news-events/nih-extramural-nexus-news/2026/06/feedback-sought-proposal-to-cap-the-number-of-simultaneous-research-project-grants-per-principal-investigator-to-support-more-researchers-and-maximize-scientific-productivity-and-innovation",
          "tier": "primary",
          "anchor": "nih-gsi"
        }
      ],
      "assurance": "Government needs submission volume to reflect distinct people rather than agent throughput, so that the count measures genuine demand and not how many an agent filed on one person's behalf.",
      "access": "A cap tuned to the average submitter excludes people with several concurrent eligibility categories, such as multiple disabilities or complex family circumstances. They legitimately file more than most. A threshold set on the population's median denies them the very services their circumstances multiply their need for. The exemption route can also shut users out if proving 'documented circumstances' amounts to a second application on top of the first. Someone who cannot obtain a verified identity at all, for want of the underlying documents or a stable address, is refused the counter itself and denied the service before any cap even applies.",
      "openings": [
        "Calibrate caps against real need distributions rather than round numbers.",
        "Keep the exemption request one step from the quota meter itself.",
        "Hold open an assisted or in-person identity-verification route, so proving who you are doesn't become the actual barrier.",
        "Never apply caps to appeals or complaints: rationing redress raises natural-justice concerns no volume argument can answer."
      ],
      "surface": {
        "instances": [
          {
            "domain": "policy",
            "kind": "interactive",
            "component": "RateLimitMeter",
            "annotation": "A quota is bound to the person rather than to their device or session, with a visible route to an exemption."
          }
        ]
      },
      "whereThingsGoWrong": "A per-human cap is a volume-control mechanism, not an adjudication shortcut. The failure to avoid is throttling the very redress channel that surfaces wrongful decisions, because a cap tight enough to bite on appeals suppresses the evidence that the first decisions were wrong.",
      "framing": "A cap on how many submissions one verified person can make in a period. One\nperson with a fast agent can no longer crowd out the applicants who file by\nhand.\n",
      "challenge": "As AI tools drive the marginal cost of producing a submission toward zero, the\nvolume one person can generate keeps rising. A limit set per request or per\nsession stops catching it. Traditional throttling mechanisms (IP-based rate\nlimits, CAPTCHAs) cannot distinguish between a human who files one high-quality\napplication and an agent that files forty on behalf of the same person.\n",
      "precedentsNote": "**[NIH application cap](#s-nih-cap) (United States).** The National\nInstitutes of Health limits each Principal Investigator to six new,\nrenewal, resubmission, or revision applications per calendar year, across\nall activity codes except T-series training and R13 conference grants. The\npolicy was explicitly motivated by AI-generated proposals, after NIH\nobserved some investigators submitting more than 40 applications in a\nsingle round, and NIH declared that applications 'substantially developed\nby AI' would not be considered original. The cap reaches about 1.3 percent\nof applicants.\n\n**[NIH Grant Support Index](#s-nih-gsi), proposed and withdrawn.** Before\nthe application cap, NIH proposed an index assigning points to grant types,\nan R01 counting seven, with a ceiling of 21 points, or three concurrent R01\ngrants. The rationale was distributional, since a small share of\nresearchers held the bulk of NIH funding. NIH took a different path through\nthe Next Generation Researchers Initiative, so the index never took effect,\nand it returned to the distributional question with a fresh proposal to cap\nsimultaneous grants per investigator.\n",
      "transferability": "The NIH cap is directly transferable to government digital services where per-person\nsubmission volume matters: planning objections, freedom-of-information requests, public\nconsultation responses, grant or subsidy applications. The key design variables are:\n\n- **Identity binding:** Caps require verified identity to prevent circumvention via\n  multiple accounts. Government digital identity infrastructure (e.g. Australia's myGovID,\n  UK's GOV.UK One Login) provides a foundation.\n- **Threshold calibration:** The NIH cap at six per year affects only 1.3% of applicants,\n  preserving access for legitimate heavy users while curtailing outliers. Calibrating\n  thresholds requires empirical analysis of pre-AI submission distributions.\n"
    },
    {
      "id": "5.2",
      "title": "Structured intake that resists volume-padding",
      "territory": 5,
      "slug": "structured-intake-resisting-volume-padding",
      "maturity": "emerging",
      "maturityLevels": [
        {
          "level": "established",
          "note": "As a form design principle."
        },
        {
          "level": "emerging",
          "note": "As a deliberate anti-AI-padding strategy."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [
        "1.5"
      ],
      "precedents": [
        {
          "name": "ATO Business Activity Statement (GST reporting)",
          "jurisdiction": "AU",
          "year": 2025,
          "source": "https://www.ato.gov.au/businesses-and-organisations/preparing-lodging-and-paying/business-activity-statements-bas/goods-and-services-tax-gst/gst-reporting-methods",
          "tier": "primary",
          "anchor": "ato-bas"
        }
      ],
      "assurance": "Government needs to assess an application on verifiable data tied to external sources, not on the volume or fluency of supporting narrative, so that an agent's ability to generate plausible prose does not raise an applicant's apparent merit.",
      "access": "Structure excludes at its edges. The user whose circumstances don't fit the predefined categories is often the user facing the most complex hardship. The form pushes them to misdescribe their situation or abandon it entirely. The same fields that resist padding cause this exclusion.",
      "openings": [
        "Put a 'my situation doesn't fit these options' escape hatch on every structured intake.",
        "Route that hatch to a human rather than to a rejection, and treat it as a first-class outcome of the form rather than an error state.",
        "Make every field operable by keyboard and assistive technology; date pickers and conditional branching are classic screen-reader traps."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "ConstrainedIntake",
            "annotation": "Constrained fields and links to existing records carry the assessment, and a case that does not fit them goes to a person."
          }
        ]
      },
      "whereThingsGoWrong": "The failure mode is an automated process drawing adverse inferences from data the person could not contest. Anchoring assessment to verified external data and providing a human-review escape hatch prevents that. An agent can still game the fields that remain, selecting real but misleading combinations of the constrained options to steer toward a favorable outcome rather than an accurate one. Structured fields verify that the data exists; they don't verify that the applicant chose the fields that describe their actual circumstance.",
      "framing": "An intake built from constrained, verifiable fields instead of free narrative,\ntying assessment to data rather than to how the application reads.\n",
      "challenge": "As agents make it costless to generate lengthy, plausible-sounding narrative, an\nassessment system that weighs volume or detail of supporting narrative starts\nrewarding whoever's agent writes most persuasively, not whoever's circumstances\nare most genuine. Free-text forms are trivially padded this way, meeting\nsurface-level quality thresholds without reflecting genuine human circumstances.\n",
      "precedentsNote": "**[The ATO business activity statement](#s-ato-bas).** Financial regulators\nand planning authorities have long used constrained fields, drop-downs,\nbounded numeric ranges, and mandatory document attachments, because they\nare harder to fabricate than narrative. The activity statement reports tax\nthrough defined numeric labels, G1 for total sales, 1A for GST on sales, 1B\nfor GST on purchases, each tied to records the agency can check. A field\nthat must reconcile against a source is not padded by writing more.\n",
      "transferability": "Structured intake is highly transferable but requires careful design:\n\n- **Field constraints** (drop-downs, date pickers, document-upload requirements) create\n  verifiable data points that are harder to fabricate than free text.\n- **Conditional logic** (showing questions based on prior answers) makes bulk template\n  generation harder because the path through the form varies.\n- **Evidence requirements** tied to external data sources (tax file number, Medicare\n  record, employer) shift verification from narrative to data.\n- **Risk:** Over-structuring intake can itself become sludge for people whose\n  circumstances do not fit neatly into pre-defined categories.\n"
    },
    {
      "id": "5.3",
      "title": "Proof of personhood without CAPTCHAs",
      "territory": 5,
      "slug": "proof-of-personhood-alternatives-to-captcha",
      "maturity": "emerging",
      "maturityLevels": [
        {
          "level": "frontier",
          "note": "For biometric approaches, deployed at scale by a private venture with no government adopter, and restricted by regulators in Kenya and Spain."
        },
        {
          "level": "emerging",
          "note": "For the cryptographic, privacy-preserving response this pattern proposes, workable today but not yet a settled government practice."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [
        "1.4"
      ],
      "precedents": [
        {
          "name": "W3C — Inaccessibility of CAPTCHA",
          "jurisdiction": "W3C",
          "year": 2021,
          "source": "https://www.w3.org/TR/turingtest/",
          "tier": "primary",
          "anchor": "w3c-captcha"
        },
        {
          "name": "World ID / Worldcoin",
          "jurisdiction": "Global",
          "year": 2025,
          "source": "https://world.org/world-id",
          "tier": "evidence",
          "anchor": "world-id"
        },
        {
          "name": "Vitalik Buterin — biometric proof of personhood",
          "year": 2023,
          "source": "https://vitalik.eth.limo/general/2023/07/24/biometric.html",
          "tier": "evidence",
          "anchor": "buterin"
        },
        {
          "name": "Kenya High Court — Worldcoin biometric data ruling",
          "jurisdiction": "Kenya",
          "year": 2025,
          "source": "https://cipit.strathmore.edu/kenya-high-courts-worldcoin-determination-upholding-consent-accountability-and-data-sovereignty-in-biometric-data-processing/",
          "tier": "evidence",
          "anchor": "kenya-ruling"
        },
        {
          "name": "Spain AEPD — Worldcoin precautionary measure",
          "jurisdiction": "Spain",
          "year": 2024,
          "source": "https://www.aepd.es/en/press-and-communication/press-releases/agency-orders-precautionary-measure-which-prevents-Worldcoin-from-continuing-toprocess-personal-data-in-spain",
          "tier": "primary",
          "anchor": "aepd"
        },
        {
          "name": "Privacy Pass (RFC 9578 / RFC 9577)",
          "jurisdiction": "IETF",
          "year": 2024,
          "source": "https://www.rfc-editor.org/rfc/rfc9578.html",
          "tier": "primary",
          "anchor": "privacy-pass"
        },
        {
          "name": "IETF — Rate-Limited Token Issuance Protocol (draft)",
          "jurisdiction": "IETF",
          "year": 2024,
          "source": "https://datatracker.ietf.org/doc/draft-ietf-privacypass-rate-limit-tokens/",
          "tier": "evidence"
        },
        {
          "name": "New Zealand Government — CAPTCHA and accessibility",
          "jurisdiction": "NZ",
          "year": 2025,
          "source": "https://www.digital.govt.nz/standards-and-guidance/design-and-ux/accessibility/captcha-and-accessibility",
          "tier": "primary",
          "anchor": "nz-captcha"
        }
      ],
      "assurance": "Government needs to confirm that a request comes from a real, distinct human without running an identity dragnet or collecting biometric data, so that bot abuse is curbed while the person keeps their pseudonymity.",
      "access": "Device-bound attestation assumes a personal, recent device. Users on shared, borrowed, or older hardware are denied outright. Any CAPTCHA fallback re-imposes the denial of service the W3C documents for people with disabilities. No one must ever lose access to government for a well-founded refusal to hand over an iris scan.",
      "openings": [
        "Hold a non-device pathway at parity: in-person verification that mints the same time-limited token.",
        "Make no CAPTCHA modality the only route.",
        "Have the token attest nothing but personhood, so the pseudonymous stay pseudonymous."
      ],
      "surface": {
        "instances": [
          {
            "domain": "service",
            "kind": "interactive",
            "component": "PersonhoodToken",
            "annotation": "Human presence is confirmed in the background, with an in-person route offered alongside, in place of the visual puzzle that locks out people with disabilities."
          }
        ]
      },
      "whereThingsGoWrong": "This is an access-gating pattern; the failure to avoid is an automated personhood check that excludes people who cannot pass it. No notice is given, and there is no route to review. A mandatory non-device fallback is the safeguard against that exclusion. A device-attested or in-person token can still be coerced or resold: someone can be paid or pressured to mint one and hand it over, or a compromised device can mint tokens on someone else's behalf. Binding each token to a single origin and a strict per-period rate limit caps what a resold or coerced token is worth, though it does not stop the coercion itself.",
      "framing": "Confirming a real, distinct human is behind a request, without a puzzle that machines now\nbeat and many disabled people never could. The service keeps out bulk automation\nwithout turning away the disabled users the old puzzles excluded.\n",
      "challenge": "As agents defeat the challenge tests that once both blocked bots and rationed access by\nfriction, government has to confirm a real, distinct human is behind the request without\nfalling back on a method that shuts people out.\n\nThe old test fails on both sides: AI has defeated most CAPTCHA types, and the test itself\nexcludes people with disabilities. The W3C's \"Inaccessibility of CAPTCHA\" working note\nrecords that \"the very nature of the interactive task inherently excludes many people with\ndisabilities, resulting in a denial of service to these users.\"\n",
      "precedentsNote": "**[World ID](#s-world-id), biometric proof of personhood.** The system uses\niris scans taken on a proprietary device to generate cryptographic proof\nthat a user is a unique human, with zero-knowledge proofs verifying\npersonhood without revealing identity. [Buterin](#s-buterin) warned that\nstrict one-person-one-ID systems threaten pseudonymity and could be\ndefeated by fakes built to fool the device or by coerced scans. The design\ncreates a centralized registry of the most sensitive data there is.\n\n**Regulatory action against World ID.** [Kenya's High\nCourt](#s-kenya-ruling) found the collection of biometric data unlawful and\nordered the data deleted within seven days, and [Spain's AEPD](#s-aepd)\nordered Tools for Humanity to stop collecting and processing personal data\nin Spain and to block what it already held. Brazil's ANPD ended the\npractice of paying people in cryptocurrency for their biometric data, and\nat least eight countries have banned, suspended, or restricted operations.\nThe mechanism works and has been stopped by regulators in several\njurisdictions on data-protection grounds.\n\n**[Privacy Pass and Private Access Tokens](#s-privacy-pass).** The\nIETF-standardized protocol, developed by Cloudflare, Apple, Google, and\nFastly, lets a user prove they are human without revealing identity, with\nApple's Private Access Tokens attesting legitimacy from the device's secure\nenclave. Extensions cover per-origin rate-limited tokens and credentials\npresentable a fixed number of times per context. It avoids the biometric\nregistry, at the cost of device binding and platform dependency.\n\n**[W3C on the inaccessibility of CAPTCHA](#s-w3c-captcha).** The Group\nDraft Note states that the interactive task 'inherently excludes many\npeople with disabilities, resulting in a denial of service to these users',\nand the Accessible Platform Architectures Working Group recommends\nnon-interactive approaches where possible and a choice of modalities where\ninteractive verification is required. The [New Zealand\nGovernment's](#s-nz-captcha) accessibility guide gives the same direction\nfor government services. The incumbent check is documented by the web's own\nstandards body as excluding.\n",
      "transferability": "The transferable principle for government digital services is to verify human presence with\na privacy-preserving, rate-limited token rather than a challenge test or a biometric\nregistry. The rate-limited token model (Privacy Pass and related schemes) shows that\nprinciple:\n\n- It does not require biometric data collection.\n- It builds on existing device attestation infrastructure.\n- It can be layered onto existing government identity systems (myGovID, GOV.UK One Login)\n  to provide rate-limited but privacy-preserving access.\n- The IETF (Internet Engineering Task Force) standardization provides an interoperable\n  foundation.\n\nBiometric proof-of-personhood is unlikely to be appropriate for government services in\ndemocratic jurisdictions, given regulatory hostility and the surveillance implications.\n"
    },
    {
      "id": "5.4",
      "title": "Participatory budgeting as an alternative to rationing",
      "territory": 5,
      "slug": "participatory-budgeting-platforms-as-rationing-alternatives",
      "maturity": "emerging",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For allocating by deliberated community priority."
        },
        {
          "level": "emerging",
          "note": "As a deliberate response to AI-enabled gaming of effort- or quality-based rationing."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "Decidim (Barcelona)",
          "jurisdiction": "ES",
          "year": 2016,
          "source": "https://participedia.net/case/decidim-participatory-budgeting-in-barcelona",
          "tier": "evidence"
        },
        {
          "name": "Decidim (open-source framework)",
          "jurisdiction": "ES",
          "year": 2016,
          "source": "https://github.com/decidim/decidim",
          "tier": "primary",
          "anchor": "decidim"
        },
        {
          "name": "Consul Democracy (Decide Madrid)",
          "jurisdiction": "ES",
          "year": 2015,
          "source": "https://consuldemocracy.org/about-us/",
          "tier": "evidence",
          "anchor": "consul"
        },
        {
          "name": "Consul — UN Public Service Award",
          "jurisdiction": "ES",
          "year": 2018,
          "source": "https://oecd-opsi.org/innovations/consul-project/",
          "tier": "primary"
        },
        {
          "name": "Consul Democracy Foundation",
          "jurisdiction": "NL",
          "year": 2019,
          "source": "https://www.access-info.org/2019-04-17/access-info-europe-helps-create-the-consul-democracy-foundation/",
          "tier": "evidence",
          "anchor": "consul-foundation"
        }
      ],
      "assurance": "Each vote counted toward the allocation must be confirmed as coming from one distinct, eligible resident, to a confidence that holds even when an agent could generate synthetic support at volume. The municipality or agency running the platform carries that duty. The vote runs on an identified channel, and the condition is the franchise rather than an integrity bar: an allocation of a community's own budget is settled by that community, so eligibility is what a vote means. Proposing and commenting are views, owed consideration on their own terms, so the platform can take them on an open channel and leave the eligible vote to decide the allocation. Say which condition each side runs under.",
      "access": "The stakes here are collective. A resident kept off the platform by poor connectivity or language barriers doesn't just lose a transaction. They cannot propose or vote, and the resulting allocation reflects only those who could take part, so they live under priorities others set. That exclusion compounds every budget round.",
      "openings": [
        "Run an in-person and assisted channel at parity with the digital one, following the precedent of the original Porto Alegre assemblies.",
        "Take proposals and votes on paper and by phone.",
        "Weight nothing by channel: a ballot cast at a community meeting counts exactly as one cast on the platform."
      ],
      "surface": {
        "instances": [
          {
            "domain": "service",
            "kind": "interactive",
            "component": "ParticipatoryBudget",
            "annotation": "Residents rank projects against a published budget, with verified-identity voting online and an in-person channel running beside it."
          }
        ]
      },
      "whereThingsGoWrong": "Participatory budgeting allocates contested public resources by visible community consent rather than opaque automated scoring, so it does not produce an unexplained automated decision against an individual that they cannot see or contest. Astroturfing is this pattern's own gaming vector: an agent can generate synthetic comments and endorsements behind real, individually verified accounts, manufacturing the appearance of broad support for a proposal. Identity-bound voting caps how many votes any one resident casts; it does not stop an agent from producing the deliberation content itself.",
      "framing": "Rationing a scarce public resource by what the affected community deliberately\nprioritizes, rather than by who produces the most polished application.\nDeliberation is a signal agents can't manufacture, so the allocation stays tied to\nwhat affected people want.\n",
      "challenge": "When AI agents let anyone produce a polished application or flood a process at\nwill, the usual ways of rationing scarce public resources start to fail. Official\ndiscretion, price, and queue come to reward whoever has the best agent rather than\nthe strongest claim.\n\nWhat remains is running deliberation at scale without it becoming the next thing\nagents game.\n",
      "precedentsNote": "**[Decidim](#s-decidim), Barcelona's digital democracy platform.** Barcelona's digital democracy\nplatform allocated up to EUR 75 million, five percent of the overall\nbudget, through participatory processes across four years, a figure later\nreduced during the pandemic. It carries resident proposals with comments\nand endorsements, phased deliberative processes, participatory budgeting\nwith project sheets and public voting, and accountability dashboards\ntracking implementation. A city has rationed part of a real municipal\nbudget by resident deliberation, across several budget cycles.\n\n**[Consul Democracy](#s-consul) (Madrid).** Madrid's municipality launched\nthe platform as Decide Madrid, and it supports proposals, consultations,\nvoting, participatory budgets, and collaborative legislation. The [Consul\nDemocracy Foundation](#s-consul-foundation) counts roughly 350 governments\nand civil society organizations that have used it, a cumulative count\nrather than a live deployment tally, while the OECD puts current reach\nabove 100 governments. The same allocation model is running in more than a\nhundred governments on the OECD's count, and not in one city alone.\n",
      "transferability": "Participatory budgeting platforms are transferable as rationing mechanisms where:\n\n- Resources are geographically bounded (local infrastructure, community grants).\n- Trade-offs are value-laden rather than purely technical (where to build a park, which\n  programs to fund).\n- Legitimacy requires visible community consent.\n\nIn an AI-agent context, these platforms face a specific risk: agents could generate\nsynthetic support for proposals (astroturfing via participatory budgeting). Both Decidim\nand Consul require identity verification for voting, but the quality of that verification\nvaries by deployment. The platforms' strength is that they shift the rationing question\nfrom \"who can produce the best application\" to \"what does the community collectively\nprioritize\", which is less susceptible to AI gaming than narrative quality.\n"
    },
    {
      "id": "5.5",
      "title": "E-petition threshold design",
      "territory": 5,
      "slug": "e-petition-threshold-design",
      "maturity": "emerging",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For threshold mechanisms."
        },
        {
          "level": "emerging",
          "note": "For adaptation toward AI-resistant design."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "UK Parliament e-petitions",
          "jurisdiction": "UK",
          "year": 2026,
          "source": "https://petition.parliament.uk/help",
          "tier": "primary",
          "anchor": "uk-epetitions"
        },
        {
          "name": "We the People (US)",
          "jurisdiction": "US",
          "year": 2016,
          "source": "https://www.pewresearch.org/internet/2016/12/28/the-background-of-the-we-the-people-website/",
          "tier": "evidence",
          "anchor": "we-the-people"
        },
        {
          "name": "We the People (source code)",
          "jurisdiction": "US",
          "year": 2013,
          "source": "https://github.com/WhiteHouse/petitions",
          "tier": "evidence"
        },
        {
          "name": "Petitioning the Assembly — Parliament of NSW",
          "jurisdiction": "AU (NSW)",
          "source": "https://www.parliament.nsw.gov.au/parliamentary-business/legislative-assembly/petitioning-the-assembly",
          "tier": "primary",
          "anchor": "nsw-petitions"
        },
        {
          "name": "NSW Legislative Assembly Standing Orders and Procedure Committee — ePetitions review",
          "jurisdiction": "AU (NSW)",
          "year": 2021,
          "source": "https://www.parliament.nsw.gov.au/ladocs/inquiries/2545/Report%206-57-%20Modernisation%20and%20reform%20of%20practices%20and%20procedures-%20ePetitions%20Review%20-%20October%202021.pdf",
          "tier": "primary"
        },
        {
          "name": "House of Representatives e-petition EN1041 (Declare a Climate Emergency)",
          "jurisdiction": "AU",
          "year": 2019,
          "source": "https://www.aph.gov.au/e-petitions/petition/EN1041",
          "tier": "primary",
          "anchor": "en1041"
        },
        {
          "name": "House of Representatives e-petition EN1938 (Royal Commission into Australian news media)",
          "jurisdiction": "AU",
          "year": 2020,
          "source": "https://www.aph.gov.au/e-petitions/petition/EN1938",
          "tier": "primary"
        },
        {
          "name": "House of Representatives petition rules",
          "jurisdiction": "AU",
          "source": "https://www.aph.gov.au/Parliamentary_Business/Petitions/House_of_Representatives_Petitions/Petition_Rules",
          "tier": "primary",
          "anchor": "hor-rules"
        }
      ],
      "assurance": "Government needs a petition's signal to reflect real collective concern among distinct people, so that the support behind it reads as genuine and not as volume an agent manufactured or a faction automated.",
      "access": "If a threshold is set for the national population, it dismisses small or marginalized communities. Their concern can be real and intense. It may still never reach the count, leaving them unheard. Verified-identity signing excludes minors and people without the documents behind a government login. They are counted out of the one instrument built to count them.",
      "openings": [
        "Offer an alternative qualification route: a lower threshold scoped to a defined affected population, or committee referral on demonstrated local impact.",
        "Set the identity bar for signing no higher than the decision requires.",
        "Provide an assisted route for those the login excludes."
      ],
      "surface": {
        "instances": [
          {
            "domain": "policy",
            "kind": "interactive",
            "component": "PetitionThreshold",
            "annotation": "A signing counter shows geographic spread and verification status alongside the total, treating the threshold as several signals rather than one inflating number."
          }
        ]
      },
      "whereThingsGoWrong": "Threshold design governs collective attention, not individual entitlements, so it is largely orthogonal to an adverse-decision failure. The relevant safeguard is verified-identity signing, which stops synthetic support from distorting which concerns receive a response.",
      "framing": "Setting the signature thresholds that convert public concern into government\nresponse. A threshold crossed by manufactured signatures forces a government\nresponse that no real breadth of concern asked for.\n",
      "challenge": "As agents can manufacture signatures at scale, a signature threshold stops standing for\nreal collective concern and starts measuring how much support a faction can automate. The\ncount that was meant to ration government attention toward issues that move many\npeople becomes something an agent can pad at will.\n",
      "precedentsNote": "**[UK Parliament e-petitions](#s-uk-epetitions).** The system runs two\ntiers: 10,000 signatures triggers a written Government response, and\n100,000 leads the Petitions Committee to consider scheduling a debate. It\nhas been criticized on the ground that a numerical threshold implies an\nissue's importance can be counted, that issues of national importance may\nnot attract enough signatures, and that volume rewards mobilization\ncapacity over the quality of an argument.\n\n**[We the People](#s-we-the-people) (United States).** The White House\nresponse threshold rose from 5,000 signatures to 25,000 and then to\n100,000, a twentyfold increase, while the 30-day signing window stayed put.\nDemand rather than quality is the reason of record for the first rise: the\nWhite House attributed it to the site's opening week, with more than 7,800\npetitions posted and more than 375,000 accounts created. Threshold\ninflation is the natural consequence of reducing friction in petition\ncreation.\n\n**[NSW Legislative Assembly petitions](#s-nsw-petitions).** Receipt is\nannounced in the House on the next sitting day, recorded in the Votes and\nProceedings, published in Hansard, and forwarded to the responsible\nMinister; at 500 or more signatures the Minister must respond to the Clerk\nwithin 35 calendar days, and that response is itself reported in the House.\nAt 20,000 ePetition signatures, or 10,000 on paper, a debate is triggered.\nOpening an ePetition needs the support of at least five people and a\nMember, which places a floor before the threshold ladder starts.\n\n**[Australian House of Representatives e-petitions](#s-en1041).** Two\nsourced instances show the volume the channel carries: e-petition EN1041\nclosed with 403,478 signatures and EN1938 with 501,128. The [House's\npetition rules](#s-hor-rules) set the intake contract, covering\nsubject-matter jurisdiction, an online form that enforces the rules at the\npoint of creation, and Petitions Committee vetting before publication. The\nrules are enforced when the petition is written, and not after it has\ngathered signatures.\n",
      "transferability": "E-petition threshold design is directly relevant to any government intake system that uses\nvolume as a proxy for legitimacy or priority:\n\n- **Thresholds must be dynamic**, adjusting to submission volumes and the prevailing cost\n  of generating support.\n- **Signature verification** must be tied to verified identity, not just email addresses.\n  The UK system requires a name, email, and postcode; AI agents could trivially generate\n  plausible combinations.\n- **Quality signals** should complement volume signals: geographic distribution of\n  support, diversity of supporting arguments, or evidence of deliberation.\n- **Response commitments** create accountability but also create an attack surface: a\n  committed response at a threshold lets adversaries use agents to force responses on\n  chosen topics.\n"
    },
    {
      "id": "5.6",
      "title": "Sludge audits and how they backfire",
      "territory": 5,
      "slug": "sludge-audit-frameworks-and-their-inversion",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For auditing administrative friction."
        },
        {
          "level": "frontier",
          "note": "For the inversion: deciding, before friction is removed, whether it rations or merely excludes, in a context where AI removes friction unilaterally."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "Sunstein — 'Sludge and Ordeals'",
          "jurisdiction": "US",
          "year": 2019,
          "source": "https://scholarship.law.duke.edu/dlj/vol68/iss8/6/",
          "tier": "primary"
        },
        {
          "name": "Sunstein — 'Sludge Audits' (Behavioural Public Policy)",
          "jurisdiction": "US",
          "year": 2020,
          "source": "https://www.cambridge.org/core/journals/behavioural-public-policy/article/abs/sludge-audits/12A7E338984CE8807CC1E078EC4F13A7",
          "tier": "primary",
          "anchor": "sludge-audits"
        },
        {
          "name": "Sunstein, 'Sludge: What Stops Us from Getting Things Done' (MIT Press)",
          "jurisdiction": "US",
          "year": 2021,
          "source": "https://mitpress.mit.edu/9780262045082/sludge/",
          "tier": "primary"
        },
        {
          "name": "USDA ERS — 'The Costs of Benefit Delivery in the Food Stamp Program'",
          "jurisdiction": "US",
          "year": 2008,
          "source": "https://ers.usda.gov/sites/default/files/_laserfiche/publications/85876/CCR-39.pdf",
          "tier": "primary",
          "anchor": "usda-ers"
        },
        {
          "name": "USDA FNS — 'Reaching Those in Need': state SNAP participation rates in 2022",
          "jurisdiction": "US",
          "year": 2025,
          "source": "https://fns-prod.azureedge.us/sites/default/files/resource-files/ear-snap-Reaching-Those-in-Need-2022.pdf",
          "tier": "primary"
        },
        {
          "name": "OECD / NSW — 'Fixing Frictions: Sludge Audits Around the World'",
          "jurisdiction": "OECD",
          "year": 2024,
          "source": "https://oecd-opsi.org/publications/fixing-frictions-sludge-audits-around-the-world/",
          "tier": "primary",
          "anchor": "oecd-frictions"
        },
        {
          "name": "Herd & Moynihan — 'Administrative Burden'",
          "jurisdiction": "US",
          "year": 2019,
          "source": "https://www.russellsage.org/publications/book/administrative-burden",
          "tier": "primary",
          "anchor": "herd-moynihan"
        },
        {
          "name": "UK Behavioural Insights Team",
          "jurisdiction": "UK",
          "year": 2010,
          "source": "https://www.bi.team/about-us/our-history/",
          "tier": "evidence",
          "anchor": "bit"
        },
        {
          "name": "myGov (Australia)",
          "jurisdiction": "AU",
          "year": 2024,
          "source": "https://architecture.digital.gov.au/design/mygov",
          "tier": "primary",
          "anchor": "mygov"
        },
        {
          "name": "DSB — CDR CX Guidelines: Withdrawal (data holder)",
          "jurisdiction": "AU",
          "year": 2026,
          "source": "https://cx.dsb.gov.au/consent-management/consent-management-data-holder/withdrawal",
          "tier": "primary",
          "anchor": "cdr-withdrawal"
        }
      ],
      "assurance": "Before agents strip a point of friction out, the agency running the audit needs a reliable, repeatable way to classify what that friction does. That classification has to be confirmed before the friction disappears, not after.",
      "access": "The people at risk sit downstream of the audit's mistakes. Remove a friction that was verifying eligibility with no record of that function, and the harm lands on those it protected. Some people rely on an in-person step, a phone call or a face-to-face appointment, to get their eligibility checked. An audit misreads exactly that step as pure delay, and removing it for speed removes their only route to a correct decision. Let an overwhelmed system reach for blanket caps, and the redirection lands on the cohorts least able to route around them.",
      "openings": [
        "Replace a rationing friction with a purpose-built, fairer mechanism rather than with nothing.",
        "Never answer overload with a cap on appeals or complaints: there is no fair way to ration redress, so the answer has to be capacity.",
        "Check who still relies on an in-person or assisted step before removing it, so clearing exclusionary friction doesn't relocate the exclusion somewhere less visible."
      ],
      "surface": {
        "instances": [
          {
            "domain": "service",
            "kind": "interactive",
            "component": "SludgeAudit",
            "annotation": "Each cataloged friction is classified as remove, replace, or preserve, so a friction doing real work gets a substitute rather than deletion."
          }
        ]
      },
      "whereThingsGoWrong": "The failure mode is friction imported into an automated system before anyone asks what function, if any, it serves. The sludge-audit inversion forces that burden analysis, whose absence lets a system impose an unexplained, unaccountable compliance burden on claimants.\n\nAn agency can also game its own audit: tagging a barrier it wants to keep as 'rationing' rather than 'exclusionary', or tagging an inconvenient check as 'exclusionary' to justify removing it, without ever running the burden analysis the inversion demands. A classification an agency makes about its own friction, with no one outside it checking the call, cannot be told apart from a rationalization for whatever the agency already intended to do.\n\nThe same discipline covers friction added after the audit: an agency answering agent volume can introduce a new barrier, label it bot security, and never classify it at all. That barrier might be a challenge test, an in-person requirement, or a degraded machine-readable channel. A barrier added under a security label owes the same burden analysis, what it rations and whom it excludes, as any friction the audit found in place.",
      "framing": "Auditing every point of administrative friction before agents strip it out, asking\nwhat it costs and what it was holding in place. Stripping friction without the\naudit also strips the rationing or reflection some of that friction performed.\n",
      "challenge": "As agents strip administrative friction out of a service unilaterally, they can\nclear a rationing step before anyone has audited whether it was doing a job. A\nfriction that only excluded people should go, but a friction that was rationing\nscarce capacity or verifying eligibility, without that function ever being\ndocumented, breaks something when it disappears with no replacement.\n\nTelling those apart before the friction is gone is the work: auditing each point of\nfriction not just for what it costs, but for what it was holding in place.\n",
      "precedentsNote": "**[Sunstein's sludge audit](#s-sludge-audits).** Sunstein introduced the\nsludge concept in 'Sludge and Ordeals' and set out the audit itself in\n'Sludge Audits': institutions should regularly catalog the costs of sludge\nand decide when and how to reduce it. Neither paper carries the SNAP\nfigures often attributed to them, which appear in the later book reporting\na study where the average application took more than five hours, including\ntwo trips to a local office and about USD 10.31 in out-of-pocket costs.\n\n**[USDA research behind the figures](#s-usda-ers).** An Economic Research\nService study of the food stamp program carries the same figures,\nsummarizing a 1999 study, and puts the out-of-pocket cost at 6 percent of\nan average monthly benefit, with each re-certification taking about half as\nmuch time again. USDA puts SNAP participation at 88 percent of eligible\npeople in fiscal 2022, its highest on record. More than one eligible person\nin ten still receives nothing.\n\n**[OECD International Sludge Academy](#s-oecd-frictions).** The OECD, with\nthe Government of New South Wales, ran an academy in which sixteen\ngovernment organizations from 14 countries completed sludge audits, out of\n22 governments taking part. The audit method is the NSW Government's, and\nthe resulting principles cover behavioral journey mapping, experience\nscoring, public engagement, and evaluation by randomized trial, A/B test,\nor before-and-after comparison. Equity, psychological costs, and temporal\ncosts are measured explicitly.\n\n**[Herd and Moynihan on administrative burden](#s-herd-moynihan).** The\nbook provides the framework underlying sludge audits, identifying learning\ncosts, compliance costs, and psychological costs. It demonstrates that\nadministrative burdens are 'the result of deliberate policy choices'. Where\na burden is an intentional rationing tool, removing it is a policy change\nand not a usability fix.\n\n**[myGov and the Data and Digital Government Strategy](#s-mygov)\n(Australia).** The\nplatform carries more than 20 million linked active accounts and serves as\nthe digital front door, and the Data and Digital Government Strategy\ncommits to stopping agencies asking for information another agency already\nholds. The same strategy reports a survey in which around two-thirds of\npeople said they often had to give the same information to different\ngovernment services more than once. The Government acknowledges a need to\nbalance usability against friction that safeguards security and fraud\nrisks.\n\n**[The Consumer Data Right sorts friction by\ndirection](#s-cdr-withdrawal).** CDR Rule 4.24 bars a data holder from\nadding 'any requirements to the authorisation process beyond those\nspecified in the data standards and these rules', from collecting extra\ninformation, from offering other services, or from referring to other\ndocuments. On withdrawal, the CX Guidelines require the consumer be advised\nto review the consequences before sharing stops, and endorse deliberate\nfriction such as a two-step withdrawal. Friction is prohibited where it\nhelps the institution keep the relationship, and prescribed where its\nabsence would cost the person a service.\n",
      "transferability": "The sludge audit framework is highly transferable and already being adopted\ninternationally. The critical adaptation for AI-agent contexts requires a new analytical\nstep, the sludge inversion question. For each friction point identified in an audit, ask:\n\n1. Is this friction purely exclusionary (sludge)? If so, remove it, and note that AI\n   agents will remove it regardless.\n2. Does this friction perform a legitimate rationing or verification function? If so,\n   replace it with a purpose-built mechanism (rate limit, structured intake, identity\n   verification) before AI agents render it moot.\n3. Does this friction create a beneficial \"pause for reflection\" (cooling-off periods,\n   mandatory consideration periods)? If so, preserve the pause but redesign it for an\n   agent-mediated context.\n"
    },
    {
      "id": "5.7",
      "title": "Appeal volume and overturn rate as early warning",
      "territory": 5,
      "slug": "uk-benefit-appeals-canary-in-the-coal-mine",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "emerging",
          "note": "As a documented phenomenon."
        },
        {
          "level": "frontier",
          "note": "As a deliberate design pattern that reads appeal volume and overturn rate together as an early-warning signal."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "MoJ Tribunal Statistics Quarterly (Oct-Dec 2025; figures above are that quarter's, superseded by Jan-Mar 2026)",
          "jurisdiction": "UK",
          "year": 2025,
          "source": "https://www.gov.uk/government/statistics/tribunals-statistics-quarterly-october-to-december-2025/tribunal-statistics-quarterly-october-to-december-2025--2",
          "tier": "primary",
          "anchor": "moj-tribunal"
        },
        {
          "name": "DWP fairness analysis (Universal Credit, Feb 2024)",
          "jurisdiction": "UK",
          "year": 2024,
          "source": "https://www.computerweekly.com/news/366616983/DWP-fairness-analysis-reveals-bias-in-AI-fraud-detection-system",
          "tier": "evidence",
          "anchor": "dwp-fairness"
        },
        {
          "name": "Amnesty International — 'Too Much Technology, Not Enough Empathy'",
          "jurisdiction": "UK",
          "year": 2025,
          "source": "https://www.amnesty.org/en/latest/news/2025/07/uk-governments-unchecked-use-of-tech-and-ai-systems-leading-to-exclusion-of-people-with-disabilities-and-other-marginalized-groups/",
          "tier": "evidence",
          "anchor": "amnesty"
        }
      ],
      "assurance": "The adjudicator needs to tell a genuine access correction from gaming or overload as appeal volume climbs, early enough to act on the cause rather than the symptom.",
      "access": "The appellants behind the volume are benefit claimants contesting decisions about their own income and care. Every response to rising volume lands hardest on them. A cap or new barrier denies them redress outright. Letting the backlog grow delays justice by queue, past the point of rescue for someone whose payment has stopped.",
      "openings": [
        "Never restrict access to appeals or complaints in response to volume.",
        "Size tribunal capacity to the true post-friction demand level.",
        "Treat a high overturn rate as the decision-quality alarm it is, so the fix lands on the first-instance decisions rather than on the people appealing them."
      ],
      "surface": {
        "instances": [
          {
            "domain": "service",
            "kind": "interactive",
            "component": "AppealsCanary",
            "annotation": "The share of appeals decided in the claimant's favor is shown beside the volume chart, so a rise in complaints is not read as abuse on its own."
          }
        ]
      },
      "whereThingsGoWrong": "A high overturn rate is exactly the signal an opaque automated decision suppresses. Publishing it turns a decision-quality failure into a visible, accountable metric. The published metric can itself be gamed: an adjudicator could narrow which cases reach a counted hearing, resolve weak decisions informally before they reach the record, or redefine what counts as 'cleared', so the published rate falls while decision quality does not improve. Reading the overturn rate alongside receipts and disposals, rather than on its own, is what catches a rate moved by reclassification rather than by better decisions.",
      "framing": "Reading appeal volume and overturn rate together as an early-warning gauge on\ndecision quality and access. A rise in appeals with most decided for the\nclaimant means the first decisions were wrong.\n",
      "challenge": "When AI tools make it easy to draft and lodge an appeal, appeal volume to a\ngovernment adjudicator can climb sharply. That can be a good thing, people exercising a right\nthat friction used to suppress, or a sign the underlying decisions are bad, or a load the\nsystem cannot meet.\n\nReading which it is, early, from the signals an adjudicator already has, separates a\ncapacity answer from a cap; a rise in appeals read as abuse gets capped, and the cap\nlands on redress itself.\n",
      "precedentsNote": "**[UK Social Security and Child Support tribunal\nstatistics](#s-moj-tribunal).** Ministry of Justice quarterly figures show\nUniversal Credit appeal receipts up 35 percent year on year, Disability\nLiving Allowance receipts up 64 percent, and Personal Independence Payment\nreceipts up 4 percent. Receipts have exceeded disposals over the latest\ntwelve months, the open caseload has risen about a quarter, and 58 percent\nof appeals cleared at hearing were overturned in the claimant's favor. An\noverturn rate that high points to systemic problems in initial decisions,\nand to friction that had been suppressing legitimate appeals.\n\n**The [DWP fairness analysis](#s-dwp-fairness) of Universal Credit.** A DWP fairness\nanalysis of Universal Credit claimants, released under Freedom of\nInformation, was reported as showing disparities across protected\ncharacteristics in an automated fraud-detection process. [A study of 782\nclaimants, welfare advisers, and others](#s-amnesty) found that with these\ndigital systems 'pre-existing flaws are being exacerbated, and new problems\n... are being created'. A department's own equity analysis reached the\npublic only through a disclosure request, so the warning the adjudicator\nreads downstream was available upstream and unpublished.\n",
      "transferability": "The UK benefit appeals pattern is a leading indicator for all government adjudication\nsystems. The transferable insights are:\n\n- **High overturn rates reframe the \"volume problem.\"** If the majority of appeals succeed,\n  the volume reflects too many poor initial decisions rather than too many appeals. The\n  policy response should focus on improving first-instance decision quality, not limiting\n  appeal access.\n- **AI drafting tools as access equalizer.** Where professional representatives previously\n  helped some claimants draft effective appeals, AI tools may extend similar capability to\n  all claimants, a distributional improvement.\n- **Tribunal capacity planning.** Systems must be designed for the post-friction volume\n  baseline, since the pre-AI baseline was artificially suppressed by friction.\n\nWhat is driving the rise in appeals has not been established. AI-assisted drafting is a\nhypothesis, and the gauge is worth reading whichever way that question resolves.\n"
    },
    {
      "id": "6.1",
      "title": "Clustering and deduplication for high-volume submissions",
      "territory": 6,
      "slug": "clustering-deduplication-views",
      "maturity": "emerging",
      "maturityLevels": [
        {
          "level": "emerging",
          "note": "For deployed comment-analysis tooling, where the CDO Council pilot and Regulations.gov generative-AI processing run in production contexts."
        },
        {
          "level": "frontier",
          "note": "For public transparency of the clustering itself, where participants can verify no substantive argument was lost."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [
        "6.4",
        "6.5"
      ],
      "precedents": [
        {
          "name": "CDO Council Public Comment Analysis Pilot",
          "jurisdiction": "US",
          "year": 2020,
          "source": "https://resources.data.gov/resources/cdoc_comment_analysis/",
          "tier": "primary",
          "anchor": "cdo-pilot"
        },
        {
          "name": "ICF / Regulations.gov Gen AI Comment Processing",
          "jurisdiction": "US",
          "year": 2024,
          "source": "https://www.icf.com/clients/technology/regulations-gov-gen-ai-public-comment-analysis",
          "tier": "evidence",
          "anchor": "icf-genai"
        },
        {
          "name": "Delib Citizen Space — Analyse Responses",
          "jurisdiction": "UK",
          "source": "https://help.delib.net/article/429-analysis-the-analyse-responses-page",
          "tier": "evidence",
          "anchor": "delib-analyse"
        },
        {
          "name": "Delib Citizen Space tour",
          "jurisdiction": "UK",
          "source": "https://www.delib.net/citizen_space/tour",
          "tier": "evidence"
        },
        {
          "name": "Parliamentary Joint Committee on Human Rights — Freedom of speech in Australia inquiry report (paras 1.5–1.7)",
          "jurisdiction": "AU",
          "year": 2017,
          "source": "https://www.aph.gov.au/~/media/Committees/Senate/committee/humanrights_ctte/FreedomspeechAustralia/Report.pdf?la=en",
          "tier": "primary",
          "anchor": "pjchr-18c"
        },
        {
          "name": "Senate Environment and Communications Committee — Tasmanian Wilderness World Heritage Area inquiry submissions",
          "jurisdiction": "AU",
          "year": 2014,
          "source": "https://www.aph.gov.au/Parliamentary_Business/Committees/Senate/Environment_and_Communications/Tasmanian_Wilderness_World_Heritage_Area/Submissions",
          "tier": "primary",
          "anchor": "senate-tasmania"
        }
      ],
      "assurance": "Government needs to read every distinct argument in a body of submissions without re-reading the duplicates that mass campaigns produce. A reviewer can then be confident no unique position was missed when the volume is too high to read each one. Confidence has to rest on what a submission argues, not on judging whether it was machine-written.",
      "access": "Semantic grouping tuned to fluent prose can mis-file a submission written in a second language or in plain, unpracticed words. That submission's distinct argument gets folded into a cluster where no reviewer ever reads it. Neither the reviewer nor the submitter can see this happen.",
      "openings": [
        "Deduplicate for analysis and never for exclusion: no submission leaves the record.",
        "Publish how the clustering was performed, so participants and the public can verify no substantive argument was lost.",
        "Sample clusters by hand, weighted toward the submissions least like the prose the model expects."
      ],
      "surface": {
        "instances": [
          {
            "domain": "service",
            "kind": "interactive",
            "component": "ClusterConsole",
            "annotation": "Submissions are grouped by similarity so a reviewer reads each distinct argument once, with nothing removed from the record."
          }
        ]
      },
      "whereThingsGoWrong": "Deduplication is analytical, not exclusionary, so on its own it creates no large-scale adverse harm. The safeguard is that clustering surfaces arguments for human review rather than substituting an automated decision for it.\n\nThe adversarial failure mode is that a language model can paraphrase one campaign into many superficially distinct submissions, defeating deduplication that keys on surface similarity and inflating the count of apparently independent voices. So an agency that treats that count as a tally reads manufactured breadth as genuine support.\n\nThe durable guard is refusing to treat volume as a vote: weighing submissions by the substance they add so distinct-looking duplicates buy little. Sharper clustering alone doesn't settle this: each detection improvement invites a subtler paraphrase in response, so clustering keeps losing ground on its own.",
      "framing": "Grouping a flood of submissions by what they argue, so a reviewer reads each\ndistinct argument once instead of the same template ten thousand times. It\nkeeps mass campaigns from inflating the record while giving reviewers and\nthe public confidence that no substantive position was missed.\n",
      "challenge": "Agencies can't meaningfully review each submission individually once volume\nreaches hundreds of thousands or millions of written submissions (public\ncomments, but equally consultation responses, grant applications, or\nplanning objections). Mass\nsubmission campaigns (historically postcard campaigns, now orchestrated online)\nproduce near-identical submissions that inflate raw counts without adding\nsubstantive argumentation. Reviewers need tools that surface distinct arguments\nrather than re-reading the same template thousands of times.\n",
      "precedentsNote": "**[CDO Council public comment analysis pilot](#s-cdo-pilot) (US).** The\nFederal Chief Data Officers Council, with OIRA and GSA, piloted\nnatural-language-processing tools that recognize topics, group semantically\nsimilar submissions, and surface them for subject-matter expert review. The\nreport's worked example collapsed 267 near-identical submissions to 9\ndistinct comments. The Council went on to publish recommendations for\nimplementing the tools across federal agencies.\n\n**[Generative AI comment processing on Regulations.gov](#s-icf-genai).**\nICF, working with GSA, has deployed generative AI to accelerate public\ncomment analysis, moving from spreadsheet-based manual review toward\nautomated clustering and theme extraction. The deployment sits on the US\nfederal rulemaking channel itself.\n\n**[Delib's Citizen Space analysis tools](#s-delib-analyse).** The platform offers tagging\nand coding of qualitative responses, cross-referencing across questions,\nand AI-assisted first-pass analysis identifying themes and sentiment. It is\nwidely used across UK, Australian, and New Zealand government\nconsultations. The clustering step is already procured infrastructure in\nthree jurisdictions.\n\n**The [Parliamentary Joint Committee on Human Rights](#s-pjchr-18c) intake\ntaxonomy.** The freedom of speech inquiry received approximately 11,460 items and\nsorted them three ways: 418 accepted as submissions and published, roughly\n10,590 categorized as form letters with one sample published alongside the\ncount, and around 452 accepted as correspondence, meaning a view expressed\nwithout substantive commentary. The [Tasmanian Wilderness\ninquiry](#s-senate-tasmania) received over 9,600 emails and form letters. A\nthree-way split already separates what is read individually from what is\ncounted from what is sampled.\n",
      "transferability": "High. Clustering and deduplication are infrastructure-level capabilities that any digital\nsubmission system should offer (the comment-analysis precedents transfer\ndirectly to grant, objection and petition intake). The CDO Council's approach is designed as\na reusable, federal-wide toolset and could be adapted by other jurisdictions.\n\nNone of the cited precedents publish their clustering methodology for outside\nverification. Methodology transparency doesn't transfer from CDO Council or\nDelib practice; it has to be designed into the deployment fresh.\n"
    },
    {
      "id": "6.2",
      "title": "Provenance and attribution for mass submissions",
      "territory": 6,
      "slug": "mass-comment-integrity-frameworks",
      "maturity": "emerging",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For problem recognition and verified-source intake, which are already in practice."
        },
        {
          "level": "emerging",
          "note": "For representative-version reporting and attribution of agent-assisted submissions at scale, which are still taking shape."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "ACUS Recommendation 2021-1: Mass, Computer-Generated, and Fraudulent Comments",
          "jurisdiction": "US",
          "year": 2021,
          "source": "https://www.acus.gov/sites/default/files/documents/Final%20Report%20on%20Mass,%20Computer-Generated,%20and%20Fraudulent%20Comments%20(Final%2006-01-2021)_0.pdf",
          "tier": "primary",
          "anchor": "acus-2021-1"
        },
        {
          "name": "ACUS Public Participation",
          "jurisdiction": "US",
          "source": "https://www.acus.gov/page/public-participation",
          "note": "ACUS's standing resource on public participation in rulemaking, collecting the recommendations and guidance behind its comment-integrity work.",
          "tier": "primary"
        },
        {
          "name": "ACUS Responding to Rulemaking Comments",
          "jurisdiction": "US",
          "year": 2025,
          "source": "https://www.acus.gov/sites/default/files/documents/40_Responding%20to%20Rulemaking%20Comments.pdf",
          "note": "A follow-up recommendation adopted at the 74th Plenary in April 2025, updating guidance on how agencies should respond to and manage the full range of comment types in the modern rulemaking environment.",
          "tier": "primary",
          "anchor": "acus-responding"
        },
        {
          "name": "Nextgov: House bill targets AI-generated comments (Comment Integrity and Management Act)",
          "jurisdiction": "US",
          "year": 2024,
          "source": "https://www.nextgov.com/artificial-intelligence/2024/05/house-bill-targets-ai-generated-comments-rulemaking/396419/",
          "note": "A House-passed bill (not enacted law; it lapsed with the 118th Congress) that would have required agencies to publish a single representative version of mass comments, publicly state the number of computer-generated submissions, and tasked the Office of Management and Budget (OMB) with guidance and the Government Accountability Office (GAO) with reporting on AI-generated comment prevalence.",
          "tier": "primary"
        },
        {
          "name": "GSA: Regulations.gov integrity updates",
          "jurisdiction": "US",
          "year": 2021,
          "source": "https://www.gsa.gov/about-us/newsroom/news-releases/gsa-launches-updated-regulationsgov-to-improve-the-integrity-of-public-commenting-02172021",
          "note": "The General Services Administration (GSA) relaunched Regulations.gov with a verified Bulk Comment API requiring identity validation, building transparency and accountability into the source of automated comments.",
          "tier": "primary",
          "anchor": "gsa-integrity"
        },
        {
          "name": "Pew Research Center: FCC net neutrality comment analysis",
          "jurisdiction": "US",
          "year": 2017,
          "source": "https://www.pewresearch.org/internet/2017/11/29/public-comments-to-the-federal-communications-commission-about-net-neutrality-contain-many-inaccuracies-and-duplicates/",
          "note": "The paradigmatic failure case. Pew found 94% of the 22 million comments in the FCC's net-neutrality docket were submitted multiple times; independent analysis (Jeff Kao) estimated only ~800,000 were likely original.",
          "tier": "evidence"
        },
        {
          "name": "NY Attorney General report on fake net neutrality comments",
          "jurisdiction": "US",
          "year": 2021,
          "source": "https://ag.ny.gov/press-release/2021/attorney-general-james-issues-report-detailing-millions-fake-comments-revealing",
          "tier": "evidence",
          "anchor": "nyag-report"
        },
        {
          "name": "NY Attorney General secures $615,000 from companies that supplied fake comments",
          "jurisdiction": "US",
          "year": 2023,
          "source": "https://ag.ny.gov/press-release/2023/attorney-general-james-secures-615000-companies-supplied-fake-comments-influence",
          "note": "A second round of settlements two years later, recovering US$615,000 from three further companies — LCX, Lead ID, and Ifficient — that supplied fake comments to the same FCC proceeding. Enforcement against the suppliers of a corrupted record arrives years after the decision that record was used to justify.",
          "tier": "evidence",
          "anchor": "nyag-settlements"
        },
        {
          "name": "TechCrunch: 80% of net neutrality comments were fake",
          "jurisdiction": "US",
          "year": 2021,
          "source": "https://techcrunch.com/2021/05/06/80-of-the-22-million-comments-on-net-neutrality-rollback-were-fake-investigation-finds",
          "note": "Reporting on the finding that roughly 80% of the 22 million net-neutrality comments were fake — the FCC's system validated only 3% of comments by email, leaving it open to mass fabrication.",
          "tier": "evidence"
        },
        {
          "name": "GAO-19-483: identity information in the comment process",
          "jurisdiction": "US",
          "year": 2019,
          "source": "https://www.gao.gov/products/gao-19-483",
          "note": "GAO found that the law does not require agencies to collect or verify commenter identity, and recommended that selected agencies clearly communicate their practices for handling identity information in the public comment process.",
          "tier": "evidence"
        },
        {
          "name": "GAO-21-103181: comment integrity",
          "jurisdiction": "US",
          "year": 2021,
          "source": "https://www.gao.gov/products/gao-21-103181",
          "tier": "evidence",
          "anchor": "gao-integrity"
        },
        {
          "name": "Australian Senate climate committee — submissions received as standard form letters",
          "jurisdiction": "AU",
          "year": 2009,
          "source": "https://www.aph.gov.au/Parliamentary_Business/Committees/Senate/Former_Committees/climate/submissions/sublist",
          "tier": "primary",
          "anchor": "senate-form-letters"
        },
        {
          "name": "Australian Senate Environment and Communications Committee — standard and form letters page (2008–10)",
          "jurisdiction": "AU",
          "year": 2010,
          "source": "https://www.aph.gov.au/Parliamentary_Business/Committees/Senate/Environment_and_Communications/Completed_inquiries/2008-10/tlaccs/zformletters/index",
          "note": "Senate environment committees maintain dedicated \"Standard and form letters\" pages for individual inquiries: the observable, standing listing convention behind Australian committees' form-letter handling, evidencing that the practice is routine rather than improvised per inquiry.",
          "tier": "primary",
          "anchor": "senate-standard-letters"
        }
      ],
      "assurance": "Government needs enough confidence in a body of submissions to act on it and stand behind the decision: that organized campaigns are identified and collapsed to a single representative entry with their size and organizer disclosed, that submissions filed through a verified route can be told apart from unverified ones, and that duplicates and automated filings are visible as such. The confidence comes from provenance and source validation. It doesn't come from judging whether a given submission was machine-written.",
      "access": "Legitimate coordinated advocates are the group most at risk. If campaign volume itself gets treated as suspect, a real constituency is collapsed out of the record the agency reads: its numbers stop counting, precisely because it organized. A submitter who can't or won't clear identity validation, because of limited connectivity, device access, or distrust of the process, can't be discounted by default.",
      "openings": [
        "Attribute a campaign rather than discarding it: one representative entry, a participant count, the organizer named.",
        "Give organizers a route to confirm authorship.",
        "Treat a submission filed outside the verified route as data for follow-up, never grounds for rejection, so source validation doesn't harden into an identity barrier."
      ],
      "surface": {
        "instances": [
          {
            "domain": "service",
            "kind": "interactive",
            "component": "CampaignProvenance",
            "annotation": "A campaign appears on the record as one attributed entry with its size and organizer disclosed, rather than as thousands of separate-looking submissions."
          }
        ]
      },
      "whereThingsGoWrong": "Absent public disclosure of the data's limits and provenance checks before acting, an organizer can inflate a campaign's participant count or file under fabricated identities to make it look larger than it is. If the representative entry for that campaign is never checked against its actual submissions, the inflated count drives a decision the agency can't later defend.",
      "framing": "Recovering who stands behind mass submissions: which campaign, how large, who\norganized it, and by what route each entry was filed. Decision-makers can see\nwhich campaign produced a flood of comments and how many distinct people stand\nbehind it.\n",
      "challenge": "Mass submissions corrupt a record in three distinct ways: the orchestrated campaign that\nfiles one position thousands of times, the computer-generated flood with no person behind\nit, and the malattributed filing made in a real person's name without their knowledge. As\nagents make all three cheap, each grows faster than any reviewer's ability to tell them\napart. The consultation record stops recording its own provenance.\n\nWhat the agency has to recover is attribution: which submissions belong to which campaign,\nwho organized it, and by what route each was filed, so it can report the record honestly\nand defend the weight it gave it. That means not discounting legitimate coordinated advocacy.\n\nThis is a problem of attribution at scale. It doesn't require detecting\nwhich submissions a machine wrote.\n",
      "precedentsNote": "**[ACUS Recommendation 2021-1](#s-acus-2021-1).** The Administrative\nConference of the United States separated three kinds of problematic\ncomment: mass comments orchestrated by campaign organizations,\ncomputer-generated comments, and malattributed comments filed using stolen\nor fabricated identities. It recommended practices for managing each while\npreserving the right to participate, and [returned to the\nsubject](#s-acus-responding) with guidance on responding to the full range\nof comment types. The three categories are distinguished by origin, and\nonly the third is fraud.\n\n**[GSA's Regulations.gov integrity updates](#s-gsa-integrity).** GSA\nrelaunched the federal comment portal with a bulk-comment API requiring\nidentity validation for organizations filing on behalf of others.\nProvenance is captured at the point of filing, which is what lets a\nverified route be told apart from an unverified one afterward.\n\n**[The New York Attorney General's investigation](#s-nyag-report).** The\ninvestigation found nearly 18 million of the 22 million comments in one\nfederal docket were fake, roughly 8.5 million of them using the names and\naddresses of real people without their knowledge, and [secured\nsettlements](#s-nyag-settlements) from the companies that supplied them.\nIdentity misuse at that scale was established by a law-enforcement\ninvestigation, and not by the docket's own controls.\n\n**[GAO on comment integrity](#s-gao-integrity).** Surveying ten agencies,\nGAO estimated the share of commenters whose email addresses confirmed their\nsubmissions ranged from 48 to 87 percent, and that 5 to 30 percent of\naddresses on the record were unverifiable. Agencies differ by a factor of two in how much of the record they can stand\nbehind.\n\n**[Australian Senate form-letter listings](#s-senate-form-letters).** The\nSenate climate-policy committee published its submission list under the\nheading 'Submissions received as standard form letters, including form\nletters with additional individual comments', and environment committees\n[maintain standing pages](#s-senate-standard-letters) for the same purpose.\nThe campaign is disclosed as a category of the official record, attributed\nrather than erased.\n",
      "transferability": "High, with jurisdictional adaptation. The US Administrative Procedure Act's (APA)\nnotice-and-comment framework is US-specific, but every jurisdiction running public\nconsultations faces the same structural challenge. The UK, Australian, and Canadian\ngovernments all encounter campaign responses and must decide how to report and\nweight them. The US Federal Communications Commission's (FCC) net-neutrality\ncomment flood is a cautionary tale with universal applicability: any system that\naccepts unverified submissions at scale is vulnerable to manipulation.\n"
    },
    {
      "id": "6.3",
      "title": "Opinion mapping by consensus and clustering",
      "territory": 6,
      "slug": "polis-consensus-clustering",
      "maturity": "emerging",
      "maturityNote": "Emerging (proven in multiple jurisdictions but not yet mainstream government practice)",
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "MIT Technology Review: Taiwan's crowdsourcing system",
          "jurisdiction": "Taiwan",
          "year": 2018,
          "source": "https://www.technologyreview.com/2018/08/21/240284/the-simple-but-ingenious-system-taiwan-uses-to-crowdsource-its-laws/",
          "tier": "evidence"
        },
        {
          "name": "Small, Bjorkegren, Erkkilä, Shaw & Megill — 'Polis: Scaling Deliberation by Mapping High Dimensional Opinion Spaces', Recerca 26(2)",
          "jurisdiction": "International",
          "year": 2021,
          "source": "https://doi.org/10.6035/recerca.5516",
          "tier": "primary",
          "anchor": "polis-paper"
        },
        {
          "name": "vTaiwan case study (CrowdLaw)",
          "jurisdiction": "Taiwan",
          "source": "https://congress.crowd.law/case-vtaiwan.html",
          "tier": "evidence",
          "anchor": "vtaiwan"
        },
        {
          "name": "People Powered: vTaiwan's hybrid approach",
          "jurisdiction": "Taiwan",
          "source": "https://www.peoplepowered.org/news-content/digital-participation-case-study-taiwan",
          "tier": "evidence"
        },
        {
          "name": "OECD OPSI: Pol.is, Official Languages and people-first policy (Canada pilot)",
          "jurisdiction": "Canada",
          "year": 2018,
          "source": "https://oecd-opsi.org/innovations/pol-is-official-languages-and-a-shift-towards-people-first-policy-development/",
          "tier": "evidence",
          "anchor": "canada-polis"
        }
      ],
      "assurance": "Government needs confidence that what it reads as agreement reflects genuine breadth across participants, not the volume a well-organized or agent-assisted faction can produce. That means weighting positions by how widely they are shared across distinct groups, and being able to show that distinction when it explains a decision.",
      "access": "Structured deliberation can exclude users with limited language or literacy skills, and those with limited connectivity. It also excludes along a subtler line: someone who can only say what they mean in their own words is deterred by a format built around voting on other people's statements. Their view never reaches the map. It gets recorded as silence.",
      "openings": [
        "Run a free-text route alongside the structured one, feeding what it gathers into the same analysis rather than a side pile.",
        "Meet language and accessibility needs up front, as the Canadian bilingual deployments did, so the method widens participation rather than narrowing it to the format-fluent."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "OpinionMap",
            "annotation": "Statements are ranked by how widely they are shared across groups, so a position that bridges divides outranks one a single faction repeats."
          }
        ]
      },
      "whereThingsGoWrong": "Pol.is is a deliberation surface, not a decision engine. The failure mode is treating its clustering output as the decision itself rather than as input to one a person still owns, which drops the accountability the mapping was meant to preserve. The clustering itself can be gamed: a coordinated or agent-run bloc voting in a matched pattern across many accounts can register as its own opinion cluster, and a statement that bloc endorses then reads as bridging real divides rather than as one faction's position. Verifying that each voting account traces to a distinct participant is what keeps a manufactured cluster from counting as a genuine one. That guard needs an identified channel, where identity is established before a vote is accepted. A consultation seeking views often runs open instead, and identity can't be required there as a condition of being heard. The round should say which condition it runs under. Where it runs open, the work falls to the agency rather than the participant: report the map as the structure of the positions put rather than a count of the people holding them, and test a cluster against other evidence before a decision cites it.",
      "framing": "Mapping where genuine agreement sits across a consultation, by weighting positions\non how widely they are shared across distinct groups rather than how often one\ngroup repeats them. A position's reported weight reflects how many different\ngroups hold it, which volume alone can't counterfeit.\n",
      "challenge": "When AI agents can generate large volumes of distinct-looking submissions, raw counts and\nfree-text piles stop telling an agency where genuine agreement lies. It needs to see the\nstructure of opinion across a consultation: which positions are broadly shared, and where\nreal disagreement sits, without a loud or heavily mobilized faction reading as the public.\n",
      "precedentsNote": "**[Pol.is](#s-polis-paper), Small et al.** The open-source platform runs large-scale\ndeliberation by real-time clustering: participants write short statements\nand vote agree, disagree, or pass on others'. It has no reply mechanism at\nall, a design its authors credit with reducing the ability to take a\nconversation off topic and with disincentivizing trolling, and it groups\nparticipants by voting-pattern similarity using dimensionality reduction\nfollowed by K-means clustering. The visualization elevates statements that\nbridge divides over statements that accumulate votes inside one cluster.\n\n**[vTaiwan](#s-vtaiwan), Taiwan.** Taiwan's government used the platform for\ndeliberation among affected groups on Uber regulation, online alcohol\nsales, and telemedicine. It combines online deliberation with face-to-face\nmeetings among those groups, using the clustering output to structure\nin-person discussion around identified areas of consensus and disagreement.\nThe clustering feeds a process, and does not conclude one.\n\n**[The Canadian government pilot](#s-canada-polis).** The Government of\nCanada deployed the platform six times in one year, adapting it for\nbilingual use and for compliance with federal privacy, security, and\naccessibility requirements. Deployments engaged 25 groups of participants,\nincluding a national engagement on digital disruption's impact on visual\nartists. Adapting it to a federal government's own obligations was the work\nthe pilot did.\n",
      "transferability": "High. Pol.is is open-source and has been successfully adapted to multiple\njurisdictional contexts, including bilingual deployments; its clustering approach\nis language-agnostic in principle. The main barriers are cultural (governments\naccustomed to free-text submissions may resist structured deliberation) and\ninstitutional (Pol.is works best when its outputs feed into a defined\ndecisions process, as in vTaiwan).\n"
    },
    {
      "id": "6.4",
      "title": "Weighting distinct voices",
      "territory": 6,
      "slug": "distinct-voice-weighting-ui",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "emerging",
          "note": "For reporting practices that separate campaign from distinct responses, which already exist."
        },
        {
          "level": "frontier",
          "note": "For a dedicated interface showing volume and breadth side by side, which has no established precedent."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [
        "6.1",
        "6.5"
      ],
      "precedents": [
        {
          "name": "GOV.UK: Growing Up in the Online World — consultation response totals",
          "jurisdiction": "UK",
          "source": "https://www.gov.uk/government/publications/growing-up-in-the-online-world-consultation-response-totals/growing-up-in-the-online-world-consultation-response-totals",
          "tier": "primary",
          "anchor": "growing-up"
        },
        {
          "name": "GOV.UK: Report on Copyright and Artificial Intelligence",
          "jurisdiction": "UK",
          "year": 2025,
          "source": "https://www.gov.uk/government/publications/report-and-impact-assessment-on-copyright-and-artificial-intelligence/report-on-copyright-and-artificial-intelligence",
          "tier": "primary",
          "anchor": "uk-copyright-ai"
        },
        {
          "name": "CDO Council Comment Analysis (deduplication metrics)",
          "jurisdiction": "US",
          "source": "https://resources.data.gov/resources/cdoc_comment_analysis/",
          "tier": "primary",
          "anchor": "cdo-metrics"
        },
        {
          "name": "Coglianese: E-Rulemaking",
          "source": "https://doi.org/10.2139/ssrn.500122",
          "tier": "evidence",
          "anchor": "coglianese"
        },
        {
          "name": "Balla: Lost in the flood?",
          "source": "https://onlinelibrary.wiley.com/doi/abs/10.1111/rego.12318",
          "tier": "evidence",
          "anchor": "balla"
        },
        {
          "name": "Parliamentary Joint Committee on Human Rights — Freedom of speech in Australia inquiry report (paras 1.5–1.7)",
          "jurisdiction": "AU",
          "year": 2017,
          "source": "https://www.aph.gov.au/~/media/Committees/Senate/committee/humanrights_ctte/FreedomspeechAustralia/Report.pdf?la=en",
          "tier": "primary",
          "anchor": "pjchr-18c"
        }
      ],
      "assurance": "When results are reported, government needs to read breadth of support rather than raw volume, so a campaign that mobilizes many people behind one position is not mistaken for many independent positions. That means the report has to distinguish how many submissions arrived, how many distinct arguments they contain, and how many verified distinct submitters stand behind them.",
      "access": "Legitimate mass participants are the group most at risk. If a distinctness metric is foregrounded in place of the raw count, a real constituency that mobilized behind one position can read as illegitimate. Their turnout looks manufactured.",
      "openings": [
        "Report raw counts and distinct-argument counts together, never one instead of the other.",
        "Label campaign responses rather than hiding them.",
        "Write the dashboard's own labels in plain language, so a reader who has never met the volume-breadth distinction is informed by it rather than misled."
      ],
      "surface": {
        "instances": [
          {
            "domain": "service",
            "kind": "interactive",
            "component": "VoiceWeighting",
            "annotation": "Raw submissions, distinct arguments, and verified distinct submitters are reported together, so breadth reads as independent sources rather than as volume."
          }
        ]
      },
      "whereThingsGoWrong": "If a dashboard reports only the raw count, an orchestrated campaign passes as a broad mandate, since nothing in it distinguishes one campaign from a thousand independent submitters. Presenting distinct-submitter and distinct-argument counts alongside raw volume closes that gap. The distinctness count can itself be gamed: an agent can paraphrase the same template into superficially different wording, and a similarity check tuned to catch identical text will register each rewrite as a separate distinct argument.",
      "framing": "Reporting consultation results so volume and breadth don't collapse into one\nnumber. A decision-maker citing the consultation can say how many people asked\nfor something, separate from how many submissions said it.\n",
      "challenge": "As AI agents make it cheap to mobilize or generate submissions in bulk, a raw count of how\nmany arrived stops telling an agency how widely a position is held. The same total can mean a\nbroad, independent constituency or a single campaign amplified at scale, and a report that\nshows only the count cannot tell the two apart.\n",
      "precedentsNote": "**[UK consultation response reporting](#s-growing-up).** UK consultations\nroutinely distinguish campaign responses, which are template-based and\noften organized by advocacy organizations, from detailed responses that are\nunique and substantive. The 'Growing Up in the Online World' consultation\nnoted that campaign responses 'reflect the reach and mobilisation capacity\nof the organising group(s) rather than the independent views of a\nrepresentative cross-section of the public', and reported the two\nseparately.\n\n**[The UK copyright and AI consultation](#s-uk-copyright-ai).** The report\nacknowledged that many responses 'either repeated or built upon a set of\ntemplate letters, or template survey responses, that were created and\ndistributed by interested organisations or individuals', and reported them\nseparately from original responses. Separate reporting is established UK\npractice across at least two departments.\n\n**[Coglianese](#s-coglianese) and [Balla](#s-balla) on mass campaigns.**\nCoglianese's research on e-rulemaking documents that in high-volume dockets\nthe great majority of mass-campaign comments are near-identical and add\nlittle distinct substantive content, so raw volume is a poor proxy for\nbreadth of views. Balla's analysis of 1,049 mass comment campaigns across\n22 EPA rulemakings found the agency references mass campaigns in its\nresponses but cites them at lower rates than unique comments. That is\nbreadth weighting already happening, without being named or disclosed.\n\n**[Parliamentary Joint Committee on Human Rights](#s-pjchr-18c) form-letter\ndisclosure.** In the\nfreedom of speech inquiry, 418 accepted submissions were published while\napproximately 10,590 items were categorized as form letters, with one\nsample of each published alongside the count received. The count is\ndisclosed, the campaign is not erased, and the substantive submissions stay\nfindable.\n",
      "transferability": "Moderate to high. The UK's practice of reporting campaign versus non-campaign\nresponses is immediately transferable. Building dashboards that show distinctness\nmetrics without appearing to dismiss mass participation is the part that does not.\n"
    },
    {
      "id": "6.5",
      "title": "Submitter nudges on template matches",
      "territory": 6,
      "slug": "template-match-submitter-nudges",
      "maturity": "frontier",
      "maturityNote": "Frontier (no production implementation of a submitter-facing template-match nudge found; the mechanism is a straightforward extension of existing similarity-matching tools)",
      "status": "published",
      "dependsOn": [],
      "seeAlso": [
        "6.1",
        "6.4"
      ],
      "precedents": [
        {
          "name": "GOV.UK: Growing Up in the Online World — consultation response totals (duplicate-entry prevention)",
          "jurisdiction": "UK",
          "source": "https://www.gov.uk/government/publications/growing-up-in-the-online-world-consultation-response-totals/growing-up-in-the-online-world-consultation-response-totals",
          "tier": "primary",
          "anchor": "growing-up"
        },
        {
          "name": "GSA: Regulations.gov Bulk Comment API transparency update",
          "jurisdiction": "US",
          "year": 2021,
          "source": "https://www.gsa.gov/about-us/newsroom/news-releases/gsa-launches-updated-regulationsgov-to-improve-the-integrity-of-public-commenting-02172021",
          "tier": "primary",
          "anchor": "gsa-bulk-api"
        },
        {
          "name": "Beth Noveck: Congressional testimony",
          "jurisdiction": "US",
          "year": 2020,
          "source": "https://www.congress.gov/116/meeting/house/110461/witnesses/HHRG-116-BA09-Wstate-NoveckB-20200206.pdf",
          "tier": "primary",
          "anchor": "noveck"
        },
        {
          "name": "Australian Senate climate committee — submissions received as standard form letters",
          "jurisdiction": "AU",
          "year": 2009,
          "source": "https://www.aph.gov.au/Parliamentary_Business/Committees/Senate/Former_Committees/climate/submissions/sublist",
          "tier": "primary",
          "anchor": "senate-form-letters"
        }
      ],
      "assurance": "A government needs the submissions it receives to contain distinct argument rather than repeated template text, so a reviewer can weigh what a person contributes, while a participant keeps the right to send a template unchanged. That means a submitter should learn, before filing, that their comment matches a known template and that a unique argument counts for more analytically. Nothing about that nudge prevents them from submitting as written.",
      "access": "The nudge lands hardest on low-literacy participants and those under cognitive load. The suggestion to 'add your own perspective' can read as a writing test. A participant may abandon a submission they were entitled to make as written.",
      "openings": [
        "Make the nudge informative and never coercive: the template route stays the primary action at full standing.",
        "Say why a personal perspective helps, rather than implying the template is worthless.",
        "Hold the banner to plain-language standards, announced to assistive technology without stealing focus, and dismissible without losing the draft in progress."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "TemplateNudge",
            "annotation": "A submitter using a campaign template is told, without being blocked, that their own experience adds weight."
          }
        ]
      },
      "whereThingsGoWrong": "By nudging toward substance over volume at the point of submission, the pattern works against the volume-as-mandate dynamic; its central safeguard is that it never gates participation behind a literacy or effort threshold. If a nudge implies the template submission counts for nothing, it can deter a legitimate submitter from submitting at all, someone already unsure their voice counts. The underlying detection can also be evaded: a campaign that varies its template's wording just enough to slip past similarity matching gets treated as a distinct argument instead of flagged volume. The nudge never fires.",
      "framing": "Telling a submitter, before they file, that their text matches a known template\nand that their own experience would add weight. The consultation gains first-hand\naccounts.\n",
      "challenge": "As AI agents make it easy to file a campaign template at scale, more participants will submit\ntext identical to thousands of others without knowing it will be grouped and weighed as a\nsingle argument rather than counted one by one. A person who would have added their own\nexperience, had they understood how submissions are read, instead files volume that adds\nlittle distinct weight.\n",
      "precedentsNote": "**[UK duplicate-entry prevention](#s-growing-up).** The 'Growing Up in the\nOnline World' consultation survey included duplicate-entry prevention and\nquestions designed to detect and deter automated responses. It is aimed at\nbots, and it is an intervention placed in the submission flow rather than\nin the analysis that follows.\n\n**[Regulations.gov bulk comment API](#s-gsa-bulk-api).** GSA's updated API\nrequires identity verification for bulk submitters and adds transparency\nabout the source of automated comments. It is organization-facing rather\nthan individual-facing, and it establishes that the system should signal\nwhen submissions are part of a coordinated campaign.\n\n**[Australian Senate form-letter listing](#s-senate-form-letters).** The\nSenate climate-policy committee published its submission list under the\nheading 'Submissions received as standard form letters, including form\nletters with additional individual comments'. The template plus the\nsubmitter's own words is captured as its own category at intake, which is\nthe intermediate state worth preserving.\n",
      "transferability": "High in principle; the design is jurisdiction-agnostic. Accessibility and\nplain-language requirements apply throughout. The nudge should explain *why*\nadding a personal perspective matters: it counts for more in the analysis than a\nrepeated template.\n"
    },
    {
      "id": "6.6",
      "title": "Alternative weighting mechanisms",
      "territory": 6,
      "slug": "alternative-weighting-mechanisms",
      "maturity": "emerging",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For Wikipedia's consensus norms, established as a long-running non-government governance practice, not yet adopted in a government process."
        },
        {
          "level": "emerging",
          "note": "For quadratic voting, which has appeared in legislative use."
        },
        {
          "level": "frontier",
          "note": "For conviction voting in government, which remains unproven."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "Weyl & Lalley: Quadratic Voting",
          "source": "https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2003531",
          "tier": "primary",
          "anchor": "quadratic-voting"
        },
        {
          "name": "RadicalxChange: Quadratic Voting wiki",
          "source": "https://www.radicalxchange.org/wiki/quadratic-voting/",
          "tier": "evidence"
        },
        {
          "name": "Colorado Sun: Quadratic voting in the Colorado House",
          "jurisdiction": "US",
          "year": 2019,
          "source": "https://coloradosun.com/2019/05/28/quadratic-voting-colorado-house-budget/",
          "tier": "evidence",
          "anchor": "colorado-qv"
        },
        {
          "name": "RadicalxChange: Colorado QV",
          "jurisdiction": "US",
          "source": "https://www.radicalxchange.org/wiki/colorado-qv/",
          "tier": "evidence"
        },
        {
          "name": "Colorado FOIC: anonymous QV violates open meetings law",
          "jurisdiction": "US",
          "source": "https://coloradofoic.org/lawmakers-use-of-anonymous-quadratic-voting-system-violates-colorados-open-meetings-law-judge-rules/",
          "tier": "evidence",
          "anchor": "colorado-foic"
        },
        {
          "name": "Commons Stack: Conviction Voting",
          "source": "https://medium.com/commonsstack/conviction-voting-a-novel-continuous-decision-making-alternative-to-governance-62e215ad2b3d",
          "tier": "evidence",
          "anchor": "conviction-voting"
        },
        {
          "name": "Block Science: A Brief History of Conviction Voting",
          "source": "https://blog.block.science/a-brief-history-of-conviction-voting/",
          "tier": "evidence"
        },
        {
          "name": "Wikipedia: Polling is not a substitute for discussion",
          "source": "https://en.wikipedia.org/wiki/Wikipedia:!VOTE",
          "tier": "evidence",
          "anchor": "wikipedia-vote"
        },
        {
          "name": "Wikipedia: Arguments to avoid in deletion discussions",
          "source": "https://en.wikipedia.org/wiki/Wikipedia:Arguments_to_avoid_in_deletion_discussions",
          "tier": "evidence"
        }
      ],
      "assurance": "Government needs a way to register how strongly a position is held, and how sustained the support behind it is, so a result reflects considered weight rather than mobilization capacity. The weighting it uses has to be defensible: explainable to participants and to anyone challenging the outcome.",
      "access": "An opaque weighting scheme excludes participants with limited language or numeracy skills. A participant who can't tell how their input is counted has little reason to take part. One who suspects the algorithm discounts them reaches a worse outcome at equal effort, without ever seeing it happen.",
      "openings": [
        "Explain the weighting in plain language at the point of participation: the credit screen shows the cost curve as it is spent.",
        "Publish the mechanism so it can be challenged, and, as the Colorado open-meetings ruling showed, never trade that legibility away for anonymity at the price of public accountability.",
        "Make the credit-allocation control operable by keyboard and assistive technology, with the running budget announced as it changes."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "CreditVoting",
            "annotation": "Concentrating votes on a single position costs more the further it goes, and the screen shows how the final weighting is computed."
          }
        ]
      },
      "whereThingsGoWrong": "Weighting mechanisms reframe participation as arguments and intensity rather than raw numbers, countering volume-as-mandate logic. The Colorado case is a reminder that an opaque weighting algorithm can itself become the accountability failure. The mechanism has its own attack surface: quadratic voting's cost curve only discourages concentration if one identity holds one credit budget, and an agent that registers many accounts to split its credits across them can buy the same concentrated influence at a fraction of the cost. A credit budget is issued rather than claimed: it goes to a participant the process already knows, which puts the mechanism on an identified channel from the start. One budget per person is what keeps that arithmetic from being gamed, and it follows from who holds the franchise rather than standing on its own as a reason to bar anyone. The mechanism doesn't transfer to an open channel, where identity can't be required as a condition of being heard. A round that reaches for it there has added a condition on being counted without saying so. Name the condition where the round is announced, so someone who can't meet it learns that before taking part rather than after spending a budget that won't count.",
      "framing": "Weighting participation by the intensity and persistence of support behind a\nposition, not by how many submissions repeat it. A participant spends a limited\nbudget of voice on what matters most to them, rather than being counted the same\nregardless of how strongly they feel.\n",
      "challenge": "When AI agents make it cheap to produce submissions in bulk, a process that counts each one\nequally rewards whoever can mobilize or automate the most volume. It does not reward whoever\nis most affected or has the strongest case. An intensely affected minority can be outweighed by a\nlarge, lightly engaged majority, or by a campaign an agent ran at scale.\n",
      "precedentsNote": "**[Quadratic voting](#s-quadratic-voting), Weyl and Lalley.** Weyl and Lalley's design gives\nparticipants a budget of voice credits that convert to votes at the square\nroot, so 1 credit buys 1 vote, 4 credits buy 2, and 9 credits buy 3. The\nconversion lets participants signal intensity while making extreme\nconcentration progressively more expensive, which mitigates both tyranny of\nthe majority and vote-buying.\n\n**[The Colorado legislature pilot](#s-colorado-qv).** The Democratic Caucus\nof the Colorado House adopted quadratic voting to prioritize spending bills\nwhen the backlog exceeded available budget, giving each lawmaker 100\ncredits to allocate across more than 100 bills and returning a bar chart of\nintensity-weighted priorities. The system has continued since. A judge\n[ruled the anonymous ballot process violated Colorado's open meetings\nlaw](#s-colorado-foic), which is the transparency cost of a secret\nintensity signal.\n\n**[Conviction voting](#s-conviction-voting), Commons Stack.** Zargham's design integrates\ntime as a core dimension: the longer a participant supports a proposal, the\nmore conviction accumulates, on a half-life decay curve. The curve rewards\nsustained commitment over flash-mob mobilization and makes last-minute\nmanipulation costly. 1Hive's Gardens is the first production deployment,\nallocating funds from a common pool.\n\n**[Wikipedia's not-vote convention](#s-wikipedia-vote).** Wikipedia's\nconsensus culture rejects vote-counting in favor of argument quality, and\nthe '!vote' notation reminds editors that polls gauge opinion without\nbinding anyone. In a deletion discussion a single well-argued,\npolicy-citing position can outweigh ten unsupported votes. A community has\nheld that line at scale for two decades.\n",
      "transferability": "Mixed. QV has proven transferable to legislative settings (Colorado) and could be adapted for\nprioritization exercises in public consultation. Conviction voting's blockchain origins make\nit culturally distant from government contexts, where it has no production use yet, but the\ntime-weighting principle is relevant. Wikipedia's !vote culture is a governance norm rather\nthan a technical mechanism, but it offers a sharp framing: a well-argued position is expected\nto outweigh a raw vote count.\n\nFor government digital services, the most transferable insight is that weighting mechanisms\nshould be legible to participants: any system that weights contributions must explain its\nlogic transparently.\n"
    },
    {
      "id": "6.7",
      "title": "Submission processing that resists prompt injection",
      "territory": 6,
      "slug": "injection-resistant-submission-processing",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "emerging",
          "note": "For the secure-development scaffolding, where treating ingested content as untrusted, least privilege, and human oversight are settled guidance from national cyber agencies."
        },
        {
          "level": "frontier",
          "note": "For a government submission-processing pipeline hardened against adversarial content, where no published deployment documents a control specific to injected submissions."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [
        "6.1",
        "4.6"
      ],
      "precedents": [
        {
          "name": "OWASP LLM01:2025 — Prompt Injection",
          "jurisdiction": "International",
          "year": 2025,
          "source": "https://genai.owasp.org/llmrisk/llm01-prompt-injection/",
          "tier": "primary",
          "anchor": "owasp-llm01"
        },
        {
          "name": "NIST AI 100-2e2025 — Adversarial Machine Learning: A Taxonomy and Terminology",
          "jurisdiction": "US",
          "year": 2025,
          "source": "https://csrc.nist.gov/pubs/ai/100/2/e2025/final",
          "tier": "primary",
          "anchor": "nist-aml"
        },
        {
          "name": "UK NCSC — prompt injection may never be fully mitigated",
          "jurisdiction": "UK",
          "year": 2025,
          "source": "https://www.ncsc.gov.uk/news/mistaking-ai-vulnerability-could-lead-to-large-scale-breaches",
          "tier": "primary",
          "anchor": "ncsc-injection"
        },
        {
          "name": "Guidelines for Secure AI System Development (NCSC, CISA and partners)",
          "jurisdiction": "International",
          "year": 2023,
          "source": "https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development",
          "tier": "primary",
          "anchor": "secure-ai-guidelines"
        },
        {
          "name": "Greshake et al. — indirect prompt injection (ACM AISec '23)",
          "jurisdiction": "International",
          "year": 2023,
          "source": "https://dl.acm.org/doi/abs/10.1145/3605764.3623985",
          "tier": "evidence",
          "anchor": "greshake"
        },
        {
          "name": "UK Consult — evaluating an AI tool for public consultation analysis",
          "jurisdiction": "UK",
          "year": 2025,
          "source": "https://ai.gov.uk/blogs/evaluating-consult-an-ai-tool-for-enhanced-public-consultation-analysis/",
          "tier": "primary",
          "anchor": "uk-consult"
        }
      ],
      "assurance": "When an agency uses its own agent to read, summarize, cluster, or rank user submissions, it needs confidence that the agent's reading reflects what the submissions say and not instructions hidden inside them. Content a submitter controls can contain directions that alter how the processing agent behaves, and by the standards bodies' own account this cannot be fully filtered out. The confidence government needs therefore has to come from structural and procedural controls run by the agency operating the pipeline, not a claim of immunity.",
      "access": "The defense can exclude the honest submitter if it is drawn too tightly. A genuine submission whose unusual phrasing trips an adversarial-content filter is redirected or denied consideration on a false signal. This is more likely for someone writing in a second language, with low literacy, or using assistive technology. Over-reliance on the agent's own ranking compounds the risk. The agent may score a submission as low-relevance because of unfamiliar phrasing, then rank it below submissions it reads easily, and no one decided to exclude it.",
      "openings": [
        "Never reject a submission on a suspected-injection signal alone: treat the signal as data for human follow-up rather than grounds for exclusion.",
        "Route anything the agent flags or deprioritizes to human review.",
        "Keep a standing route for a submitter to have their submission considered by a person."
      ],
      "surface": {
        "instances": [
          {
            "domain": "service",
            "kind": "interactive",
            "component": "SubmissionIntegrity",
            "annotation": "Submissions are treated as data the agent may read but never obey, with a person owning every consequential step."
          }
        ]
      },
      "whereThingsGoWrong": "The failure mode is an agency acting on a reading of the submissions that a submission covertly steered. A crafted entry in the pile can direct the processing agent to misrepresent the weight of opinion, drop a category of response, or emit content the agent was never meant to produce. Because the manipulation rides inside ordinary-looking text, it is invisible in the summary the agency relies on. Without a log of what the agent did, it stays invisible afterward too, leaving a decision defended on a reading no one can reconstruct. The four controls are what keep a manipulated reading from becoming a manipulated decision.",
      "framing": "Protecting the integrity of a government agent that reads, summarizes, clusters,\nor ranks user submissions from adversarial content inside those submissions,\nthrough structural controls that hold regardless of how the injection is\nworded.\n",
      "challenge": "As agencies use their own agents to process submissions at scale, the content of a\nsubmission becomes a channel for manipulating the agent that reads it. Indirect\nprompt injection (instructions planted in the very text an agent ingests) is the\ntop-ranked risk for language-model applications, and national cyber agencies warn\nit may never be fully mitigated, because a model cannot reliably tell the\ninstructions it was given from the data it was asked to read. For policymakers this\nlands squarely on the duty to consider what was submitted and to defend the\nresulting decision: an agency must be able to stand behind a reading produced, in\npart, by an agent that ingested content specifically crafted to steer it.\n",
      "precedentsNote": "**[OWASP LLM01:2025](#s-owasp-llm01) and the [NIST adversarial-ML\ntaxonomy](#s-nist-aml).** Prompt injection is the top-ranked language-model\napplication risk, split into direct injection through the user's own input\nand indirect injection through instructions planted in content the agent\nlater reads, and its canonical treatment states plainly that fool-proof\nprevention is unclear. The US standards body's taxonomy adds indirect\nprompt injection as a defined subcategory. The bodies that catalog the\nattack rule out a filtering cure in the same document, which is what leaves\na structural control as the only kind available.\n\n**[UK NCSC](#s-ncsc-injection) and the [Guidelines for Secure AI System\nDevelopment](#s-secure-ai-guidelines).** The NCSC states prompt injection\n'may never be totally mitigated' the way SQL injection can be, and counsels\nsecure design over a single fix, while the joint international guidelines\nset secure design, development, deployment, and operation on a\nsecure-by-default basis. The mitigations that follow, segregating and\nmarking external content as untrusted, validating output against an\nexpected shape, enforcing least privilege, keeping a human on consequential\nactions, and logging inputs, outputs, and tool calls, each reduce the risk.\nA national cyber agency frames every one of them as risk reduction.\n\n**[The UK's Consult tool](#s-uk-consult).** Consult analyzes large volumes\nof consultation responses and presents themes to human reviewers rather\nthan deciding, aligned to the principles governing lawful consultation. Its\npublished safeguard is human review for accuracy and legitimacy. No control\nspecific to adversarial or injected submissions is documented, which marks\nthe gap precisely.\n",
      "transferability": "The mitigations transfer directly to a submission-processing pipeline, and the\nhonest posture is that they harden it rather than seal it: the four controls\n(submissions held as data rather than instructions, an agent with no authority\nto act, a human owning the consequential step, a log of everything read and\ndone) transfer unchanged, alongside validating the agent's output against the\nshape a triage step expects. The assumption to design on is that some injected\ncontent will arrive and some will get through.\n\nThe unresolved part is that no published government deployment documents a control\nspecific to injected submissions, and the standards bodies agree no control makes\nthe risk go away. That is why the hardened pipeline is frontier even though its\ncomponent practices are settled secure-development guidance. It is also why the\ndurable answer leans on keeping a human on the consequential decision rather than\non any claim to have filtered the adversarial content out.\n"
    },
    {
      "id": "6.8",
      "title": "Verified agent admission",
      "territory": 6,
      "slug": "verified-agent-admission",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "emerging",
          "note": "For the signing-and-verification loop itself, where HTTP Message Signatures is a ratified IETF standard and a content-delivery network validates signed-agent requests at the edge in production."
        },
        {
          "level": "frontier",
          "note": "As a government-service admission control with a mandated unsigned fallback: no public-sector deployment documents it, and the fallback that keeps it from excluding is undesigned."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [
        "2.11",
        "5.3",
        "6.2"
      ],
      "precedents": [
        {
          "name": "RFC 9421 — HTTP Message Signatures",
          "jurisdiction": "IETF",
          "year": 2024,
          "source": "https://www.rfc-editor.org/rfc/rfc9421.html",
          "tier": "primary",
          "anchor": "rfc-9421"
        },
        {
          "name": "Web Bot Auth — HTTP signatures protocol (IETF individual draft, before the webbotauth WG)",
          "jurisdiction": "IETF",
          "year": 2026,
          "source": "https://datatracker.ietf.org/doc/draft-meunier-webbotauth-httpsig-protocol/",
          "tier": "evidence",
          "caveat": "unadopted-draft",
          "anchor": "web-bot-auth"
        },
        {
          "name": "Web Bot Auth registry — Signature Agent Card (IETF individual draft)",
          "jurisdiction": "IETF",
          "year": 2026,
          "source": "https://datatracker.ietf.org/doc/draft-meunier-webbotauth-registry/",
          "tier": "evidence",
          "caveat": "unadopted-draft",
          "anchor": "signature-agent-card"
        },
        {
          "name": "Cloudflare — Verified Bots and signed agents",
          "jurisdiction": "Global",
          "year": 2025,
          "source": "https://blog.cloudflare.com/signed-agents/",
          "tier": "evidence",
          "anchor": "cloudflare-signed"
        },
        {
          "name": "Visa Trusted Agent Protocol — merchant specification",
          "jurisdiction": "Global",
          "year": 2025,
          "source": "https://developer.visa.com/capabilities/trusted-agent-protocol/trusted-agent-protocol-specifications",
          "tier": "primary",
          "anchor": "visa-tap"
        }
      ],
      "assurance": "A service admitting agent traffic needs confidence that a request comes from a declared, identifiable operator it can attribute and hold to account. That confidence must be proportionate to what it is admitting the agent to do: a public crawl and a transaction do not warrant the same assurance. The obligation sits with the agency operating the service: it verifies the operator's declared signal at the moment of the request rather than inferring the actor from behavior. What this confirms is the operator behind the agent. It does not establish the human principal, the scope of any authority the user delegated, or that a person stands behind the request at all. It tells the service whose agent this is, not what the agent may do, so it is one signal among several and never the whole check.",
      "access": "Admission by signature is itself an exclusion mechanism. An agent whose operator cannot obtain a signing key, host a public key directory, or enroll in a registry is refused admission even when it holds valid authority from the user. The person who depends on that agent is denied the outcome, not just slowed. The burden falls hardest on a user's self-built or open-source agent, a small operator, and anyone acting from a jurisdiction without the supporting infrastructure. Treated as the only route in, a signed-agent requirement recreates the exclusion it was meant to prevent.",
      "openings": [
        "Hold an unsigned route at parity: a personhood or delegated-authority path, or an assisted and non-agent channel, that doesn't depend on operator registration and reaches the same outcome.",
        "Publish how signed and unsigned traffic are weighted, rather than leaving it silent.",
        "Treat an absent signature as data for follow-up, never as grounds for refusal.",
        "Have any control the service exposes for this convey its state and the consequence of that state in plain language, operable without sight of the cryptography beneath it."
      ],
      "surface": {
        "instances": [
          {
            "domain": "service",
            "kind": "interactive",
            "component": "AgentAdmission",
            "annotation": "A signed request is admitted with its operator named, and an unverifiable one is routed to a path held at parity rather than turned away."
          }
        ]
      },
      "whereThingsGoWrong": "The failure mode is a service that comes to trust the signature as proof of more than it can support. A valid signed request proves which operator sent it. It does not prove that a human authorized this particular action, that the agent is acting within a delegated scope, or that the operator is honest. An admitted agent can therefore still be compromised, over-scoped, or acting for no one. Treating admission as authorization lets it through on a check that was never asking that question.\n\nAn operator's signing key, if stolen, admits an attacker under a trusted name until the key is rotated. A service that has made the signed path the fast path without saying so also pressures every legitimate operator toward registration and every unregistered one toward a slower route or out of the service entirely.\n\nTwo moves contain this. Keep the signal to its own claim (whose agent this is), and a key compromise is an attribution problem rather than an unchecked admission. Hold the unsigned route at genuine parity, and an unregistered agent stays admissible, just slower.",
      "framing": "Letting a legitimate agent prove it is a known, authorized agent at the moment\nit makes a request, the inversion of proving a human is present. A service can\nthen admit and account for declared agent traffic instead of guessing an actor\nfrom its behavior.\n",
      "challenge": "As agents reach government services at scale, a service will field a rising share of\nits traffic from software rather than people, and be unable to tell a declared,\naccountable agent from an anonymous or spoofed one. The response that suggests itself\nis to infer the actor from its behavior: a CAPTCHA agents now defeat, invisible\nbehavioral scoring, or a compute-under-time-pressure challenge a scripted human passes\nas easily as an agent. But each behavioral test is defeated and replaced by the next,\nand a raw-compute test establishes nothing about who stands behind the request.\nAdmission decisions (whom to admit, whom to rate-limit, whom to hold to account) then\nrest on traffic the service cannot attribute, unless a legitimate agent is given a way\nto declare itself that the service can check.\n",
      "precedentsNote": "**[RFC 9421](#s-rfc-9421), HTTP Message Signatures.** The Standards-Track\nRFC defines how to sign and verify selected components of an HTTP message,\nso a server or an intermediary can confirm them even after the message is\nrelayed. The agent signs and the origin verifies, and nothing in the\nexchange asks the agent to behave in a detectable way. The verification\nprimitive is ratified.\n\n**[Web Bot Auth](#s-web-bot-auth).** An automated client signs its requests with an Ed25519 key and publishes\nthe public key at a well-known directory, so an origin can fetch the key\nnamed in a `Signature-Agent` header and verify the operator that signed. A\n[companion registry draft](#s-signature-agent-card) defines a Signature\nAgent Card carrying an operator's identity and keys. The IETF chartered a\nworking group, every draft before it remains unadopted, and the milestone\nfor sending the specifications to the IESG has not been met.\n\n**[Cloudflare's signed agents](#s-cloudflare-signed).** Cloudflare folded\nsignature validation into its Verified Bots program at the network edge and\nextended verified status to end-user-directed AI agents as signed agents,\nlisted in a public directory. An origin is admitting declared agents on a\ncryptographic check rather than a behavioral one, in production. It runs on\nprivate infrastructure, by a private operator, against no access duty a\ngovernment service would owe.\n\n**[Visa's Trusted Agent Protocol](#s-visa-tap).** The specification sets out\nhow a merchant recognizes a trusted agent's request on the same signature\nprimitives. The admission mechanism has reached a payments network, answering\na commercial question rather than a public-access one.\n",
      "transferability": "The primitive transfers cleanly and the application does not yet. RFC 9421 is\nratified and the signing-and-verification loop runs at content-delivery scale, so a\ngovernment service could require or prefer a verifiable agent signature at the request\nlayer in place of a behavioral bot check: the mechanism is real and deployed. What\ndoes not transfer as it stands is the part a public service cannot skip: an admission\ncontrol the state runs must come with an unsigned route held at genuine parity,\nbecause a government cannot refuse someone the outcome for want of a registered agent\nthe way a private site can refuse a crawler. The precedents solve identifying the\nagent; they do not solve admitting the unregistered one, and they say nothing about\nhow signed and unsigned traffic should be weighted where access is a duty rather than\na courtesy.\n\nThe honest position is that the signing layer is emerging while the government\nadmission control is frontier. The drafts that define agent-side identity are\nunadopted and may change, and the only at-scale deployment is a private network\nanswering a private question. The fallback that would keep the pattern from excluding\npeople, and that makes it fit for government at all, is the piece no one has yet\ndesigned.\n"
    },
    {
      "id": "6.9",
      "title": "Declared agent welcome",
      "territory": 6,
      "slug": "declared-agent-welcome",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "emerging",
          "note": "For the signaling layer, where an IETF working group is chartered with adopted vocabulary drafts and a vendor reports deploying the same shape on millions of domains."
        },
        {
          "level": "frontier",
          "note": "As a government channel policy — declared agent permissions per channel with declared-versus-enforced parity — where no public-sector deployment documents one."
        }
      ],
      "status": "reviewed",
      "dependsOn": [],
      "seeAlso": [
        "6.8",
        "5.1"
      ],
      "precedents": [
        {
          "name": "IETF AIPREF working group — charter",
          "jurisdiction": "IETF",
          "year": 2025,
          "source": "https://datatracker.ietf.org/wg/aipref/about/",
          "tier": "primary",
          "anchor": "aipref"
        },
        {
          "name": "draft-ietf-aipref-vocab (working-group draft)",
          "jurisdiction": "IETF",
          "year": 2026,
          "source": "https://datatracker.ietf.org/doc/draft-ietf-aipref-vocab/",
          "tier": "evidence",
          "anchor": "aipref-vocab"
        },
        {
          "name": "Cloudflare — Content Signals Policy",
          "jurisdiction": "Global",
          "year": 2025,
          "source": "https://blog.cloudflare.com/content-signals-policy/",
          "tier": "evidence",
          "anchor": "content-signals"
        },
        {
          "name": "RSL — Really Simple Licensing 1.0",
          "jurisdiction": "US",
          "year": 2025,
          "source": "https://rslstandard.org/",
          "tier": "primary",
          "anchor": "rsl"
        },
        {
          "name": "llms.txt — community proposal",
          "jurisdiction": "US",
          "year": 2024,
          "source": "https://llmstxt.org/",
          "tier": "evidence",
          "anchor": "llms-txt"
        }
      ],
      "assurance": "The relying party here is the agent and its operator: before acting, they need confidence that a channel's declared preferences are authoritative, current, and complete enough to act on. The agency operating the channel must publish the declaration and keep it current. It must also keep the declaration true, so that what the declaration welcomes and what the edge enforces match. A declaration the edge does not honor misleads the compliant agent and does nothing to the non-compliant one. A preference declaration is not an access control and confirms nothing about which agent sent a request; the standards work is explicit on that boundary. Enforcement and attribution belong to admission, and the declaration is one signal among the pair, never the whole answer.",
      "access": "Exclusion here runs through the people behind the agents. A person may depend on an agent for disability, language, working hours, or the sheer administrative effort involved. If a channel's declaration defaults to 'no agents', that person is redirected to slower channels or deterred outright, while large operators negotiate private carve-outs an individual's self-built agent never gets.",
      "openings": [
        "State what is welcome, not only what is forbidden.",
        "Scope the welcome so it isn't available only to registered commercial operators.",
        "Cost the agent's traffic, not the person's outcome, when an agent violates the declared preferences: a submission that arrived through a discouraged route is still a submission owed consideration.",
        "Publish the declaration in plain language on the channel it governs, readable by people as well as machines, so a person can know what their agent may do there without parsing a preference file."
      ],
      "surface": {
        "instances": [
          {
            "domain": "policy",
            "kind": "interactive",
            "component": "AgentWelcome",
            "annotation": "The channel itself states what agent traffic is welcome and for what purposes, in plain language and in a form an agent can read."
          }
        ]
      },
      "whereThingsGoWrong": "Left unaddressed, the failure is a policy made by nobody: edge infrastructure and vendor defaults decide which agents reach a government channel, the agency cannot say what its own policy is, and the record shows blocking decisions no official made. The adversarial readings are institutional as much as technical. A publisher games its own declaration by publishing a welcome its edge configuration does not honor and does not log. The metric is met on paper while compliant agents are refused without a record. A declaration nobody enforces fails in the opposite direction, training agents to ignore it and penalizing exactly the operators who honor it. A declaration can also be weaponized as a gate: scoped so narrowly that only registered commercial operators fall inside the welcome, it converts a transparency instrument into a market-access filter. The pairing with admission is the containment for all three: the declaration states what is welcome, admission confirms which agent made the request, and neither pretends to do the other's job.",
      "framing": "A service stating, in machine-readable form on the channel itself, what agent\ntraffic is welcome there and for what purposes. The declaration states the\npolicy; confirming which agent is making a request is a separate duty.\n",
      "challenge": "As agent traffic grows, what a government channel permits an agent to do\n(lodge a submission for a person, read and index it, train on its content)\nbecomes a real policy question, and nowhere more than on a submissions\nchannel, where the legitimate agent filing in the open is the alternative to\nthe anonymous one filing covertly. Today the question is answered only by\nfragmented, unilateral signals descended from robots.txt. An agency that says\nnothing invites everything and then over-blocks at the edge with no record of\nthe decision; an agency that blocks by default excludes the legitimate agents\nits own users depend on. Both are policy\ndecisions no one is recorded as making, and increasingly not the agency's to\nmake: a service behind a large CDN may already be emitting vendor-defined\nagent signals its policy owners never chose. Draft standards now exist for\nsaying it explicitly, which puts the choice in front of agencies: declare what\nagent use is welcome, or keep making that policy by default and by vendor.\n",
      "precedentsNote": "**[The IETF AIPREF working group](#s-aipref).** The IETF chartered AIPREF\nto standardize a vocabulary for expressing preferences about AI use of\ncontent and mechanisms to attach them via robots.txt and HTTP. The\n[vocabulary draft](#s-aipref-vocab) is an adopted working-group document\nnarrowed to two categories, train-ai and search, while its attachment\ncompanion has lapsed and the milestones have slipped a year. The charter is\nexplicit that this expresses a preference without enforcing it: no access\ncontrol, no authentication, no registries.\n\n**[Cloudflare's Content Signals Policy](#s-content-signals).** The policy\nlayers three machine-readable yes-or-no signals, search, ai-input, and\nai-train, onto robots.txt, running on more than 3.8 million domains through its managed robots.txt, on\na count the operator publishes itself. The design consequence is not: an agency behind that\ninfrastructure may already be signaling to agents without having decided\nto.\n\n**[Really Simple Licensing](#s-rsl).** RSL attaches machine-readable\nlicensing terms covering attribution and compensation to the same\nrobots.txt-adjacent slots, with a collective-rights organization behind it.\nGovernment channels do not sell content. It still demonstrates that\nmachine-readable conditions of agent use, and not only permissions, are\nviable.\n\n**[llms.txt](#s-llms-txt), the cautionary example from the same slot.** The community proposal\nfor an agent-facing index file has real tooling-side adoption and no\ndocumented crawler honoring it. A signal only one side of the conversation\nadopted binds nobody, which is why a declaration pairs with admission\nrather than replacing it.\n",
      "transferability": "The mechanics transfer today. An agency could publish content signals on its\nchannels this afternoon, which is precisely why the gap is legible. None of\nthe deployed or drafted vocabularies speaks to the interaction government\ncares about: whether an agent may lodge a submission here, for whom, and under\nwhat admission requirements. The categories are crawl-era (search, training,\ninput), and the government-shaped extension is undesigned. The trust model\ndoes not transfer either. The web's version is a unilateral request aimed at\nstrangers, while a government declaration would be read as a commitment. A\ncommitment needs two things a request does not: parity between what is\ndeclared and what is enforced, and somewhere authoritative to publish it.\nNeither is designed yet, and the llms.txt experience sets the failure baseline\nfor skipping them.\n"
    },
    {
      "id": "7.1",
      "title": "Agency-provided agents (a public option)",
      "territory": 7,
      "slug": "public-option-agency-provided-agents",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "emerging",
          "note": "For government-provided public options, where the Swiss Apertus model runs in production and IRS Direct File ran two filing seasons before the IRS discontinued it."
        },
        {
          "level": "frontier",
          "note": "For a public-option agent at government service entry points, where Ukraine's Diia.AI open beta is the only live deployment and no full production deployment exists elsewhere."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "IRS Publication 5969, 'Direct File Pilot Program: Filing Season 2024 After Action Report'",
          "jurisdiction": "US",
          "year": 2024,
          "source": "https://www.irs.gov/pub/irs-pdf/p5969.pdf",
          "tier": "primary",
          "anchor": "direct-file"
        },
        {
          "name": "Code for America, guide to the IRS free tax filing survey (2025 season-end figures)",
          "jurisdiction": "US",
          "year": 2025,
          "source": "https://codeforamerica.org/news/code-for-americas-guide-to-the-irs-free-tax-filing-survey/",
          "tier": "evidence"
        },
        {
          "name": "Nextgov/FCW, 'Direct File won't happen in 2026, IRS tells states'",
          "jurisdiction": "US",
          "year": 2025,
          "source": "https://www.nextgov.com/digital-government/2025/11/direct-file-wont-happen-2026-irs-tells-states/409309/",
          "tier": "evidence",
          "anchor": "direct-file-end"
        },
        {
          "name": "Accounting Today, 'IRS ends Direct File program'",
          "jurisdiction": "US",
          "year": 2025,
          "source": "https://www.accountingtoday.com/news/irs-ends-direct-file-program",
          "tier": "evidence"
        },
        {
          "name": "Schneier, \"Public AI as an Alternative to Corporate AI\"",
          "year": 2024,
          "source": "https://www.schneier.com/blog/archives/2024/03/public-ai-as-an-alternative-to-corporate-ai.html",
          "tier": "evidence",
          "anchor": "schneier-public-ai"
        },
        {
          "name": "Schneier, \"Canada Needs Nationalized, Public AI\"",
          "year": 2026,
          "source": "https://www.schneier.com/blog/archives/2026/03/canada-needs-nationalized-public-ai.html",
          "tier": "evidence"
        },
        {
          "name": "Schneier, \"Rewiring Democracy Now: Switzerland Shows Us an Alternative to Corporate AI\" (the Apertus public model)",
          "year": 2026,
          "source": "https://www.schneier.com/essays/archives/2026/02/rewiring-democracy-now-switzerland-shows-us-an-alternative-to-corporate-ai.html",
          "tier": "evidence",
          "anchor": "apertus"
        },
        {
          "name": "Eric Friedman, \"Universal Basic Agents\"",
          "source": "https://ericfriedman.substack.com/p/universal-basic-agents",
          "tier": "evidence",
          "anchor": "basic-agents"
        },
        {
          "name": "Ukraine Diia.AI — state AI agent on the Diia portal",
          "jurisdiction": "UA",
          "year": 2025,
          "source": "https://digitalstate.gov.ua/news/govtech/diiaai-pershyy-u-sviti-derzavnyy-ai-ahent-iakyy-ne-prosto-konsultuye-a-nadaye-posluhy-iak-pratsiuye-shtuchnyy-intelekt-na-portali",
          "tier": "primary",
          "anchor": "diia-ai"
        }
      ],
      "assurance": "Government needs every user to be able to reach agentic services through an agent that answers to the user, not to a commercial intermediary. Meeting that requires a publicly accountable baseline agent whose alignment, training data, and decision logic can be audited, so the user and the agency can both trust whose interests it serves. The providing agency must publish and keep current that audit of the agent's alignment, training data, and decision logic.",
      "access": "Users with no bank, employer, insurer, or subscription relationship have no route to a capable agent when agents come bundled with those relationships.",
      "openings": [
        "Offer a free public agent at every service entry point, so reaching agentic government is never conditioned on wealth or an existing institutional relationship.",
        "Hold that public agent to the same accessibility criteria as any novel surface: operable by assistive technology, plain-language by default, and usable on low-end and shared devices."
      ],
      "surface": {
        "instances": [
          {
            "domain": "service",
            "kind": "interactive",
            "component": "PublicOptionEntry",
            "annotation": "Every service entry point offers a free government agent, presented alongside whatever agent the user already has."
          }
        ]
      },
      "whereThingsGoWrong": "The failure mode is a system that systematically acts against the people it serves because the agent in front of them answers to a commercial intermediary that steers them toward its own products. An agency can also game its own public-option commitment: offering it a step further away in the flow than the commercial agent, or letting its funding and capability lag until it exists on paper without matching what users are offered. A publicly auditable baseline agent aligned to the user reduces that chance.",
      "framing": "A free, government-provided agent at every service entry point, aligned to the\nuser and auditable by the public. A user without a bank, employer, or subscription\nthat supplies an agent still gets one at the door of the service.\n",
      "challenge": "If AI agents are only available through banks, employers, insurers, or subscription\nplatforms, access to agentic government services becomes a function of wealth and\nexisting institutional relationships. The agent a bank provides will serve the\nbank's interests ahead of the user's. Users without commercial relationships\n(the very people most likely to need government services) are excluded entirely.\n",
      "precedentsNote": "**[IRS Direct File](#s-direct-file).** The Internal Revenue Service built a\ngovernment-provided free tax filing tool as an alternative to the\ncommercial software offered through the Free File Alliance. Its\nafter-action report on the pilot found 90 percent of users rating their\nexperience excellent or above average and a Net Promoter Score of +74, with\nseason-end figures the following year at 94 percent and +80. The [IRS then\ntold its 25 partner states](#s-direct-file-end) the tool would not be\navailable for the next filing season, and set no future launch date.\n\n**[Schneier on public AI](#s-schneier-public-ai).** Schneier argues for\nfederally funded foundation models as a public service, analogous to public\nroads or the postal system, providing a competitive baseline private\nofferings must meet. Switzerland has built [Apertus](#s-apertus), a large\nlanguage model made by Swiss public servants and university researchers on\nappropriately licensed training data and public supercomputing\ninfrastructure. One jurisdiction has taken the proposal as far as a shipped\nmodel.\n\n**[Ukraine's Diia.AI](#s-diia-ai).** The Ministry of Digital Transformation\nruns a state AI agent on the Diia portal that consults, navigates services,\nand delivers income certificates directly in chat, with state-registry data\nshielded from the cloud model behind an on-premise perimeter. It is a\npublic-option deployment answering to the state rather than to a commercial\nintermediary. Usage figures circulate only through secondary reporting.\n",
      "transferability": "High. The IRS Direct File precedent demonstrates that government-provided tools can\noutperform commercial alternatives on user satisfaction, and that a public option can\nnonetheless be withdrawn on cost and uptake grounds while that satisfaction is rising.\n\nFor an agent-mediated government services context, this translates to a pattern where the\ngovernment provides a baseline agent whose alignment is to the user rather than to a\ncommercial intermediary, even where it is not the most capable agent on the market. The Swiss\nApertus model shows this is technically feasible at the foundation-model level. Commercial\nagents may connect to the same service APIs, but the public option ensures universal access.\n"
    },
    {
      "id": "7.2",
      "title": "Preserving the person's own voice",
      "territory": 7,
      "slug": "voice-fidelity-preservation",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "frontier",
          "note": "For voice-fidelity preservation as a design requirement, where the documenting research is recent (2025-2026, anchored by the CHI 2026 extended abstract quantifying cultural-marker erasure), no known system implements it, and the interaction design that surfaces and flags substantive rewrites to the user has no established precedent."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "Hansard (the Official Report) — 'substantially verbatim' reporting",
          "jurisdiction": "UK",
          "source": "https://hansard.parliament.uk/about",
          "tier": "primary",
          "anchor": "hansard"
        },
        {
          "name": "\"When AI Writes, Whose Voice Remains?\" (CHI 2026 extended abstract)",
          "year": 2026,
          "source": "https://dl.acm.org/doi/full/10.1145/3772363.3799085",
          "tier": "evidence"
        },
        {
          "name": "Stanford, \"How AI is leaving non-English speakers behind\"",
          "jurisdiction": "US",
          "year": 2025,
          "source": "https://news.stanford.edu/stories/2025/05/digital-divide-ai-llms-exclusion-non-english-speakers-research",
          "tier": "evidence"
        },
        {
          "name": "WEF, \"How can we design AI agents for a world of many voices?\"",
          "year": 2026,
          "source": "https://www.weforum.org/stories/2026/01/how-can-we-design-ai-agents-for-a-world-of-many-voices/",
          "tier": "evidence"
        },
        {
          "name": "Sharma et al., \"Towards Understanding Sycophancy in Language Models\" (ICLR 2024)",
          "year": 2024,
          "source": "https://arxiv.org/abs/2310.13548",
          "tier": "evidence",
          "anchor": "sycophancy"
        },
        {
          "name": "Gender bias in AI-generated reference letters (arXiv)",
          "source": "https://arxiv.org/pdf/2310.09219",
          "tier": "evidence",
          "caveat": "preprint",
          "anchor": "reference-letters"
        }
      ],
      "assurance": "Government needs confidence that a submission reaching an agency still represents what the user said, not a version the agent reshaped on the way. Meeting that requires the agency to be able to confirm, to a stated confidence, that a rewrite has not changed the user's substantive position without the user and agency knowing. The agent provider, or the platform accepting agent-mediated submissions, must be able to demonstrate that confidence.",
      "access": "The people whose voice the agent most reshapes, speakers of minoritized dialects and under-resourced languages, are also the people a review step serves worst. Checking what an agent changed is itself a literacy-dependent task. A substantive rewrite can slip past the user uncaught. A visual diff assumes sight and reading competence. An audio summary assumes hearing. Both formats put people with visual or hearing impairments at risk.",
      "openings": [
        "Offer the review across modalities: text, audio, plain-language summary, or interpreter.",
        "Flag meaning-level changes rather than expecting the user to find them.",
        "Keep the user's original wording one action away from restored.",
        "Make the diff view work with assistive technology, and never convey changes by color alone."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "VoiceDiff",
            "annotation": "Edits that change what the user meant are shown before submit, so the user can keep their own wording."
          }
        ]
      },
      "whereThingsGoWrong": "The failure mode is an agent silently reframing a complaint or appeal in a way that misrepresents the person to the agency. The flagging signal itself can be gamed: an agent tuned to classify a substantive rewrite as merely stylistic reports full compliance while the reframing goes unflagged. Surfacing what the agent changed, and flagging when a rewrite alters the user's substantive position, limits it.",
      "framing": "Keeping what the user said intact through an agent's rewriting: the original\ntravels with the polished version, and meaning-changing edits are flagged before\nanything is sent. What the person said remains on the record, available\nwhenever the polished version is disputed.\n",
      "challenge": "As more submissions pass through an AI agent before they reach government, an\nagent's habit of smoothing, formalizing, and homogenizing what a user wrote\nbecomes the default way it gets rendered.\n\nResearch demonstrates this is not neutral: LLM rewriting pulls text toward dominant\nforms at the expense of minoritized ones. A 2026 CHI extended abstract, \"When AI\nWrites, Whose Voice Remains?\", quantified that erasure of cultural markers across\nWorld English varieties.\n\nLLM rewriting reduces lexical diversity, strips dialectal markers, and imposes a formal\nregister that may change the substance of what was said. Minoritized linguistic features\n(such as African American Vernacular English syntax) are often flagged as requiring\n\"correction.\"\n",
      "precedentsNote": "**[Hansard's substantially-verbatim rule](#s-hansard).** The UK\nParliament's Official Report is edited, but only within a stated limit: it\nreports what Members said 'substantially verbatim', with repetitions and\nobvious mistakes removed. An institution that publishes speech on someone\nelse's behalf has fixed the line, and put the obligation to hold it on the\neditor. Nobody is shown what changed before publication, and corrections\nrun as a separate procedure afterward.\n\n**[Sharma et al. on sycophancy in language models](#s-sycophancy), ICLR.** The documented tendency\nof language models toward sycophancy, tailoring responses to what they\npredict the user wants to hear rather than to what is accurate, bears\ndirectly on rewriting someone else's words. An agent that rewrites a\ncomplaint to sound more professional may also moderate its force, remove\nemotional content that conveys urgency, or turn a demand into a request.\n\n**[Gender bias in AI-generated reference letters](#s-reference-letters).**\nThe research found AI-generated reference letters carrying gender biases in\nlanguage of professionalism, excellence, and agency, with male candidates\ndescribed in more professional terms. Improvement of text by a model is not\nneutral, and it encodes existing hierarchies.\n",
      "transferability": "Direct, though few working examples exist yet. In a government services context, the\nvoice-fidelity problem appears when a user's complaint about housing conditions is\nrewritten into bureaucratic language that strips the lived urgency, or when an appeal is\n\"improved\" into a form that changes its legal character. The user may not understand what\nwas changed, and the receiving agency may not know the submission was agent-mediated.\n\nThe precedents establish that the erasure happens and describe its mechanism; none of them\nshow a preserve-and-flag protocol operating in practice, so that part of the response stays\nundesigned.\n\nShowing a user with low literacy, or whose first language is not English, that their agent\nchanged the meaning is the hardest part, because a diff display assumes reading competence\nand an audio summary assumes hearing. The more review the check asks of the user, the more\npeople it risks excluding.\n"
    },
    {
      "id": "7.3",
      "title": "Non-agent fallback channels, kept first-class",
      "territory": 7,
      "slug": "first-class-non-agent-fallback-channels",
      "maturity": "emerging",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For the digital/non-digital divide, fallback channels are well-established practice."
        },
        {
          "level": "emerging",
          "note": "For the agent/non-agent divide, equivalent fallback channels are still taking shape."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "GDS blog, \"An introduction to Assisted Digital\"",
          "jurisdiction": "UK",
          "year": 2011,
          "source": "https://gds.blog.gov.uk/2011/07/28/an-introduction-to-assisted-digital/",
          "tier": "evidence",
          "anchor": "assisted-digital"
        },
        {
          "name": "GDS blog, \"Designing public services that work for everyone\"",
          "jurisdiction": "UK",
          "year": 2025,
          "source": "https://gds.blog.gov.uk/2025/12/10/designing-public-services-that-work-for-everyone/",
          "tier": "evidence",
          "anchor": "gds-everyone"
        },
        {
          "name": "Services Australia self-service",
          "jurisdiction": "AU",
          "source": "https://www.servicesaustralia.gov.au/self-service?context=64107",
          "tier": "primary",
          "anchor": "sa-selfservice"
        },
        {
          "name": "Services Australia 2030 Vision",
          "jurisdiction": "AU",
          "year": 2025,
          "source": "https://www.servicesaustralia.gov.au/services-australia-2030-vision?context=22",
          "tier": "primary",
          "anchor": "sa-2030"
        },
        {
          "name": "Data and Digital, Connected service delivery",
          "jurisdiction": "AU",
          "year": 2025,
          "source": "https://www.dataanddigital.gov.au/implementation-plan/2025/connected-service-delivery",
          "tier": "primary"
        },
        {
          "name": "GDS blog — non-digital channels",
          "jurisdiction": "UK",
          "source": "https://gds.blog.gov.uk/tag/non-digital-channels/",
          "tier": "evidence"
        }
      ],
      "assurance": "Government needs to be able to confirm, on a recurring basis, that the non-agent channel delivers the same outcome as the agent-mediated one, on the same timetable. A user who takes it should never be placed on a slower or worse path without being told, and the agency operating the service owes the obligation to hold that confirmation.",
      "access": "As agent mediation becomes the default, some users drift onto a slower, thinner channel that still formally exists: those with no capable device or agent, those who can't operate the interface, and those who have a well-founded refusal to use one. That drift is a worse outcome at equal effort, disguised as a choice of route.",
      "openings": [
        "Put an explicit channel choice at every service entry point.",
        "Publish processing times and success rates for the non-agent route, so the drift toward second-tier service becomes visible the quarter it starts rather than the year it is litigated."
      ],
      "surface": {
        "instances": [
          {
            "domain": "service",
            "kind": "interactive",
            "component": "ChannelChoice",
            "annotation": "The user can choose the non-agent route, and its published processing times hold the agency to its promise that the route is equivalent."
          }
        ]
      },
      "whereThingsGoWrong": "Where this goes wrong is a person who opts out of agent mediation being funneled into a slower, worse path. The equivalence commitment can also be gamed by the agency that made it: parity reported on one flattering measure, such as time to first response, while the non-agent queue degrades on the measures that decide outcomes, such as time to decision and success rate. Publishing those outcome measures for the non-agent route limits how long the degradation stays invisible.",
      "framing": "A non-agent route to every outcome, held at genuine parity of quality and\ntimeliness with the agent route. A person who declines the agent route still gets\nthe benefit, license, or decision on the same terms and timetable.\n",
      "challenge": "As agent-mediated interaction becomes the default pathway, agent channels can process faster\nand more cheaply than the human ones behind them, so the non-agent channel drifts toward\nlonger waits and worse outcomes even when it still formally exists.\n\nParity is the condition to hold: a user who cannot or chooses not to use an agent must\nreach the same outcome, at the same quality and on the same timetable, as someone who\nuses the agent route.\n",
      "precedentsNote": "**[GOV.UK assisted digital](#s-assisted-digital).** The Government Digital\nService established assisted digital as a formal policy category covering\nhelp for people who cannot use digital services independently, and the\nService Standard requires services to maintain non-digital channels. The\nprogram is tiered: click-and-print for paper forms, interface layers where\na non-digital element is required, physical access through internet\nterminals and face-to-face support, and alternative delivery through Post\nOffices and other partners. GDS [moved from digital by default to designing\nservices that work for everyone](#s-gds-everyone).\n\n**[Services Australia multichannel delivery](#s-sa-selfservice).** Services\nAustralia maintains face-to-face service centers, self-service terminals\nincluding in rural, regional, and remote locations through Agents and\nAccess Points, phone services, and digital channels. Its published [Vision](#s-sa-2030) holds that 'regardless of how people choose to engage\nwith us' they should receive 'high-quality, inclusive, accessible\nservices', and lists additional pathways when needed or preferred among\nwhat customers should expect. Channel choice is written into the agency's\nown published expectations.\n",
      "transferability": "Direct. The GOV.UK model is the most mature expression of this principle. For agent-mediated\nservices, the pattern extends from \"non-digital\" to \"non-agent.\" A user must be able to\ninteract with government services without any AI intermediary and receive equivalent service\nquality and timeliness.\n\nWhat is harder to transfer is the measurement itself. GOV.UK and Services Australia measure\nand report on the digital/non-digital split, but none of the cited precedents track outcomes\nacross an agent/non-agent split. The monitoring this pattern needs has no precedent to draw\non yet.\n"
    },
    {
      "id": "7.4",
      "title": "Accessibility baseline: WCAG and beyond",
      "territory": 7,
      "slug": "accessibility-baseline-wcag-and-beyond",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For WCAG conformance on web services, a recognized, mandated floor."
        },
        {
          "level": "frontier",
          "note": "For conversational accessibility standards specific to agent interactions, which have no established precedent."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "DOJ ADA Title II final rule — web and mobile app accessibility (Federal Register)",
          "jurisdiction": "US",
          "year": 2024,
          "source": "https://www.federalregister.gov/documents/2024/04/24/2024-07758/nondiscrimination-on-the-basis-of-disability-accessibility-of-web-information-and-services-of-state",
          "tier": "primary",
          "anchor": "ada-title-ii"
        },
        {
          "name": "DOJ interim final rule — extension of ADA Title II compliance dates (Federal Register)",
          "jurisdiction": "US",
          "year": 2026,
          "source": "https://www.federalregister.gov/documents/2026/04/20/2026-07663/extension-of-compliance-dates-for-nondiscrimination-on-the-basis-of-disability-accessibility-of-web",
          "tier": "primary",
          "anchor": "ada-extension"
        },
        {
          "name": "UNC SOG, \"Understanding the New ADA Web Accessibility Requirements\"",
          "jurisdiction": "US",
          "year": 2026,
          "source": "https://canons.sog.unc.edu/blog/2026/01/14/understanding-the-new-ada-web-accessibility-requirements-for-state-and-local-governments/",
          "tier": "evidence"
        },
        {
          "name": "DTA, \"Accessibility and the Digital Service Standard\"",
          "jurisdiction": "AU",
          "source": "https://www.dta.gov.au/blogs/accessibility-and-digital-service-standard",
          "tier": "evidence",
          "anchor": "dta-accessibility"
        }
      ],
      "assurance": "Government needs every user to be able to use the agent interface itself, not only the service behind it, before it can rely on agent-mediated delivery. Meeting that requires the recognized web-accessibility floor for the interface components and a parallel commitment on how the agent converses, covering pace, plain language, the ability to pause and review, and a transcript the user can check. The agency deploying the agent, or its vendor under contract, must commit to and hold that conversational floor.",
      "access": "Users with cognitive or processing differences, low literacy, or limited working memory may be unable to follow the conversation itself. It may move too fast, assume domain knowledge, or vanish as it scrolls. The user is excluded from a consequential action they could not track.",
      "openings": [
        "Hold the agent to that same conversational floor.",
        "Add explicit confirmation before anything consequential, so a user who lost the thread is not committed to an action they never tracked."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "AccessibilityControls",
            "annotation": "The user sets the pace of the conversation and keeps a transcript they can go back over."
          }
        ]
      },
      "whereThingsGoWrong": "The failure mode is a person swept through an inaccessible automated flow they cannot follow or check. An interface can pass every WCAG conformance test while the conversational layer stays unaudited, so a vendor can claim compliance while the pace and complexity of the exchange remain the actual barrier. Holding the agent to the same conversational floor reduces that chance.",
      "framing": "Holding the agent interface itself to the recognized accessibility floor, and\nextending that floor to how the agent converses, not only how it renders.\n",
      "challenge": "As agent-mediated conversation becomes the default channel for reaching a\ngovernment service, the agent's own interface becomes the thing a user has to\nbe able to use. If it is not accessible, the agent is just a new barrier in\nfront of the service. Web-accessibility standards cover the visual and\ninteraction layer, but a back-and-forth conversation adds a cognitive dimension (pace,\nplain language, the ability to pause and review) that no current standard covers.\n\nAn interface can pass every conformance test and still leave a user unable to follow\nwhat is being asked of them. Left unaddressed, the agent channel launches with barriers the law already\nprohibits on every other channel.\n",
      "precedentsNote": "**[The DOJ ADA Title II final rule](#s-ada-title-ii).** The rule requires\nstate and local government entities to ensure web content and mobile\napplications conform to WCAG 2.1 Level AA. An [interim final\nrule](#s-ada-extension) extended the compliance deadlines to 26 April 2027\nfor public entities serving 50,000 or more people and to 26 April 2028 for\nsmaller entities and special districts. Section 508 of the Rehabilitation\nAct requires WCAG 2.0 AA for federal agencies and contractors.\n\n**[Australia's Digital Service Standard](#s-dta-accessibility).** The\nStandard incorporates WCAG conformance as a requirement of the service,\nrather than as separate accessibility guidance beside it. WCAG conformance\nlevels are cumulative, so Level AA requires meeting all Level A and Level\nAA success criteria.\n",
      "transferability": "WCAG compliance is necessary but not sufficient for agent-mediated services. WCAG addresses\nthe interface layer (screen readers, color contrast, keyboard navigation) but not the\ncognitive accessibility of agent interactions.\n\nThat extension has no precedent to draw on: no jurisdiction's accessibility standard defines\nhow an agent should pace, confirm, or make reviewable a conversation, so this part of the\nfloor has to be designed fresh rather than adopted from WCAG or any other existing standard.\n"
    },
    {
      "id": "7.5",
      "title": "Plain language and multilingual intake",
      "territory": 7,
      "slug": "plain-language-and-multilingual-intake",
      "maturity": "emerging",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For plain-language requirements, codified and in force."
        },
        {
          "level": "emerging",
          "note": "For multilingual AI with quality transparency, which is beginning to appear."
        },
        {
          "level": "frontier",
          "note": "For language-quality disclosure patterns on agents, which have no established precedent."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "Digital.gov, \"Requirements for plain writing\" (Plain Writing Act 2010)",
          "jurisdiction": "US",
          "year": 2010,
          "source": "https://digital.gov/resources/plain-writing-act",
          "tier": "primary",
          "anchor": "plain-writing"
        },
        {
          "name": "DOI, \"Plain Language\"",
          "jurisdiction": "US",
          "source": "https://www.doi.gov/plainlanguage",
          "tier": "primary"
        },
        {
          "name": "Digital.gov, \"Requirements for improving access to services for LEP\" (describes EO 13166, revoked March 2025)",
          "jurisdiction": "US",
          "source": "https://digital.gov/resources/requirements-for-improving-access-to-services-for-people-with-limited-english-proficiency-lep",
          "tier": "evidence",
          "anchor": "eo-13166"
        },
        {
          "name": "Executive Order 14224 — designating English the official language (Federal Register)",
          "jurisdiction": "US",
          "year": 2025,
          "source": "https://www.federalregister.gov/documents/2025/03/06/2025-03694/designating-english-as-the-official-language-of-the-united-states",
          "tier": "primary",
          "anchor": "eo-14224"
        },
        {
          "name": "TIS National (Translating and Interpreting Service)",
          "jurisdiction": "AU",
          "source": "https://www.tisnational.gov.au/",
          "tier": "primary",
          "anchor": "tis-national"
        },
        {
          "name": "Australian Academy of the Humanities, \"Enshrining multilingualism\"",
          "jurisdiction": "AU",
          "source": "https://humanities.org.au/power-of-the-humanities/enshrining-multilingualism-how-a-landmark-languages-policy-changed-australia/",
          "tier": "evidence"
        },
        {
          "name": "US Department of Labor — EO 13166 24th anniversary release",
          "jurisdiction": "US",
          "year": 2024,
          "source": "https://www.dol.gov/newsroom/releases/oasam/oasam20240812",
          "tier": "evidence"
        },
        {
          "name": "Migration Policy Institute — 'Shifting Priorities' on the official-English order",
          "jurisdiction": "US",
          "year": 2025,
          "source": "https://www.migrationpolicy.org/news/official-english-order-language-access",
          "tier": "evidence"
        }
      ],
      "assurance": "Government needs confidence that a user acting through an agent has understood the service and been understood by it, regardless of their literacy or the language they use. Meeting that requires plain language as the working register, disclosure of how well the agent commands a given language, and human-verified translation where legal or medical content makes an error costly. The agency or agent provider must make that disclosure and commission the verified translation.",
      "access": "An agent fluent in English and unusable in Karen or Dinka excludes speakers of under-resourced languages without refusing them anything or recording a failure: it delivers confident, wrong sentences the user has no way to check.",
      "openings": [
        "Make plain language the default register, rather than an option the user must find.",
        "Confirm the detected language with the user at intake.",
        "Show a competence indicator when the agent's command of a language is limited.",
        "Keep a human interpreter one action away, including for the legal or medical content that already requires human-verified translation."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "LanguageCompetence",
            "annotation": "The agent states how well it handles the user's language and offers a human interpreter where its command of that language runs out."
          }
        ]
      },
      "whereThingsGoWrong": "Where this goes wrong is a user misled by confident-but-wrong agent output into a position that harms their entitlement or compliance. A service can also claim multilingual support in aggregate while specific languages (Karen or Dinka rather than Spanish or Mandarin) stay effectively unsupported behind the combined number. Disclosing competence per language rather than as one average, and defaulting to plain language, addresses both.",
      "framing": "Agent intake that works across literacy levels and languages: plain language by\ndefault, an honest indicator of how well the agent handles the user's language,\nand a human interpreter when it doesn't. That disclosure stops the service from\nsettling consequential matters in a language the agent only appears to understand.\n",
      "challenge": "As more government interaction runs through AI agents, the same capability that could open\nbureaucratic language to users with lower literacy or limited English proficiency can\ninstead deepen the barrier. It rewards users who know how to prompt the agent well and\nunderserves languages with little training data behind them. Left unaddressed, the agent's\nown language competence decides who is understood, without anyone having chosen that outcome.\n",
      "precedentsNote": "**[The US Plain Writing Act](#s-plain-writing).** The Act requires\nexecutive branch agencies to use plain language in documents the public\nneeds in order to obtain benefits, access services, or comply with\nrequirements. Agencies must train employees, establish compliance\noversight, write all new or substantially revised documents in plain\nlanguage, and publish an implementation plan. Plain language is a statutory\nobligation on the agency, and not a style preference.\n\n**[Executive Order 13166 on limited English proficiency](#s-eo-13166).**\nThe order required federal agencies to provide meaningful access for people\nwith limited English proficiency, through language-access plans, staff\ntraining, multilingual recruitment, qualified translators and interpreters,\nand language-assistance technology. [Executive Order 14224](#s-eo-14224)\ndeclared English the official language and revoked it. The underlying legal\nrequirements for language access remain in force.\n\n**[TIS National](#s-tis-national) (Australia).** The Translating and\nInterpreting Service provides language services for people with limited\nEnglish proficiency and for the organizations that support them, supporting\nthe Multicultural Access and Equity Policy. Australia's framework,\ndeveloped from the Lo Bianco report, is built on English-plus\nmultilingualism and on removing language-based social inequalities. A\nstanding national interpreting service is the infrastructure the policy\nrests on.\n",
      "transferability": "High, with one caveat. AI agents can do better than static document translation because they\nadapt to the user's language level. That creates a new dependency, though: the quality of\nmultilingual AI output varies widely by language. Stanford research (2025) documents\nhow LLMs leave non-English speakers behind. The \"invisible languages\" problem (languages with\ninsufficient training data) means agent-mediated services could be excellent in English and\nMandarin but unusable in Karen, Dinka, or Auslan.\n\nThe plain-language and interpreter obligations transfer directly. The disclosure does not:\nnone of the cited regimes require a service to say how well it commands the language it is\noperating in, so the competence indicator has no precedent behind it.\n"
    },
    {
      "id": "7.6",
      "title": "Co-design with affected communities",
      "territory": 7,
      "slug": "co-design-with-affected-communities",
      "maturity": "emerging",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For co-design methodology in service design, which is well settled."
        },
        {
          "level": "emerging",
          "note": "For co-design applied to conversational AI, which is beginning to appear."
        },
        {
          "level": "frontier",
          "note": "For community oversight of deployed agent behavior, which has no established precedent."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "Services blog, \"From user-centred design to co-design\"",
          "jurisdiction": "UK",
          "year": 2021,
          "source": "https://services.blog.gov.uk/2021/03/23/from-user-centred-design-to-co-design/",
          "tier": "evidence",
          "anchor": "gds-codesign"
        },
        {
          "name": "Accessibility blog, \"Accessibility and service design for inclusion\"",
          "jurisdiction": "UK",
          "year": 2024,
          "source": "https://accessibility.blog.gov.uk/2024/02/21/accessibility-and-service-design-for-inclusion/",
          "tier": "evidence"
        },
        {
          "name": "GOV.UK Design System community",
          "jurisdiction": "UK",
          "source": "https://design-system.service.gov.uk/community/",
          "tier": "primary",
          "anchor": "govuk-ds"
        },
        {
          "name": "DTA Digital Service Standard",
          "jurisdiction": "AU",
          "year": 2023,
          "source": "https://www.digital.gov.au/policy/digital-experience/digital-service-standard",
          "tier": "primary",
          "anchor": "dta-standard"
        },
        {
          "name": "OECD OPSI, \"Government Digital Service Design Principles\"",
          "source": "https://oecd-opsi.org/toolkits/government-digital-service-design-principles/",
          "tier": "primary",
          "anchor": "oecd-opsi"
        }
      ],
      "assurance": "Government needs confidence that an agent serving a marginalized community behaves the way that community understands and expects, not the way its designers assumed people communicate. Meeting that requires the agency to be able to confirm, to the affected community's own satisfaction, that the agent behaves as they expect, both before it ships and for as long as it stays live.",
      "access": "The excluded cohort is the community the service exists for. When an agent encodes its designers' assumptions about how people talk, users with different language, literacy, or disability needs get misread requests and wrong outcomes. The affected community had no part in shaping the agent and no channel to correct it.",
      "openings": [
        "Involve affected communities as active participants at every design stage.",
        "Give them standing oversight of the live agent through an anonymized interaction-log review panel.",
        "Ask in the conversation itself whether the agent said what the user meant, so the person who was misread catches it early."
      ],
      "surface": {
        "instances": [
          {
            "domain": "service",
            "kind": "interactive",
            "component": "CommunityOversight",
            "annotation": "An affected-community panel keeps oversight of how the agent behaves once it is live, informed by what users say it got wrong."
          }
        ]
      },
      "whereThingsGoWrong": "The failure mode is systematic harm to a community baked into the agent's design and only confronted after it has scaled. A team can also convene a co-design or oversight panel without giving it power to change the agent's behavior, so consultation happens and nothing about the design moves as a result. Giving the affected community a hand in the design, and the power to direct changes to the live agent's behavior, lets that community correct the harm rather than absorb it.",
      "framing": "Giving the communities a service is built for a hand in how its agent talks,\nbefore it ships and after: co-designed conversational behavior, and standing\noversight of the live system by the people it affects. Failure modes only an\naffected community would recognize get raised while they can still be fixed.\n",
      "challenge": "As more services become agent-mediated, an agent's conversational design embeds\nassumptions about how people communicate, and those assumptions scale from a\nbadly worded form to every conversation the service has. The communities\nmisread by them have no hand on the design doing the misreading.\n",
      "precedentsNote": "**[GOV.UK co-design](#s-gds-codesign).** UK government service teams\ndescribe a move from user-centered design to co-design, treating users as\nactive participants rather than as research subjects. The [Design\nSystem](#s-govuk-ds) depends on cross-government community contribution,\nand the accessibility guidance frames co-design as including service\nbeneficiaries in order to understand journeys, pathways, and how people\ninteract with services.\n\n**[Australia's Digital Service Standard](#s-dta-standard).** The Standard\nincludes 'Leave no one behind' alongside 'Know your user', requiring\nservices to include users with different needs at all stages of development\nand prototyping. The obligation attaches at every stage, and not to a\nresearch phase that closes.\n\n**The [OECD Observatory of Public Sector Innovation](#s-oecd-opsi) on GDS\ndesign principles.** The GDS\ndesign principles have traveled beyond the UK: the OECD's Observatory of\nPublic Sector Innovation catalogs them as a toolkit for other governments,\nand standards like Australia's share overlapping principle sets built on\nthe same foundations. The same co-design commitment now sits in several\nnational standards.\n",
      "transferability": "The method transfers; the artifact it must govern changes. Co-designing a form or a\nwebsite produces artifacts that are relatively stable and reviewable. An agent's\nconversational behavior is probabilistic and context-dependent, so communities need a hand\nnot just in what the agent says but in how it responds to unexpected input, how it handles\ndistress, and what it does when it does not understand.\n\nEstablished co-design methods also assume the work ends when the design ships. Keeping the\naffected community involved after deployment, when the agent's behavior can drift from what\nwas agreed, is the part no existing method covers.\n"
    },
    {
      "id": "7.7",
      "title": "Whose interests the platform serves",
      "territory": 7,
      "slug": "whose-model-platform-intermediary-interests",
      "maturity": "frontier",
      "maturityNote": "The agentic-inequality framework provides the analytical foundation and the regulatory response is nascent, but no government has implemented provider-disclosure requirements for AI agents interacting with public services, so the response remains proposed rather than operated.",
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "16 CFR 255.5 — Disclosure of material connections (FTC Endorsement Guides)",
          "jurisdiction": "US",
          "source": "https://www.ecfr.gov/current/title-16/chapter-I/subchapter-B/part-255/section-255.5",
          "tier": "primary",
          "anchor": "ftc-255-5"
        },
        {
          "name": "ASIC Moneysmart — Choosing a financial adviser (Financial Services Guide)",
          "jurisdiction": "Australia",
          "year": 2026,
          "source": "https://moneysmart.gov.au/financial-advice/choosing-a-financial-adviser",
          "tier": "primary",
          "anchor": "fsg"
        },
        {
          "name": "\"Vertical tacit collusion in AI-mediated markets\" (arXiv)",
          "year": 2026,
          "source": "https://arxiv.org/pdf/2601.03061",
          "tier": "evidence",
          "caveat": "preprint",
          "anchor": "tacit-collusion"
        },
        {
          "name": "\"Regulating AI Agents\" (arXiv)",
          "year": 2026,
          "source": "https://arxiv.org/pdf/2603.23471",
          "tier": "evidence",
          "caveat": "preprint",
          "anchor": "regulating-agents"
        },
        {
          "name": "Sharp, Bilgin, Gabriel & Hammond, \"Agentic Inequality\" (Oxford Martin AIGI / Cooperative AI Foundation research report)",
          "year": 2025,
          "source": "https://aigi.ox.ac.uk/wp-content/uploads/2025/10/Agentic-Inequality-2025.pdf",
          "tier": "evidence",
          "anchor": "agentic-inequality"
        },
        {
          "name": "Rest of World, \"AI agents will exacerbate global economic inequality\"",
          "year": 2026,
          "source": "https://restofworld.org/2026/ai-agent-inequality/",
          "tier": "evidence"
        }
      ],
      "assurance": "When a commercially provided agent acts on a user at a government service, government needs to know whose interests are steering it, so an undisclosed conflict cannot shape an outcome unseen. Meeting that requires the agent to declare its provider, principal, and commercial relationships and to attest whose interests it serves as part of the delegation chain the agency can check.",
      "access": "An agent serving its provider's interests steers the interaction against the person it fronts for, often without the user noticing. A disclosure written in commercial legalese only reaches readers who least needed the warning. Users with lower literacy are left unable to catch the conflict themselves.",
      "openings": [
        "Accept agents from any provider, while offering the public-option agent beside them.",
        "Write the conflict disclosure in plain language a user can act on: 'this agent is provided by your bank and may favor its products'.",
        "Put the switch to the uncompromised alternative one action away from the disclosure itself."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "InterestDisclosure",
            "annotation": "When a third-party agent acts for the user, the surface names who it answers to and offers a switch to the public option."
          }
        ]
      },
      "whereThingsGoWrong": "The failure mode is a structurally misaligned intermediary steering a user's government interaction toward the provider's benefit without the user knowing the agent was doing it. A provider can also satisfy the disclosure requirement with commercial legalese that technically names the relationship without any user understanding what it means for their outcome. Requiring the agent to disclose whose interests it serves, and giving the user an uncompromised alternative, makes the conflict visible and gives the user a way around it; case-by-case scrutiny of each interaction can do neither.",
      "framing": "Making visible whose interests a commercially supplied agent serves when it acts\nfor a user, with an uncompromised public alternative one action away. A user\ndeciding whether to rely on a supplied agent can see whose interests it serves\nbesides their own.\n",
      "challenge": "An agent that reaches government for a user may have been supplied by their bank,\nemployer, or insurer. It can serve the provider's interests as much as\nthe user's, shaping those interactions in ways the user usually cannot\nsee. Pointed at a government service, that agent might file a\ntax return in a way that favors the provider's products, or downplay an\nemployer's liability in a claim.\n\nThe mechanism has been modelled: in simulation, platforms and sellers each\nindependently learn to exploit an AI shopping agent's documented biases, so\nother parties' interests reach the consumer through the agent with no\nexplicit coordination for antitrust scrutiny to catch. Research on agentic\ninequality names the wider condition, that agents function as autonomous\ndelegates rather than tools and generate asymmetries through scalable goal\ndelegation, while analysis of the EU AI Act finds rules written for\nconventional AI systems fall short on responsibility allocation and\nenforcement. Left unseen, that conflict shapes the outcome of a government\ninteraction without the user ever knowing their agent was not acting solely\nfor them.\n",
      "precedentsNote": "**[FTC material-connection disclosure](#s-ftc-255-5), 16 CFR 255.5.** Where\na connection between an endorser and the seller of an advertised product\n'might materially affect the weight or credibility of the endorsement, and\nthat connection is not reasonably expected by the audience, such connection\nmust be disclosed clearly and conspicuously'. The rule reaches business,\nfamily, and personal relationships, free or discounted products, and\nbenefits as slight as early access. A regime already requires the interest\nbehind a recommendation to be named where the recommendation is made.\n\n**[The Financial Services Guide](#s-fsg) (Australia).** ASIC's consumer\nguidance directs a person to read an adviser's Financial Services Guide\nbefore engaging them, and states that the Guide explains the adviser's\nservices, fees, commissions earned, and any links to financial products. It\nis a standing document handed over before the relationship starts, rather\nthan a warning attached to one recommendation. The duty to name a\ncommercial interest sits on the party holding it, ahead of any advice the\nclient acts on.\n",
      "transferability": "Direct. The conflict the framework names appears wherever a provider-supplied agent\ntouches a government interaction its provider has a stake in, and the user may never\nknow the agent was not acting solely in their interest.\n\nDisclosure addresses transparency but not the underlying misalignment, which is why the\nuser needs an uncompromised alternative as well as a warning. The remaining challenge is\nconnecting a disclosed conflict to a user who can act on it, and that connection\nis where the pattern is least settled.\n"
    },
    {
      "id": "7.8",
      "title": "Government-provided agents for high-stakes interactions",
      "territory": 7,
      "slug": "public-defender-analogy",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "emerging",
          "note": "For legal AI tools, which already exist."
        },
        {
          "level": "frontier",
          "note": "For a government-provided agent as a right in high-stakes interactions, which has no established precedent."
        }
      ],
      "status": "published",
      "dependsOn": [
        "7.1"
      ],
      "seeAlso": [],
      "precedents": [
        {
          "name": "Cheong, Liu, Stammbach & Henderson, \"How Can AI Augment Access to Justice? Public Defenders' Perspectives on AI Adoption\" (arXiv)",
          "jurisdiction": "US",
          "year": 2026,
          "source": "https://arxiv.org/abs/2510.22933",
          "tier": "evidence",
          "caveat": "preprint",
          "anchor": "public-defenders"
        },
        {
          "name": "OECD, \"AI in justice administration and access to justice\" (separate context)",
          "year": 2025,
          "source": "https://www.oecd.org/en/publications/2025/06/governing-with-artificial-intelligence_398fa287/full-report/ai-in-justice-administration-and-access-to-justice_f0cbe651.html",
          "tier": "evidence"
        },
        {
          "name": "LawHelp Interactive via Pro Bono Net",
          "jurisdiction": "US",
          "source": "https://www.probono.net/programs/lhi/",
          "tier": "evidence",
          "anchor": "lawhelp"
        },
        {
          "name": "Sam & Pearson, \"Community Legal Centres in the Digital Era\"",
          "jurisdiction": "AU",
          "year": 2019,
          "source": "https://lthj.qut.edu.au/article/view/1305",
          "tier": "primary",
          "anchor": "clc-digital"
        },
        {
          "name": "lawcpd.com.au, \"3 Australian Initiatives Using Technology to Improve Access to Justice\"",
          "jurisdiction": "AU",
          "source": "https://lawcpd.com.au/blog/technology-access-justice-australia/",
          "tier": "evidence"
        },
        {
          "name": "Justice Connect — Pro Bono Portal (network of 10,000+ pro bono lawyers)",
          "jurisdiction": "AU",
          "source": "https://justiceconnect.org.au/about/innovation/legal-help-experience/pro-bono-portal/",
          "tier": "primary",
          "anchor": "justice-connect"
        }
      ],
      "assurance": "In a high-stakes interaction, government needs to be able to confirm that the user on the other side had capable representation available, whether or not they brought their own agent, because the outcome turns on it. That obligation sits with the agency operating the appeal, dispute, or enforcement process: it must be able to show, for any case, that a capable agent and a reachable human escalation path were offered to a user who lacked their own.",
      "access": "The user facing an appeal or enforcement action without an agent is often someone already under cognitive load or distress, or without anyone able to act on their behalf.",
      "openings": [
        "Provide a capable public agent to users who lack their own for high-stakes interactions.",
        "Wrap it in human support from the start: the community-legal-center experience shows technology alone can alienate vulnerable clients, so build the human escalation path into the provision."
      ],
      "surface": {
        "instances": [
          {
            "domain": "service",
            "kind": "interactive",
            "component": "TieredAdvocacy",
            "annotation": "For an appeal or dispute, the user is routed to a stronger public agent, with a human escalation available throughout."
          }
        ]
      },
      "whereThingsGoWrong": "Where this goes wrong is a user left to face a consequential automated decision unaided. An agency can also game the tiering itself, routing a high-stakes appeal to the basic agent to hold down cost rather than escalating it to the enhanced tier the stakes call for. Guaranteeing a capable, government-provided agent with human escalation for high-stakes interactions gives them real representation when contesting a debt or benefit decision.",
      "framing": "A capable, government-provided agent for high-stakes interactions (an appeal, a\ndispute, an enforcement action), offered to users who lack their own, with a human\nescalation path throughout. The outcome of an appeal or enforcement action stops\ntracking whether the person could afford a capable agent.\n",
      "challenge": "In high-stakes dealings with government (an appeal, a benefit dispute, an enforcement\naction), a user with a capable agent has a real advantage over one without, and the\nstakes make that gap matter.\n\nAs agent-mediated interactions become how most people deal with government, that advantage\ncompounds: the representation gap in a benefit appeal starts to resemble the gap the public\ndefender system exists to close for a defendant who cannot afford a lawyer.\n",
      "precedentsNote": "**[Public defenders on AI adoption](#s-public-defenders).** Cheong, Liu,\nStammbach and Henderson interviewed public defense professionals across the\nUnited States and mapped their work into five domains: evidence\ninvestigation, legal research and writing, client communication, courtroom\nrepresentation, and defense strategy. Interviewees put evidence\ninvestigation first for AI support, and courtroom representation and\ndefense strategy last. The authors note that 'legal AI research rarely\nengages with the everyday realities of public defense work'.\n\n**[LawHelp Interactive](#s-lawhelp) and legal document assembly.** The US Legal\nServices Corporation funds LawHelp Interactive, which provides document\nassembly for self-represented litigants, and [Justice\nConnect](#s-justice-connect) in Australia has developed intake and referral\ntools alongside a portal matching need with a network of more than 10,000\npro bono lawyers. Publicly funded assistance at the point of a legal task\nis established practice in two jurisdictions.\n\n**[Sam and Pearson on community legal centres](#s-clc-digital).**\nAustralian community legal centres have adopted digital technologies\ncautiously, on the reasoning that institutions serving vulnerable clients\n'must be cautious not to adopt digital technologies without due thought\nand, consequently, potentially alienate vulnerable clients'. The caution\ncomes from the providers closest to the people the service is for.\n",
      "transferability": "Strong conceptual alignment, significant implementation challenges. The public-defender\ncomparison holds at the concept level: government extending capable representation to\nhigh-stakes interactions (benefit appeals, immigration decisions, regulatory enforcement)\nregardless of what a user could otherwise afford. The community-legal-center experience\nshows the technology alone is insufficient; it must be wrapped in human support structures.\n\nWhat no precedent yet shows is a government operating such an agent as an entitlement.\nThe provision itself, and who funds and staffs it, remains undesigned.\n"
    },
    {
      "id": "7.9",
      "title": "Digital divide and exclusion risk",
      "territory": 7,
      "slug": "digital-divide-awareness",
      "maturity": "emerging",
      "maturityNote": "Emerging. A published account of whom a channel fails, with the alternative route named beside it, is a legal requirement for UK public sector websites and is monitored and enforced. Nothing yet applies it to an agent channel, where the populations at risk and the route left open both differ.",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For digital-divide research and measurement, which are mature."
        },
        {
          "level": "emerging",
          "note": "For extending that work to agentic exclusion specifically, which is still taking shape."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "GOV.UK — Model accessibility statement",
          "jurisdiction": "UK",
          "source": "https://www.gov.uk/guidance/model-accessibility-statement",
          "tier": "primary",
          "anchor": "model-statement"
        },
        {
          "name": "GOV.UK — Public sector website and mobile application accessibility monitoring",
          "jurisdiction": "UK",
          "source": "https://www.gov.uk/guidance/public-sector-website-and-mobile-application-accessibility-monitoring",
          "tier": "primary",
          "anchor": "a11y-monitoring"
        },
        {
          "name": "Good Things Foundation, \"Digital Nation\"",
          "jurisdiction": "UK",
          "year": 2024,
          "source": "https://www.goodthingsfoundation.org/policy-and-research/research-and-evidence/research-2024/digital-nation",
          "tier": "primary",
          "anchor": "digital-nation"
        },
        {
          "name": "Sumsub newsroom — Catalyst research announcement (source of the 627 million figure)",
          "year": 2024,
          "source": "https://sumsub.com/newsroom/global-businesses-lose-1-75-trillion-from-untapped-economic-potential-of-third-largest-nation/",
          "tier": "evidence",
          "anchor": "sumsub"
        },
        {
          "name": "ISPI, \"The Digital Divide: A Barrier to Social, Economic and Political Equity\" (broader context; ITU ~2.6 billion offline)",
          "source": "https://www.ispionline.it/en/publication/the-digital-divide-a-barrier-to-social-economic-and-political-equity-204564",
          "tier": "evidence"
        },
        {
          "name": "ITU — Measuring Digital Development: Facts and Figures 2024 (rural 48% vs urban 83% internet use)",
          "jurisdiction": "Global",
          "year": 2024,
          "source": "https://www.itu.int/itu-d/reports/statistics/2024/11/10/ff24-internet-use-in-urban-and-rural-areas/",
          "tier": "primary",
          "anchor": "itu"
        }
      ],
      "assurance": "Before and after it deploys an agent-mediated service, government needs to be able to account for who the service will fail and to show that those users still have a working route to the outcome. That account is what a user, an oversight body, or a court relies on to check that the agency knew who the agent channel would fail and kept a route open for them.",
      "access": "The people at risk here are every population an agent channel can lose: users with no affordable internet or capable device, users without the skills or confidence to direct an agent, users with a well-founded distrust of automation after past algorithmic harm, users with disabilities, and users without the legal capacity to act for themselves. As agent channels become the default, the risk to these populations ranges from outright denial, through deterrence, to being shifted onto a slower, lower-quality channel.",
      "openings": [
        "Reach out proactively through the intermediaries those populations already trust: libraries, community organizations, community legal centers.",
        "Provide a non-agent route that delivers the same outcome.",
        "Disaggregate uptake reporting enough that an excluded cohort becomes a number someone must answer for."
      ],
      "surface": {
        "instances": [
          {
            "domain": "policy",
            "kind": "interactive",
            "component": "ExclusionAssessment",
            "annotation": "The populations an agent channel is likely to fail are named in advance, each with a committed alternative that later uptake reporting checks."
          }
        ]
      },
      "whereThingsGoWrong": "The failure mode is a system that serves some populations badly, confronted only after a cohort has been damaged. The assessment itself can also be gamed: completed as a checkbox before launch, or its uptake reporting aggregated so coarsely that a failed cohort disappears inside the average. Naming the at-risk populations before deployment, and reporting uptake disaggregated enough that each named population stays visible, keeps them inside the service rather than leaving them to be found among the harmed.",
      "framing": "Naming, before an agent channel launches, the populations it will fail, and\ncommitting outreach and a working alternative route for each. A population the\nchannel will fail is provided for before launch instead of surfacing later in\ncomplaint and harm data.\n",
      "challenge": "As government delivery moves onto agent-mediated channels, the existing divides of access,\nskills, affordability, trust, and relevance compound into an agentic divide between users\nwith a capable agent and those without one.\n\nThe divides being compounded are already measured: the ITU puts roughly 2.6\nbillion people offline and rural internet use at 48 percent against 83\npercent in cities, 7.9 million UK adults lack basic digital skills, and a\nthird of those offline report difficulty reaching council and government\nservices. Exclusion at the verification step is counted separately again,\nwith survey estimates putting 243 million people at risk because their\nidentity documents are non-standard, and 96 million whose appearance\ndiffers from their ID photo. Left unaddressed, that divide surfaces only\nafter deployment, in complaint volumes and documented harm, once a cohort\nhas already been failed.\n",
      "precedentsNote": "**[UK public sector accessibility statements](#s-model-statement).** The\nregulations require a public sector body to publish its compliance status\nagainst WCAG 2.2 level AA and to list its non-accessible content with the\ncause of each, pointing to an accessible alternative where one exists. The\n[Government Digital Service monitors](#s-a11y-monitoring) a sample, allows\ntwelve weeks for fixes, and refers what is left to the equality regulator.\nA service is already required to name in public whom it fails, and what\nroute it leaves them.\n",
      "transferability": "The existing digital divide research provides the demographic and geographic map of who will\nbe excluded from agent-mediated services. Every barrier to digital services is also a barrier\nto agent-mediated services, plus new barriers: the cognitive complexity of agent interaction,\nthe trust deficit for AI among communities harmed by algorithmic systems, and the\naffordability of capable agents.\n\nThe research maps who is excluded today. Turning that map into an obligation, an assessment\na service must complete before its agent channel launches, is the step with no operating\nprecedent yet.\n"
    },
    {
      "id": "8.1",
      "title": "Certification marks and trust registries",
      "territory": 8,
      "slug": "certification-marks-and-trust-registries",
      "maturity": "emerging",
      "maturityNote": "Emerging. The public registry and trust-badge response is in operation but narrow: a machine-readable mark an agent can query is legislated under CE marking yet not operationally implemented, FedRAMP-style certification is mature for cloud but only beginning to cover AI, and the DPGA registry is live but voluntary and limited in scope.",
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "EU AI Act — Article 48, CE Marking for High-Risk AI Systems",
          "jurisdiction": "EU",
          "year": 2024,
          "source": "https://artificialintelligenceact.eu/article/48/",
          "tier": "evidence",
          "anchor": "ai-act-48"
        },
        {
          "name": "EU AI Act — Article 43, Conformity Assessment",
          "jurisdiction": "EU",
          "year": 2024,
          "source": "https://artificialintelligenceact.eu/article/43/",
          "tier": "evidence",
          "anchor": "ai-act-43"
        },
        {
          "name": "EU AI Act — Article 79, Procedure at National Level for AI Systems Presenting a Risk",
          "jurisdiction": "EU",
          "year": 2024,
          "source": "https://artificialintelligenceact.eu/article/79/",
          "tier": "evidence",
          "anchor": "ai-act-79"
        },
        {
          "name": "FedRAMP Marketplace",
          "jurisdiction": "US",
          "year": 2011,
          "source": "https://www.fedramp.gov/marketplace/",
          "tier": "primary",
          "anchor": "fedramp-marketplace"
        },
        {
          "name": "FedRAMP 20x — certification classes A to D",
          "jurisdiction": "US",
          "year": 2026,
          "source": "https://www.fedramp.gov/20x/",
          "tier": "primary",
          "anchor": "fedramp-20x"
        },
        {
          "name": "FedRAMP Consolidated Rules for 2026 — definitions",
          "jurisdiction": "US",
          "year": 2026,
          "source": "https://www.fedramp.gov/2026/definitions/",
          "tier": "primary"
        },
        {
          "name": "FedRAMP — programme home",
          "jurisdiction": "US",
          "year": 2011,
          "source": "https://www.fedramp.gov/",
          "tier": "primary"
        },
        {
          "name": "FedRAMP — how agencies can reuse an authorization",
          "jurisdiction": "US",
          "year": 2020,
          "source": "https://www.fedramp.gov/archive/2020-05-07-how-agencies-can-reuse-a-fedramp-authorization/",
          "tier": "primary"
        },
        {
          "name": "GSA/FedRAMP 20x AI prioritisation announcement",
          "jurisdiction": "US",
          "year": 2025,
          "source": "https://www.gsa.gov/about-gsa/newsroom/news-releases/gsa-fedramp-prioritize-20x-authorizations-for-ai-08252025",
          "tier": "primary",
          "anchor": "fedramp-20x-ai"
        },
        {
          "name": "Digital Public Goods Alliance Standard",
          "jurisdiction": "International",
          "year": 2019,
          "source": "https://www.digitalpublicgoods.net/standard",
          "tier": "primary",
          "anchor": "dpga-standard"
        },
        {
          "name": "Digital Public Goods Alliance Registry",
          "jurisdiction": "International",
          "year": 2019,
          "source": "https://www.digitalpublicgoods.net/registry",
          "tier": "primary",
          "anchor": "dpga-registry"
        },
        {
          "name": "FPF / OneTrust — Conformity assessments under the EU AI Act (white paper)",
          "jurisdiction": "EU",
          "year": 2025,
          "source": "https://fpf.org/wp-content/uploads/2025/04/OT-comformity-assessment-under-the-eu-ai-act-WP-1.pdf",
          "tier": "evidence"
        },
        {
          "name": "UNICEF — Digital Public Goods Accelerator guide (what is a DPG)",
          "jurisdiction": "International",
          "year": 2024,
          "source": "https://unicef.github.io/publicgoods-accelerator-guide/about-dpgs/what-is-a-dpg/",
          "tier": "evidence"
        },
        {
          "name": "IEEE CertifAIEd — AI ethics certification programme",
          "jurisdiction": "International (IEEE)",
          "year": 2021,
          "source": "https://standards.ieee.org/products-programs/icap/ieee-certifaied/",
          "tier": "primary",
          "anchor": "certifaied"
        },
        {
          "name": "IEEE Beyond Standards — CertifAIEd applied to the City of Vienna",
          "jurisdiction": "Austria",
          "year": 2021,
          "source": "https://standards.ieee.org/beyond-standards/industry/technology-industry/the-ieee-certifaied-framework-for-ai-ethics-applied-to-the-city-of-vienna/",
          "tier": "evidence",
          "anchor": "certifaied-vienna"
        },
        {
          "name": "CEN-CENELEC — acceleration measures for AI Act standards",
          "jurisdiction": "EU",
          "year": 2025,
          "source": "https://www.cencenelec.eu/news-events/news/2025/brief-news/2025-10-23-ai-standardization/",
          "tier": "primary"
        }
      ],
      "assurance": "A widely recognized, independently assured certification mark and public trust registry give a user, agency, or agent a rapid signal that a digital tool has been assessed against known standards. In the EU model the mark is machine-readable, so the agent can query it programmatically. The certifying body or registry operator must keep that assessment current and hold the record behind the mark.",
      "access": "Small builders may be priced out of expensive verification processes: a FedRAMP certification at the Moderate class runs to roughly US$500K–1.5M upfront, and EU conformity assessment needs a Notified Body. The users who rely on the long tail of volunteer-built tools inherit that cost, since the tools that serve them end up with no signal at all. A mark also only works if what it certifies is stated in plain words, or the user reading the registry learns nothing from it.",
      "openings": [
        "Tier certification to risk, so a low-consequence tool can qualify without an enterprise-scale audit.",
        "Pair every machine-readable mark with a plain-language statement of what was checked.",
        "Give the registry entry's badge a text alternative a screen reader can announce, since a visual mark alone tells a user who can't see it nothing about the tool's status."
      ],
      "surface": {
        "instances": [
          {
            "domain": "service",
            "kind": "interactive",
            "component": "TrustRegistry",
            "annotation": "A registry entry carries both a badge a person can read and a code an agent can query."
          }
        ]
      },
      "whereThingsGoWrong": "A trust registry surfaces whether a decision-support tool was ever assessed against a standard. It would not by itself stop a flawed tool, but recording the absence of any conformity assessment makes that gap visible to agencies relying on it.",
      "framing": "A public registry and certification mark for civic tools, readable by a user as a\nbadge and by an agent as machine-readable code. Every user, agent, and agency\nrelying on a tool checks the same assessment instead of each vetting it alone.\n",
      "challenge": "As more services run through an AI agent, and agencies come to rely on more\nthird-party tools, the marks and claims those tools display multiply faster\nthan anyone can verify them. An agent has nothing it can check\nprogrammatically at all. Physical goods have CE marks, electrical safety tags,\nand food-grade certifications; digital tools have no equivalent that is both\nwidely recognized and independently assured.\n",
      "precedentsNote": "**[EU AI Act Article 48](#s-ai-act-48), CE marking for high-risk systems.**\nProviders of high-risk AI systems must undergo conformity assessment and\naffix a CE marking, the symbol long used for physical product safety, and for systems provided digitally the Act requires a digital CE marking\naccessible through the software interface or a machine-readable code. Where\na Notified Body conducted the assessment, its identification number must\nfollow the mark. [Article 79](#s-ai-act-79) carries the withdrawal power:\nmarket surveillance authorities may require an operator to bring a system\ninto compliance, withdraw it, or recall it.\n\n**[EU AI Act Article 43](#s-ai-act-43), who performs the assessment.** For\nthe high-risk categories at points 2 to 8 of Annex III the Act routes a\nprovider to conformity assessment based on internal control, with no\nnotified body involved. A notified body enters at point 1, and there only\nwhere harmonised standards were not applied or were applied in part. The\nmark records the provider's own assessment, across most of the scope, under\na procedure the reader of the mark never sees.\n\n**[The FedRAMP Marketplace](#s-fedramp-marketplace) (US).** The registry\nlists certified cloud service offerings alongside the agencies that\ncertified them and the assessors the program recognizes. FedRAMP's own name\nfor the model is do once, use many: a provider is certified once, and the\nresulting security package can be reused by any federal agency. GSA has\nsince prioritized [20x](#s-fedramp-20x) authorizations for [AI cloud\nservices](#s-fedramp-20x-ai), beginning with conversational engines already\non the government schedule, so a registry model matured on cloud is\nreaching AI one service category at a time.\n\n**[The Digital Public Goods Alliance registry](#s-dpga-registry).** The\nregistry lists verified digital public goods assessed against a\n[nine-indicator standard](#s-dpga-standard) covering SDG relevance,\napproved open licenses, clear ownership, platform independence,\ndocumentation, non-PII data extraction, privacy and applicable laws,\nstandards and best practices, and do-no-harm-by-design. Applicants submit\nevidence online and a technical team reviews against each indicator.\nApproved status lapses after a year unless the tool is reassessed.\n\n**[IEEE CertifAIEd](#s-certifaied), applied by the [City of\nVienna](#s-certifaied-vienna).** The program assesses an AI system\nagainst ethics criteria covering transparency, accountability, algorithmic\nbias, and privacy, and issues a mark on the result. Vienna took the mark on\na municipal service, so a city government rather than a vendor carried it.\n",
      "transferability": "High for the registry pattern; moderate for the CE-marking analogue. The DPGA model (open\nstandard, evidence-based review, public registry) is directly transferable to a national\nregistry of verified civic technology. FedRAMP's do-once-use-many model solves a real\ncoordination problem, but its cost structure has to be reworked for small builders.\n\nThe EU's digital CE marking is the precedent that matters most for agents: a machine-readable\ntrust signal embedded in the product interface rather than a registry listing alone, which is\nthe form an agent can query programmatically.\n"
    },
    {
      "id": "8.2",
      "title": "Nutrition labels for AI tools and datasets",
      "territory": 8,
      "slug": "nutrition-labels-for-ai-tools-and-datasets",
      "maturity": "emerging",
      "maturityLevels": [
        {
          "level": "emerging",
          "note": "For model cards and datasheets, common yet unevenly completed even on platforms built around them, with healthcare labels the most advanced sector application."
        },
        {
          "level": "frontier",
          "note": "For a government-specific nutrition label for civic technology tools, which has yet to be built."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "Model Cards for Model Reporting (Mitchell et al., FAT* '19)",
          "jurisdiction": "International",
          "year": 2019,
          "source": "https://dl.acm.org/doi/10.1145/3287560.3287596",
          "tier": "primary",
          "anchor": "model-cards"
        },
        {
          "name": "Systematic analysis of 32,111 AI model cards (Nature Machine Intelligence)",
          "jurisdiction": "International",
          "year": 2024,
          "source": "https://www.nature.com/articles/s42256-024-00857-z",
          "tier": "evidence",
          "anchor": "model-card-analysis"
        },
        {
          "name": "Datasheets for Datasets (Gebru et al., CACM 64(12))",
          "jurisdiction": "International",
          "year": 2021,
          "source": "https://dl.acm.org/doi/10.1145/3458723",
          "tier": "primary",
          "anchor": "datasheets"
        },
        {
          "name": "Dataset Nutrition Labels (Data Nutrition Project)",
          "jurisdiction": "US",
          "year": 2018,
          "source": "https://datanutrition.org/",
          "tier": "primary",
          "anchor": "data-nutrition"
        },
        {
          "name": "CHAI Health AI Nutrition Label",
          "jurisdiction": "US",
          "year": 2024,
          "source": "https://www.chai.org/blog/health-ai-nutrition-label-advances",
          "tier": "evidence"
        },
        {
          "name": "CHAI — assurance lab certification and nutrition label for health AI (field list)",
          "jurisdiction": "US",
          "year": 2024,
          "source": "https://chai.org/chai-advances-assurance-lab-certification-and-nutrition-label-for-health-ai/",
          "tier": "primary",
          "anchor": "chai-label"
        },
        {
          "name": "Consumer Reports Innovation — Data Nutrition Project",
          "jurisdiction": "US",
          "year": 2025,
          "source": "https://innovation.consumerreports.org/initiatives/data-nutrition-project/",
          "tier": "evidence"
        },
        {
          "name": "Datasheets for Digital Cultural Heritage Datasets — Journal of Open Humanities Data",
          "jurisdiction": "International",
          "year": 2023,
          "source": "https://openhumanitiesdata.metajnl.com/articles/10.5334/johd.124",
          "tier": "primary"
        },
        {
          "name": "IEEE 7003-2024 — Algorithmic Bias Considerations",
          "jurisdiction": "International (IEEE)",
          "year": 2024,
          "source": "https://standards.ieee.org/ieee/7003/6980/",
          "tier": "primary"
        }
      ],
      "assurance": "A structured, glanceable label has to be accurate and kept current. This is the 'ingredient list' that lets a user or agent see what they are consuming, beyond the bare fact that it was approved. The tool's publisher or maintainer must complete that label and keep it updated.",
      "access": "A disclosure standard that demanded specialist effort would exclude the small builder whose tools most often go undocumented. Users inherit that gap: the tools they meet most often disclose the least. An accuracy claim expressed as a raw statistic misleads users who aren't specialists in reading it.",
      "openings": [
        "Set a minimum label small enough to publish without specialist help.",
        "Make it machine-readable, so an agent consumes the same label a user reads.",
        "State the accuracy claim as what the tool can and cannot reliably do, rather than as a raw figure.",
        "Make the rendered label work with a screen reader, not only display visually, or the disclosure never reaches a user who can't see it."
      ],
      "surface": {
        "instances": [
          {
            "domain": "policy",
            "kind": "interactive",
            "component": "NutritionLabel",
            "annotation": "A fixed label states the same required fields for every tool, extended for the higher-risk domains."
          }
        ]
      },
      "whereThingsGoWrong": "The failure mode is a tool whose accuracy claims and currency are left implicit. A nutrition label mandating an 'accuracy claim' and 'last updated' field forces an explicit, checkable statement of what the tool can and cannot reliably compute. A builder can game the label itself: overstate the accuracy claim, or leave 'last updated' stale once the tool has moved on. Because the claim names a specific, checkable capability rather than a vague assurance, a user or downstream agent can test it against the tool's actual behavior and catch the mismatch.",
      "framing": "A standard, glanceable label on every civic tool: what it does, what data it uses,\nwho is accountable, where it falls short. A user choosing a tool and an agent\ninvoking one make the decision on the same disclosed facts.\n",
      "challenge": "A registry entry tells a user or their agent that a tool was approved, not what it\nis. Before relying on a tool, a user needs to see at a glance what it does, what\ndata it uses, who is accountable, and where it is known to fall short. An agent\nneeds the same facts in a form it can read.\n\nWhat serves both is a standard, glanceable disclosure: one schema, rendered for the\nuser's eye and the agent's parser alike.\n",
      "precedentsNote": "**[Model Cards](#s-model-cards) (Mitchell et al.).** The template runs nine\nsections: model details, intended use, factors, metrics, evaluation data,\ntraining data, quantitative analyses, ethical considerations, and caveats.\nAdoption is concentrated rather than universal, with models carrying a card\naccounting for roughly 90 percent of Hugging Face download traffic while\nwell under half of repositories have one. A [systematic analysis of 32,111\ncards](#s-model-card-analysis) found training details most consistently\ncompleted, and environmental impact, limitations, and evaluation lowest.\n\n**[Datasheets for Datasets](#s-datasheets) (Gebru et al.).** By analogy to\nelectronics datasheets, the template runs seven sections: motivation,\ncomposition, collection process, preprocessing and labeling, uses,\ndistribution, and maintenance. A second version focuses on interoperability\nand reuse, and Europeana has adapted the format for cultural heritage\ndatasets. The template moved from preprint to Communications of the ACM,\nwhich is when it became citable as the authoritative text.\n\n**[Dataset Nutrition Labels](#s-data-nutrition).** The free, public-facing,\nvoluntarily disclosed standard is modeled on food labels and covers\nprovenance, quality, and intended use. It is hosted at Consumer Reports as\nan innovation initiative, which places a consumer-advocacy organization\nbehind the format.\n\n**[CHAI health AI nutrition labels](#s-chai-label).** The open-source\napplied model card for healthcare AI carries developer identity, intended\nuses, target patient populations, model type, data types, performance\nmetrics, security and compliance accreditations, maintenance, known risks\nand out-of-scope uses, bias, ethical considerations, and third-party\ninformation such as relevant clinical studies. A domain has specified the\nfield list its own regulators and buyers need.\n",
      "transferability": "The nutrition label metaphor reads clearly to users and suits government digital\nservices. The design challenge is making the label machine-readable for agents as well as\nhuman-readable. A government pattern library can specify a minimum label schema for any\ntool that processes public data or advises users. The CHAI model, sector-specific\nlabels with mandatory fields tailored to the risk domain, is a workable template for\ngovernment adaptation.\n"
    },
    {
      "id": "8.3",
      "title": "Software bills of materials for user-facing tools",
      "territory": 8,
      "slug": "software-bills-of-materials",
      "maturity": "emerging",
      "maturityLevels": [
        {
          "level": "emerging",
          "note": "For the software bill of materials (SBOM), discretionary and agency risk-based in US federal procurement, increasingly mandated in EU regulation, with consumption tooling maturing fast."
        },
        {
          "level": "frontier",
          "note": "For folding an SBOM into civic technology certification, which has no working precedent."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "CISA SBOM (US Executive Order 14028)",
          "jurisdiction": "US",
          "year": 2021,
          "source": "https://www.cisa.gov/sbom",
          "tier": "primary",
          "anchor": "cisa-sbom"
        },
        {
          "name": "CISA SBOM Resources Library",
          "jurisdiction": "US",
          "year": 2025,
          "source": "https://www.cisa.gov/topics/cyber-threats-and-advisories/sbom/sbomresourceslibrary",
          "tier": "primary"
        },
        {
          "name": "White House — EO 14306 (rescinds EO 14144 SBOM/attestation enhancements)",
          "jurisdiction": "US",
          "year": 2025,
          "source": "https://www.whitehouse.gov/presidential-actions/2025/06/sustaining-select-efforts-to-strengthen-the-nations-cybersecurity-and-amending-executive-order-13694-and-executive-order-14144/",
          "tier": "primary",
          "anchor": "eo-14306"
        },
        {
          "name": "OpenSSF — Global alignment on SBOM standards in the era of the CRA",
          "jurisdiction": "EU",
          "year": 2025,
          "source": "https://openssf.org/blog/2025/10/22/sboms-in-the-era-of-the-cra-toward-a-unified-and-actionable-framework/",
          "tier": "evidence",
          "anchor": "openssf-cra"
        },
        {
          "name": "FDA AI/ML Software as a Medical Device guidance (SBOM requirement)",
          "jurisdiction": "US",
          "year": 2025,
          "source": "https://www.fda.gov/medical-devices/software-medical-device-samd/artificial-intelligence-enabled-medical-devices",
          "tier": "primary",
          "anchor": "fda-samd"
        },
        {
          "name": "OWASP Dependency-Track",
          "jurisdiction": "International",
          "year": 2024,
          "source": "https://dependencytrack.org/",
          "tier": "evidence",
          "anchor": "dependency-track"
        },
        {
          "name": "CycloneDX Sunshine — SBOM visualization",
          "jurisdiction": "Global",
          "year": 2024,
          "source": "https://cyclonedx.github.io/Sunshine/",
          "tier": "evidence",
          "anchor": "cyclonedx"
        }
      ],
      "assurance": "The confidence needed is that the dependency record is accurate, and that an agent can read it as reliably as a person can. The tool's publisher or maintainer must generate that record and keep it current as dependencies change.",
      "access": "The builders most at risk of exclusion are the small ones. A volunteer or single-developer civic tool can't run a manual supply-chain audit for every release. If the record is priced in analyst hours, the long tail opts out, and the users who depend on those tools are left with no signal about them.",
      "openings": [
        "Make the dependency record something a build step generates and keeps updated automatically.",
        "Mark a tool that can't yet produce one as unverified rather than excluded.",
        "State its meaning in plain language: 'all dependencies current, no known vulnerabilities' says something to a user, where a raw vulnerability count does not.",
        "State the status badge's meaning in words, so it reaches a screen-reader user rather than being conveyed only by a color or icon change."
      ],
      "surface": {
        "instances": [
          {
            "domain": "service",
            "kind": "interactive",
            "component": "SupplyChainStatus",
            "annotation": "The badge recomputes as the tool's components change, so it reflects current supply-chain risk rather than the state on approval day."
          }
        ]
      },
      "whereThingsGoWrong": "An SBOM addresses component-level supply-chain integrity, not algorithmic correctness. It would not catch a flawed calculation method, which is a methodology failure rather than a compromised dependency.",
      "framing": "A queryable record of what a tool is built from, kept current as its dependencies\nchange.\n",
      "challenge": "Agents and the tools they call chain together libraries, models,\nand data drawn from other providers. A user reaching a service through an agent,\nor an agency standing behind a tool, ends up trusting a dependency chain longer\nthan anyone has inventoried. Approval on the day a\ntool is certified says nothing about whether one of those parts has since\nbecome vulnerable or changed underneath it.\n\nKnowing what a tool depends on, and keeping that knowledge current, is what lets trust\nreflect the tool's state now rather than its state on approval day.\n",
      "precedentsNote": "**[Executive Order 14028 and CISA SBOM guidance](#s-cisa-sbom) (US).** The\norder directed work toward software supply-chain security including\nsoftware bills of materials, and CISA published minimum-elements guidance\nand maintains an SBOM resources library. The federal mandate has since been\nrolled back: [EO 14306](#s-eo-14306) rescinded the SBOM and attestation\nenhancements, and an OMB memorandum makes vendor SBOMs and security\nattestations a matter for agency risk-based assessment. The artifact\nsurvived the mandate that produced it.\n\n**The [EU Cyber Resilience Act](#s-openssf-cra), aligned by OpenSSF.** The CRA mandates SBOMs\nfor products with digital elements sold in the European market, and OpenSSF\nand others are aligning the SPDX and CycloneDX standards across US and EU\nrequirements. The requirement moved to the market rather than to the\nprocurer.\n\n**[FDA SBOM requirements for AI medical devices](#s-fda-samd) (US).** The\npremarket guidance for AI-enabled device software functions requires an\nSBOM so vulnerabilities can be tracked. It carries the requirement out of\ngeneral IT procurement and into domain-specific safety regulation.\n\n**[SBOM visualization tooling](#s-dependency-track).** OWASP\nDependency-Track ingests SBOMs by API and evaluates them against live\nvulnerability intelligence, and [CycloneDX Sunshine](#s-cyclonedx) renders\ninteractive radial dependency graphs. Tooling is what makes an SBOM\nconsumable by someone outside a security team.\n",
      "transferability": "High for supply-chain transparency; moderate for user-facing UX. SBOMs are essential\ninfrastructure for any trust registry or certification regime: they enable ongoing\nmonitoring. The user-facing design challenge is translating SBOM data into a meaningful\nsignal. For AI agents, SBOMs provide structured, queryable metadata that can ground\ndecisions about whether to rely on a tool.\n"
    },
    {
      "id": "8.4",
      "title": "Risk-proportionate review of civic tools",
      "territory": 8,
      "slug": "app-store-verification-as-precedent",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "established",
          "note": "As a consumer-app review precedent, documented in Apple's own App Review Guidelines and Google Play's own developer policies: expert review plus malware scanning, with mandatory structured data-collection disclosure."
        },
        {
          "level": "frontier",
          "note": "As a tiered-review model for civic technology, which no jurisdiction has built."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "App Review Guidelines — Apple Developer",
          "jurisdiction": "Global",
          "source": "https://developer.apple.com/app-store/review/guidelines/",
          "tier": "primary",
          "anchor": "apple-guidelines"
        },
        {
          "name": "App Review — Apple Developer (review-time metric)",
          "jurisdiction": "Global",
          "source": "https://developer.apple.com/distribute/app-review/",
          "tier": "primary",
          "anchor": "apple-review"
        },
        {
          "name": "Provide information for Google Play's Data safety section — Play Console Help",
          "jurisdiction": "Global",
          "source": "https://support.google.com/googleplay/android-developer/answer/10787469?hl=en",
          "tier": "primary",
          "anchor": "play-data-safety"
        },
        {
          "name": "Apple App Store review (fraud prevention 2025)",
          "jurisdiction": "US",
          "year": 2025,
          "source": "https://www.apple.com/newsroom/2026/05/the-app-store-stopped-over-2-point-2-billion-usd-in-fraudulent-transactions-in-2025/",
          "tier": "evidence"
        },
        {
          "name": "SecurityWeek — Apple rejected 2 million App Store submissions in 2025",
          "jurisdiction": "US",
          "year": 2025,
          "source": "https://www.securityweek.com/apple-rejected-2-million-app-store-submissions-in-2025-for-security-and-fraud-prevention/",
          "tier": "evidence",
          "anchor": "apple-rejections"
        },
        {
          "name": "NowSecure — App store security myths (Google Play Protect)",
          "jurisdiction": "US",
          "year": 2025,
          "source": "https://www.nowsecure.com/blog/2025/03/26/app-store-security-myths-why-enterprises-cant-solely-rely-on-apple-and-google-for-security-reviews/",
          "tier": "evidence"
        },
        {
          "name": "Security Boulevard — App store security threats in 2025",
          "jurisdiction": "US",
          "year": 2025,
          "source": "https://securityboulevard.com/2025/06/app-store-security-threats-in-2025-why-hackers-target-mobile-ecosystems/",
          "tier": "evidence",
          "anchor": "appstore-threats"
        }
      ],
      "assurance": "Government needs a level of review that scales to what a tool can affect: light enough that every tool can pass quickly, deep enough that a tool capable of real harm gets a harder look. The aim is a credible minimum bar, not an exhaustive audit of every tool.",
      "access": "The exclusion risk is concentration. An opaque review gate denies the small builder who can't read the rules they're judged against, or can't appeal a rejection. When a queue is built for enterprises, it delays the communities waiting on their tools.",
      "openings": [
        "Publish the review criteria, so anyone can see what is checked.",
        "Keep the lightest tier cheap and fast enough for a solo builder.",
        "Provide a real appeal route, and never vest review authority in a single entity that can exclude without recourse.",
        "Make the submission flow operable by keyboard and screen reader, or a solo builder who relies on assistive technology meets a barrier before the review even starts."
      ],
      "surface": {
        "instances": [
          {
            "domain": "service",
            "kind": "interactive",
            "component": "SubmissionReview",
            "annotation": "Review burden scales with consequence, so an informational tool clears automated checks and a decision-support tool goes to a human."
          }
        ]
      },
      "whereThingsGoWrong": "App-store review checks behavior against stated policies, not the ground-truth accuracy of outputs. A binary approved/rejected gate of this kind would not catch a method that produces plausible-looking but incorrect results, which pass any behavioral check.",
      "framing": "Review depth scaled to consequence: an automated check every tool passes quickly,\nhuman review reserved for the tools that can do real harm, and takedown when\nsomething slips through. Reserving human review for the tools that can do real\nharm keeps certification fast enough that developers seek it.\n",
      "challenge": "The tools and agents a user might use to deal with government range from a harmless\ninformation lookup to something that files a claim or shapes a decision. Reviewing every one\nto the same depth is neither affordable nor useful, but reviewing none leaves users\nrelying on tools no one has checked.\n\nThe gap will only widen as the population of tools gets larger and keeps changing.\n",
      "precedentsNote": "**[Apple App Review](#s-apple-guidelines).** Apple's guidelines state that\n'every app is reviewed by experts' and that Apple scans 'each app for\nmalware and other software that may impact user safety, security, and\nprivacy', combining automated scanning with human review of app flows,\npermissions, and usability. App Review evaluated more than 9.1 million\nsubmissions in a year and [rejected over 2 million](#s-apple-rejections).\nApple's [published review-time metric](#s-apple-review) is that on average\n90 percent of submissions are reviewed in under 24 hours.\n\n**[Google Play's Data safety section](#s-play-data-safety).** Google relies\nmore heavily on automated machine-learning checks, triggering human review\nfor flagged or sensitive categories, and its developer documentation\nrequires every app to declare how it collects, shares, and protects user\ndata before anyone installs it. The declaration is a condition of\ndistribution, and it is the direct analogue of Apple's disclosure\nrequirement.\n\n**[Known limitations of App Store and Play review](#s-appstore-threats).** Malware\nregularly bypasses review through code obfuscation, delayed execution, and\ncompromised third-party SDKs, with multiple incidents traced to vulnerable\nadvertising SDKs. Store review is a minimum-bar filter and not an\nexhaustive security audit, and enterprises are advised not to treat\npresence in a store as sufficient assurance.\n",
      "transferability": "The app-store model shows that centralized review at scale is feasible but imperfect.\nTransferable elements: structured disclosure requirements (the Data Safety section is a\nnutrition label by another name); tiered review (automated first pass, human review for\nhigh-risk categories); post-publication monitoring and takedown. Limitations: review checks\nbehavior against stated policies, not ground-truth accuracy; it concentrates review authority in a\nsingle entity; and it is binary rather than graded.\n\nA civic registry should adopt the tiered review model but add domain-specific accuracy checks\nand make criteria publicly auditable.\n"
    },
    {
      "id": "8.5",
      "title": "Lifecycle certification for tools that advise users",
      "territory": 8,
      "slug": "medical-device-certification-as-analogue",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "established",
          "note": "As a medical-device regime."
        },
        {
          "level": "frontier",
          "note": "As a lifecycle-certification model adapted for civic technology, which has no working precedent."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "FDA AI/ML Software as a Medical Device",
          "jurisdiction": "US",
          "year": 2025,
          "source": "https://www.fda.gov/medical-devices/software-medical-device-samd/artificial-intelligence-enabled-medical-devices",
          "tier": "primary",
          "anchor": "fda-samd"
        },
        {
          "name": "Ballard Spahr — FDA AI guidance, August 2025",
          "jurisdiction": "US",
          "year": 2025,
          "source": "https://www.ballardspahr.com/insights/alerts-and-articles/2025/08/fda-issues-guidance-on-ai-for-medical-devices",
          "tier": "evidence"
        },
        {
          "name": "FDA — Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (3 February 2026)",
          "jurisdiction": "US",
          "year": 2026,
          "source": "https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-management-system-considerations-and-content-premarket",
          "tier": "primary",
          "anchor": "fda-cyber"
        },
        {
          "name": "TGA AI and Medical Device Software",
          "jurisdiction": "Australia",
          "year": 2026,
          "source": "https://www.tga.gov.au/products/medical-devices/software-and-artificial-intelligence/manufacturing/artificial-intelligence-ai-and-medical-device-software",
          "tier": "primary",
          "anchor": "tga-samd"
        },
        {
          "name": "TGA consultation report — clarifying and strengthening regulation of medical device software including AI",
          "jurisdiction": "Australia",
          "year": 2025,
          "source": "https://consultations.tga.gov.au/tga/clarifying-and-strengthening-the-regulation-of-ai/supporting_documents/tga-report-clarifying-and-strengthening-the-regulation-of-medical-device-software-including-artificial-intelligence-aipdf",
          "tier": "primary",
          "anchor": "tga-consultation"
        }
      ],
      "assurance": "Government needs assurance that scales with consequence and lasts: certification has to impose ongoing obligations for the higher-consequence tools, and it is treated as a standing commitment rather than a one-time stamp. The tool's operator, or the certifying body overseeing it, must meet those ongoing obligations.",
      "access": "Lifecycle obligations fall hardest on the smallest builders, who have no regulatory-affairs team for continuous monitoring. Duties pitched at the medical-device level are unworkable for volunteer-built civic tools, so builders exit rather than comply. Users who relied on those tools are left without the tool, or without a signal about it.",
      "openings": [
        "Scale the obligation to risk: a low-consequence tool should face almost none, and the demanding lifecycle duties are reserved for the high-consequence tools that warrant them.",
        "Offer small builders shared monitoring infrastructure rather than demanding it of them.",
        "Make the classification intake work for a builder using a screen reader, or the step that sets every tool's obligations excludes some builders before it even asks a risk question."
      ],
      "surface": {
        "instances": [
          {
            "domain": "policy",
            "kind": "interactive",
            "component": "RiskClassification",
            "annotation": "A tool's obligations are set by what it claims to do and the consequence of getting it wrong, not by whether it contains AI."
          }
        ]
      },
      "whereThingsGoWrong": "A medical-device-style regime would classify an automated decision tool as high-consequence and require lifecycle monitoring and accuracy validation against reference data, exactly the scrutiny a high-stakes calculation often never receives. A tool can game the classification by understating its own intended purpose, describing a benefits calculator as merely informational to stay in a lower tier and dodge the lifecycle monitoring a decision-support classification would trigger. Catching that means checking what the tool does against its declared purpose, not taking the declaration at its word.",
      "framing": "Certifying a tool by what its output can affect, and holding it to that claim for\nas long as it runs: monitoring for drift, checking for bias, renewing rather than\nexpiring. A tool that drifts after approval is caught by the monitoring instead of\nkeeping a certification it no longer meets.\n",
      "challenge": "Some of the tools and agents users use give advice that changes their lives: what benefit\nthey are owed, whether a plan will be approved, what their legal rights are. A tool like that\nneeds to be held to its claim not once but for as long as it is in use, because its accuracy\ncan drift as data, rules, and models change.\n",
      "precedentsNote": "**[FDA AI/ML software as a medical device](#s-fda-samd) (US).** The FDA's\npublic database lists over 1,250 authorized AI-enabled medical devices, up\nfrom 950 the year before. Draft guidance recommends lifecycle management\ncovering post-market performance monitoring, algorithmic bias assessment,\nand transparency. A rule incorporating ISO 13485 by reference replaced the\nearlier quality-system regulation.\n\n**[FDA premarket cybersecurity guidance](#s-fda-cyber).** The guidance sets\na secure-by-design objective, defining a device 'designed from the outset\nto be secure within its system and/or network of use throughout the device\nlifecycle', and expects a software bill of materials. Security is assessed\nas part of premarket review, and not as a separate compliance exercise\nafterward.\n\n**[TGA AI and medical device software](#s-tga-samd) (Australia).** The\nTherapeutic Goods Administration published its final report on AI in\nhealthcare and followed it with [guidance on when AI-based software as a\nmedical device is regulated](#s-tga-consultation). The framework is\ntechnology-agnostic and risk-based: regulation is triggered by the\nmanufacturer's intended purpose, and not by the presence of AI features.\n",
      "transferability": "High for principles; moderate for direct adoption. Transferable principles:\nrisk-proportionate classification (not all tools need the same scrutiny); lifecycle\nmanagement (certification is ongoing, not one-time); intended-purpose triggers (regulate by\nwhat the tool claims to do, not the technology it uses); SBOM and \"secure by design\" as\nbaseline. The TGA's technology-agnostic, risk-based approach is especially relevant: it\navoids regulating \"AI\" as a category and focuses on the consequences of outputs.\n\nThe main limitation is scale. Medical device certification is resource-intensive and assumes\na commercial manufacturer with regulatory-affairs capacity, which volunteer-built civic tools\ncannot match.\n"
    },
    {
      "id": "8.6",
      "title": "From voluntary framework to certifiable standard",
      "territory": 8,
      "slug": "nist-ai-rmf-and-certification-infrastructure",
      "maturity": "emerging",
      "maturityNote": "Emerging. Frameworks exist and are widely used, but they are voluntary, and no jurisdiction has yet implemented a mandatory, auditable certification regime for general-purpose civic technology tools based on them.",
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "NIST AI Risk Management Framework",
          "jurisdiction": "US",
          "year": 2023,
          "source": "https://www.nist.gov/itl/ai-risk-management-framework",
          "tier": "primary",
          "anchor": "nist-airmf"
        },
        {
          "name": "NIST AI 600-1 — Generative AI Profile",
          "jurisdiction": "US",
          "year": 2024,
          "source": "https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf",
          "tier": "primary",
          "anchor": "nist-genai"
        },
        {
          "name": "NIST IR 8596 — Cyber AI Profile (initial preliminary draft)",
          "jurisdiction": "US",
          "year": 2025,
          "source": "https://csrc.nist.gov/pubs/ir/8596/iprd",
          "tier": "primary",
          "anchor": "nist-cyber-profile"
        },
        {
          "name": "NIST AI Resource Center — crosswalk documents",
          "jurisdiction": "US",
          "year": 2024,
          "source": "https://airc.nist.gov/AI_RMF_Knowledge_Base/Crosswalks",
          "tier": "primary",
          "anchor": "nist-crosswalks"
        },
        {
          "name": "Australian Public Service AI Plan 2025",
          "jurisdiction": "Australia",
          "year": 2025,
          "source": "https://www.digital.gov.au/policy/ai/australian-public-service-ai-plan-2025",
          "tier": "primary",
          "anchor": "aps-ai-plan"
        },
        {
          "name": "Pilot AI Assurance Framework (Australia)",
          "jurisdiction": "Australia",
          "year": 2024,
          "source": "https://www.digital.gov.au/policy/ai/pilot-ai-assurance-framework",
          "tier": "primary"
        },
        {
          "name": "National Framework for the Assurance of AI in Government (Australia)",
          "jurisdiction": "Australia",
          "year": 2024,
          "source": "https://www.finance.gov.au/government/public-data/data-and-digital-ministers-meeting/national-framework-assurance-artificial-intelligence-government",
          "tier": "primary",
          "anchor": "au-assurance"
        },
        {
          "name": "ISO/IEC 42005:2025 — AI system impact assessment",
          "jurisdiction": "International",
          "year": 2025,
          "source": "https://www.iso.org/standard/42005",
          "tier": "primary"
        },
        {
          "name": "ISO/IEC 42006:2025 — requirements for AI management system certification bodies",
          "jurisdiction": "International",
          "year": 2025,
          "source": "https://www.iso.org/standard/42006",
          "tier": "primary",
          "anchor": "iso-42006"
        },
        {
          "name": "ETSI EN 304 223 — baseline cyber security requirements for AI models and systems",
          "jurisdiction": "EU (ETSI)",
          "year": 2025,
          "source": "https://www.etsi.org/deliver/etsi_en/304200_304299/304223/02.01.01_60/en_304223v020101p.pdf",
          "tier": "primary"
        },
        {
          "name": "NIST CAISI — AI Agent Standards Initiative",
          "jurisdiction": "US",
          "year": 2026,
          "source": "https://www.nist.gov/news-events/news/2026/02/announcing-ai-agent-standards-initiative-interoperable-and-secure",
          "tier": "primary"
        },
        {
          "name": "NIST COSAiS — SP 800-53 control overlays for securing AI systems",
          "jurisdiction": "US",
          "year": 2026,
          "source": "https://csrc.nist.gov/projects/cosais",
          "tier": "primary",
          "anchor": "nist-cosais"
        }
      ],
      "assurance": "Government needs a certification regime that rests on a recognized risk-management structure but goes beyond it: a defined, auditable bar that means the same thing across jurisdictions, not just a shared vocabulary. The certifying body must run the assessment and maintain that auditable record.",
      "access": "An all-or-nothing standard excludes by pricing. The small builder for whom full assurance is out of reach stays uncertified, and their sound tool goes unused. Users who would have been best served by that tool are pushed toward whatever else met the bar.",
      "openings": [
        "Build graduated tiers on the same framework, so a low-risk tool can reach a meaningful, achievable level instead of failing the only bar on offer.",
        "State each tier's meaning in plain language, so users can tell what 'certified' did and did not check.",
        "Make the self-assessment workflow completable with a screen reader and keyboard alone, or a builder who relies on assistive technology can't reach the tier a low-risk tool would otherwise qualify for."
      ],
      "surface": {
        "instances": [
          {
            "domain": "policy",
            "kind": "interactive",
            "component": "FrameworkAssessment",
            "annotation": "A tiered self-assessment turns a tool's coverage of a risk-management framework into the certification level the framework itself leaves undefined."
          }
        ]
      },
      "whereThingsGoWrong": "The RMF's Govern/Map/Measure/Manage discipline (accountability for each AI use case and risk-based action) is exactly the assurance process a flawed automated decision lacks. Applied as a mandatory, auditable regime, it forces explicit ownership and measurement of the risk. A tool can satisfy the four functions on paper, governance documented, measurement logged, while no action follows when the numbers call for it. What catches that is auditing the self-assessment against the tool's actual practice, not accepting the completed assessment as the certification itself.",
      "framing": "Turning a voluntary risk-management framework into a certifiable standard, with a bar\na tool can be checked against.\n",
      "challenge": "Certifying a user-facing tool or agent requires a standard to certify against, and the\nstandard has to say what passes and what does not. The risk-management frameworks that exist\ngive a shared vocabulary and a sensible structure, but they are voluntary and set no\nthreshold, so two builders can both claim to follow one and mean very different things.\n\nTurning a framework into a defined, auditable standard, one a tool can pass or\nfail, is the step no jurisdiction has taken.\n",
      "precedentsNote": "**[The NIST AI Risk Management Framework](#s-nist-airmf) (US).** The\nframework organizes AI risk management around four functions: Govern, Map,\nMeasure, and Manage. The [Generative AI Profile](#s-nist-genai) addresses\ngenerative risks, supply-chain vulnerabilities, and third-party model\nassessment, and a [Cyber AI Profile](#s-nist-cyber-profile) has reached an\ninitial preliminary draft. The [control overlays for\nAI](#s-nist-cosais) remain announced and provisional.\n\n**The [NIST AI Resource Center crosswalks](#s-nist-crosswalks).**\nNIST states that the AI RMF 'is intended for voluntary use' and records\nthat it 'is being revised'. Its AI Resource Center hosts crosswalks\nsubmitted by the framework's own user community, including one to ISO/IEC\n42001, while stating that inclusion 'does not imply NIST endorsement' of\nthe mapped resource. A crosswalk aligns vocabulary and sets no threshold,\nand the mapping toward a certifiable standard is being drawn by the user\ncommunity rather than by the body that wrote the framework.\n\n**[Australia's national AI assurance framework](#s-au-assurance).** The\nframework for AI assurance in government was agreed by Data and Digital\nMinisters, and the [AI Plan for the Australian Public\nService](#s-aps-ai-plan) rests on three pillars: Trust covering\ntransparency, ethics and governance, People covering capability building\nand engagement, and Tools covering access, infrastructure and support.\nChief AI Officers are the named leadership mechanism for adoption.\n\n**[ISO/IEC 42006](#s-iso-42006), requirements for certification bodies.**\nThe standard sets what a body must satisfy to audit and certify an AI\nmanagement system against ISO/IEC 42001, covering competence, impartiality,\nand audit duration. A voluntary framework becomes certifiable when the\nbodies assessing it are themselves accredited.\n",
      "transferability": "High for risk-management structure; moderate as certification basis. The NIST RMF provides\nthe vocabulary and structure a certification regime would assess against.\n\nA government pattern library should treat the RMF (or its Australian equivalent) as the\nreference framework and define certification tiers on top of it. The Australian AI Assurance\nFramework is a useful precedent, having taken a government assurance framework toward exactly\nthis kind of structured, accountable use.\n"
    },
    {
      "id": "8.7",
      "title": "Grounding and source attribution in AI outputs",
      "territory": 8,
      "slug": "grounding-and-source-attribution-in-ai-outputs",
      "maturity": "emerging",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For retrieval-augmented generation architecture, whose evaluation is now documented in the NIST/TREC 2025 RAG Track proceedings, not only preprint research and vendor commentary."
        },
        {
          "level": "emerging",
          "note": "For citation interface design."
        },
        {
          "level": "frontier",
          "note": "For typed-function grounding in government services, which has no working precedent."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "Overview of the TREC 2025 RAG Track — NIST/TREC proceedings",
          "jurisdiction": "International",
          "year": 2026,
          "source": "https://trec.nist.gov/pubs/trec34/papers/Overview_rag.pdf",
          "tier": "primary",
          "anchor": "trec-rag"
        },
        {
          "name": "TREC 2025 RAG Track (preprint — not peer-reviewed)",
          "jurisdiction": "International",
          "year": 2025,
          "source": "https://arxiv.org/abs/2603.09891",
          "tier": "evidence"
        },
        {
          "name": "Lewis et al. — Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks (NeurIPS 2020)",
          "jurisdiction": "International",
          "year": 2020,
          "source": "https://proceedings.neurips.cc/paper/2020/hash/6b493230205f780e1bc26945df7481e5-Abstract.html",
          "tier": "primary",
          "anchor": "lewis-rag"
        },
        {
          "name": "Moveworks — improved AI grounding with agentic RAG",
          "jurisdiction": "International",
          "year": 2025,
          "source": "https://www.moveworks.com/us/en/resources/blog/improved-ai-grounding-with-agentic-rag",
          "tier": "evidence",
          "anchor": "agentic-rag"
        },
        {
          "name": "Whitehat SEO — AI engines citation comparison",
          "jurisdiction": "International",
          "year": 2025,
          "source": "https://whitehat-seo.co.uk/blog/ai-engines-comparison-citations",
          "tier": "evidence",
          "anchor": "citation-comparison"
        }
      ],
      "assurance": "Government needs every substantive claim an agent presents to be traceable to an authoritative source a user or agent can check. A figure or a rule the agent states can then be confirmed against the record it came from rather than taken on the model's word. For high-consequence answers it needs assurance that the content was retrieved from that record at all, not produced by the model. The agency or data owner behind that source must keep the record retrievable and current.",
      "access": "A mandatory per-claim citation and typed-function grounding requirement would exclude the small builder with no budget for bespoke retrieval infrastructure. A citation a user can't evaluate serves them nothing, however rigorous it looks.",
      "openings": [
        "Publish shared, reusable grounding and citation components a small builder can adopt rather than build.",
        "Pair them with a source panel that states in plain words what the source is, when it was current, and who stands behind it, so checking a claim never requires knowing what a URL means.",
        "Make the citation and source panel work with a screen reader, or the check this pattern exists for is closed to a user who can't see the panel open."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "GroundedAnswer",
            "annotation": "Every factual claim in the answer is retrieved from a named source rather than generated, and cited where it appears."
          }
        ]
      },
      "whereThingsGoWrong": "The failure mode is a system generating a figure from inference rather than reading the authoritative record. Typed, read-only grounding against that record means it reports the actual value rather than an invented one, eliminating the class of fabricated numbers that drive wrongful determinations. Grounding can still fail if the record it reads from is stale or has been altered upstream, since a citation pointing to a wrong record looks identical to one pointing to a correct one. A model can also cite a real source while adding detail the source never stated, producing an answer that looks grounded but isn't. Catching either means checking the cited passage against the claim, not just checking that a citation exists.",
      "framing": "Anchoring every substantive claim an agent makes to a source the user or the next\nagent can check: per-claim citations, a source panel, and typed read-only\nretrieval for the answers that matter most. A user or a downstream agent can check\nany claim against its source before acting on it.\n",
      "challenge": "When an AI agent retrieves information from a public-data tool and presents it to a user,\nthe user needs to be able to trace where each claim came from and check it against the\nsource.\n\nThe grounding problem is narrower than certifying the tool as a whole: the question is\nwhether this specific output is traceable to a specific source.\n",
      "precedentsNote": "**[Retrieval-augmented generation](#s-lewis-rag), Lewis et al. at\nNeurIPS.** RAG\nsystems retrieve documents from a corpus, inject them into context, and\ngenerate answers grounded in the retrieved content. The founding paper\nreports that grounded models produce more specific, diverse, and factual\nlanguage than an equivalent model generating from its parameters alone. No\nmeasurement of reduced hallucination accompanies that result, and\n[engineering commentary](#s-agentic-rag) makes the same point from the\nother side: retrieval imposes no truthfulness on what the model then\nwrites.\n\n**[The TREC RAG Track](#s-trec-rag).** The NIST-run evaluation formalizes\nassessment across relevance, completeness, attribution verification, and\nagreement analysis, over more than 150 submissions. Attribution\nverification is scored as its own dimension, separately from whether the\nanswer is right.\n\n**[Citation UX across AI assistants](#s-citation-comparison).** Patterns\nvary substantially: Perplexity gives inline per-claim attribution with a\npersistent source panel, ChatGPT gives inline numbered references with\nexpandable source cards, and Google AI Overviews shows a source list\nwithout guaranteed inline attribution. Industry comparisons report low\noverlap between platforms in which sources they cite for the same query.\nThose figures are methodology-dependent, with no independent primary\nmeasurement behind them.\n",
      "transferability": "Source attribution transfers directly and is a requirement for government AI services. The\npattern library can specify a set of components.\n\nInline citation is mandatory for any claim derived from a specific source, attributed per\nclaim as in the Perplexity model rather than gathered into an end-of-response list. A source\npanel shows the authoritative source, its date, and institutional provenance. Typed function\ngrounding is the preferred architecture for factual questions about government data: it is\nstronger than retrieval-augmented generation (RAG) alone because it removes the generation\nstep for substantive content. Machine-readable provenance metadata lets downstream agents\nverify source chains programmatically.\n"
    },
    {
      "id": "8.8",
      "title": "Lightweight certification for the long tail",
      "territory": 8,
      "slug": "lightweight-certification-for-the-long-tail",
      "maturity": "frontier",
      "maturityNote": "Frontier. No jurisdiction has implemented a tiered, proportionate certification regime for civic technology tools. The components exist (nutrition labels, software bill of materials tooling, peer review networks) but have not been assembled into a coherent program.",
      "status": "published",
      "dependsOn": [
        "8.2",
        "8.3",
        "8.4"
      ],
      "seeAlso": [],
      "precedents": [
        {
          "name": "EU AI Act small-business guide (SME proportionality measures)",
          "jurisdiction": "EU",
          "year": 2024,
          "source": "https://artificialintelligenceact.eu/small-businesses-guide-to-the-ai-act/",
          "tier": "evidence",
          "anchor": "ai-act-sme"
        },
        {
          "name": "EU AI regulatory sandbox approaches — member-state overview",
          "jurisdiction": "EU",
          "year": 2025,
          "source": "https://artificialintelligenceact.eu/ai-regulatory-sandbox-approaches-eu-member-state-overview/",
          "tier": "evidence"
        },
        {
          "name": "Digital Public Goods Alliance Standard (lightweight model)",
          "jurisdiction": "International",
          "year": 2019,
          "source": "https://www.digitalpublicgoods.net/standard",
          "tier": "primary",
          "anchor": "dpga-standard"
        },
        {
          "name": "FedRAMP 20x — certification classes A to D",
          "jurisdiction": "US",
          "year": 2026,
          "source": "https://www.fedramp.gov/20x/",
          "tier": "primary",
          "anchor": "fedramp-20x"
        },
        {
          "name": "OWASP Dependency-Track (automated assurance tooling)",
          "jurisdiction": "International",
          "year": 2024,
          "source": "https://dependencytrack.org/",
          "tier": "evidence",
          "anchor": "dependency-track"
        },
        {
          "name": "Hugging Face model card automation research",
          "jurisdiction": "International",
          "year": 2023,
          "source": "https://arxiv.org/pdf/2309.12616",
          "tier": "evidence",
          "caveat": "preprint",
          "anchor": "card-automation"
        }
      ],
      "assurance": "A tiered certification model matches the confidence delivered to the risk a tool poses: an informational tool needs only a checkable claim, a decision-support tool needs a second party's sign-off, and a consequential tool needs an assessment independent of its own maker. The long tail of civic technology can then hold a meaningful trust signal without enterprise-scale compliance cost. For each tier, the peer body or accredited assessor must run that review and stand behind its result.",
      "access": "Solo developers and small volunteer teams can't clear a lowest tier that takes more than a weekend, or a step up that means starting over. If the only certification on offer costs millions and needs a Notified Body, the long tail opts out entirely. Users who rely on volunteer-built tools inherit that consequence: those tools end up with no signal at all.",
      "openings": [
        "Hold the binding constraint absolute: the lowest tier, a self-declared nutrition label, must be achievable by a solo developer in a weekend.",
        "Publish every tier's criteria in plain language.",
        "Let a tool move between tiers as it grows, so stepping up never means starting over against a different regime."
      ],
      "surface": {
        "instances": [
          {
            "domain": "service",
            "kind": "interactive",
            "component": "CertificationWizard",
            "annotation": "The lowest tier asks a developer to self-declare, with no third-party gate, so a solo team can clear it in a weekend."
          }
        ]
      },
      "whereThingsGoWrong": "A tiered regime would classify an automated decision tool with legal and financial consequence at its highest tier and require independent accuracy testing against reference data (assurance such tools often never undergo). Low-risk informational tools would still get a weekend-scale path. The tiering itself invites gaming: a builder can self-declare a decision-support tool as merely informational to stay in the cheap, no-review Tier 1. What catches that mismatch is the same nutrition label the tier requires: if the label's own description of what the tool does doesn't match an informational claim, anyone reading the registry can see it.",
      "framing": "A certification ladder the long tail can climb, with a rung matched to what a tool\ncan affect. A tool built by one developer can still qualify for a checkable trust signal,\nkeeping the long tail inside the certification system.\n",
      "challenge": "Every established certification route assumes an applicant with an institutional budget and\ncompliance staff: a FedRAMP certification runs into the millions, an FDA submission needs a\nregulatory-affairs team, and EU conformity assessment needs extensive documentation or a\nNotified Body. A solo developer can't clear any of those bars. Neither can a small volunteer\nteam. Yet a benefits calculator or a community planning-data explorer built by exactly that kind\nof team is what users rely on most, and most need a trust signal for.\n\nWhat is missing is a certification path light enough for a solo developer or small volunteer\nteam to use.\n",
      "precedentsNote": "**[EU AI Act proportionality for SMEs](#s-ai-act-sme).** Conformity\nassessment fees must be proportional to SME size, simplified documentation\ntemplates are permitted, and regulatory sandboxes must offer SMEs and\nstartups priority access free of charge. The provisions apply to commercial\nproviders, and volunteer-built open-source tools fall outside the\ncommercial regulatory perimeter entirely.\n\n**[The DPGA Standard as a lightweight model](#s-dpga-standard).** The\nnine-indicator standard runs on open criteria, evidence-based\nself-assessment, technical review by the registry operator, and public\nlisting, so the cost to an applicant is assembling documentation rather\nthan paying fees or commissioning an audit. It assesses openness and\ngovernance. It does not assess accuracy or fitness for purpose.\n\n**FedRAMP's [20x certification classes](#s-fedramp-20x).** FedRAMP replaced its\nLow, Moderate, and High impact levels with certification classes A through\nD, keeping one program while grading what it certifies. Medical device risk\nclasses do the same work in another domain, which is where a tiered model\nfor civic tools would draw its shape.\n",
      "transferability": "The tiered model is the most workable approach but needs an institutional sponsor to run it.\nA national digital services agency could establish and maintain a lightweight registry with\ntiered certification, using the DPGA Standard as a starting point and adding accuracy and\nfitness-for-purpose indicators; the Australian Digital Transformation Agency is one body of\nthat kind.\n"
    },
    {
      "id": "9.1",
      "title": "Jurisdiction disclosure when data is processed",
      "territory": 9,
      "slug": "jurisdiction-disclosure-at-point-of-data-processing",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For the obligation to disclose data transfers, which exists in law."
        },
        {
          "level": "emerging",
          "note": "For visual jurisdiction indicators, which appear in consumer products."
        },
        {
          "level": "frontier",
          "note": "For three-part jurisdiction-plus-legal-exposure disclosure on AI-powered government services."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "EUR-Lex — GDPR, Regulation (EU) 2016/679, Articles 13-14",
          "jurisdiction": "EU",
          "year": 2016,
          "source": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng",
          "tier": "primary",
          "anchor": "gdpr-13-14"
        },
        {
          "name": "European Commission — Standard Contractual Clauses",
          "jurisdiction": "EU",
          "source": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en",
          "tier": "primary",
          "anchor": "sccs"
        },
        {
          "name": "CJEU press release — General Court dismisses Latombe (T-553/23), upholding the EU-US Data Privacy Framework",
          "jurisdiction": "EU",
          "year": 2025,
          "source": "https://curia.europa.eu/site/upload/docs/application/pdf/2025-09/cp250106en.pdf",
          "tier": "primary",
          "anchor": "latombe"
        },
        {
          "name": "French Senate — commission d'enquete on public procurement, Microsoft France hearing (10 June 2025)",
          "jurisdiction": "France",
          "year": 2025,
          "source": "https://www.senat.fr/compte-rendu-commissions/20250609/ce_commande_publique.html",
          "tier": "primary",
          "anchor": "french-senate"
        },
        {
          "name": "UXmatters — UX Design in VPN Development",
          "year": 2023,
          "source": "https://www.uxmatters.com/mt/archives/2023/11/ux-design-in-vpn-development-balancing-security-and-the-user-experience.php",
          "tier": "evidence",
          "anchor": "vpn-ux"
        },
        {
          "name": "OAIC — APP 1.4 and APP 8 overseas-disclosure obligations",
          "jurisdiction": "Australia",
          "year": 2025,
          "source": "https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-1-app-1-open-and-transparent-management-of-personal-information",
          "tier": "primary",
          "anchor": "app-8"
        }
      ],
      "assurance": "Government must disclose, at the point a user's data is processed, three facts that determine its legal exposure: where the data is physically hosted, which legal jurisdiction the operating entity answers to, and whether the data stays onshore for data-protection purposes. The transfer-disclosure duty in law is satisfied only when these reach the user at the moment of processing, not when they sit in a privacy policy.",
      "access": "A screen of dense legal text is dismissed by exactly the people it should protect. Someone who is rushed, or has low literacy, can click through without understanding what they agreed to, losing the protection the disclosure was meant to give them.",
      "openings": [
        "Place the disclosure beside the submit button, one line per fact: where the data is processed, whose law can reach it, and whether it stays onshore.",
        "Present the signal as a glanceable, plain-language label, rather than a screen the user must clear to proceed.",
        "Announce the label through assistive technology, and never convey jurisdiction by a flag icon alone."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "JurisdictionBadge",
            "annotation": "Where the data is processed and whose law can reach it are stated at the submit step, not buried in a privacy policy."
          }
        ]
      },
      "whereThingsGoWrong": "Surfacing legal exposure at the point of processing does not by itself stop a bad decision, but it embodies the same anti-pattern lesson: a material legal consequence buried out of sight rather than disclosed at the moment the user acts on it. The badge itself can state a fact that hides the exposure it exists to disclose. A hosting label can say a submission is 'processed in France' while the operating entity's US parent can still be compelled to hand the data over. That is the exact gap the French Senate testimony exposed, between where data sits and whose law reaches it.",
      "framing": "Telling the user, at the moment their data is processed, where it goes, whose law\ncan reach it, and whether it stays onshore. A person deciding whether to share\nsomething sensitive knows, before sharing, whether a foreign authority could\ncompel it.\n",
      "challenge": "As AI-mediated government interactions grow, more moments of actual data\nprocessing will pass with no disclosure of which jurisdiction's law governs\nthem. A user interacting with a government service may not know that their\npersonal data is being processed by an AI model hosted in a different legal\njurisdiction. That matters because the hosting jurisdiction's laws can differ\nmaterially from the user's own, particularly around law-enforcement access, data\nretention, and surveillance. A cross-border transfer framework being in force does\nnot make the underlying exposure go away.\n\nThat exposure has to surface where the user, or their agent, is about to act on it.\n",
      "precedentsNote": "**[GDPR Articles 13 and 14](#s-gdpr-13-14), transfer disclosure.** Data\ncontrollers must inform data subjects at the point of collection whether\npersonal data will be transferred to a third country and on what legal\nbasis, whether an adequacy decision, [standard contractual clauses](#s-sccs), or\nbinding corporate rules. The obligation is to tell people before their data\nmoves. In practice the information sits in a privacy policy rather than at\nthe point of interaction.\n\n**[Schrems II and the Data Privacy Framework challenge](#s-latombe).** The\nCJEU's Schrems II ruling invalidated the EU-US Privacy Shield, finding that\nUS surveillance law could reach data processed by US-owned entities even\ninside European facilities. The successor Data Privacy Framework was\nchallenged and upheld by the European General Court in Latombe, with an\nappeal pending. Legal exposure and physical location came apart, and stayed\napart.\n\n**[Microsoft's testimony to the French Senate](#s-french-senate).**\nMicrosoft's Director of Public and Legal Affairs stated under oath that\nMicrosoft cannot guarantee data stored by French public-sector customers in\nMicrosoft's French data centers would never be transmitted to US\nauthorities without French government consent. Hosted in France does not mean subject only to French law, and the operator\nsaid so under oath.\n\n**[VPN jurisdiction indicators](#s-vpn-ux).** Consumer VPN applications\nroutinely show the selected server country with a flag icon and map pin,\ngiving a glanceable indicator of where traffic exits. The indicator is simple, visual, and widely understood. It shows routing and not legal\nexposure, since a server in Germany operated by a US company may still face\nUS legal compulsion.\n\n**[Australia's overseas-disclosure obligation](#s-app-8).** APP 1.4\nrequires a privacy policy to state whether personal information is likely\nto be disclosed to overseas recipients and the countries where they are\nlocated, and APP 8 governs the transfer itself. One jurisdiction's duty\nalready reaches the recipient countries by name, and not only the fact that\na transfer may occur.\n",
      "transferability": "The GDPR disclosure obligation is directly relevant, but its current implementation is not\nfit for purpose in an agent-mediated interaction. A user's agent making a submission to\ngovernment needs a machine-readable signal indicating where the data will be processed and\nunder what legal framework.\n\nThe VPN flag pattern provides a visual precedent for glanceable jurisdiction disclosure but\nneeds to be extended from \"where the server is\" to \"what laws apply to your data here.\" The\nSchrems II precedent demonstrates that physical hosting location is necessary but not\nsufficient; legal jurisdiction of the operating entity must also be disclosed.\n\nFor government services powered by AI, the disclosure pattern should indicate three things: (a)\nwhere the model processes the user's data (physical hosting), (b) what legal jurisdiction the model\noperator is subject to (legal exposure), and (c) whether the data remains onshore for the\npurposes of applicable data-protection law. This three-part signal has no established pattern\nyet.\n"
    },
    {
      "id": "9.2",
      "title": "Data-sovereignty tiers for sensitive interactions",
      "territory": 9,
      "slug": "sovereignty-tiering-for-sensitive-interactions",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For tiered sovereignty frameworks in government procurement."
        },
        {
          "level": "emerging",
          "note": "For GAIA-X labeling as a visible trust signal."
        },
        {
          "level": "frontier",
          "note": "For user-facing sovereignty-tier indicators in real-time AI interactions."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "Hosting Certification Framework",
          "jurisdiction": "Australia",
          "source": "https://www.hostingcertification.gov.au/framework",
          "tier": "primary",
          "anchor": "hcf"
        },
        {
          "name": "iTnews — Govt certifies first four strategic cloud providers",
          "jurisdiction": "Australia",
          "source": "https://www.itnews.com.au/news/govt-certifies-first-four-strategic-cloud-providers-570922",
          "tier": "evidence",
          "anchor": "hcf-first-four"
        },
        {
          "name": "GAIA-X — Trust Framework",
          "jurisdiction": "EU",
          "source": "https://gaia-x.eu/gaia-x-welcomes-the-eu-cloud-and-ai-development-act-and-calls-for-a-practical-trusted-path-to-european-digital-sovereignty/",
          "tier": "evidence",
          "anchor": "gaia-x"
        },
        {
          "name": "Cloud Temple — among the first providers certified Gaia-X Label Level 3",
          "jurisdiction": "EU",
          "year": 2025,
          "source": "https://www.cloud-temple.com/en/press-releases/digital-sovereignty-cloud-temple-becomes-the-first-european-player-to-be-certified-gaia-x-label-level-3/",
          "tier": "evidence"
        },
        {
          "name": "GAIA-X Trust Framework 3.0 'Danube' release (Summit 2025)",
          "jurisdiction": "EU",
          "year": 2025,
          "source": "https://gaia-x.eu/gaia-x-enters-season-two-of-dataspaces-and-digital-ecosystems-with-summit-2025/",
          "tier": "primary",
          "anchor": "gaia-x-danube"
        },
        {
          "name": "Computer Weekly — G-Cloud 15 framework",
          "jurisdiction": "UK",
          "source": "https://www.computerweekly.com/feature/UK-governments-G-Cloud-15-framework-Everything-you-need-to-know",
          "tier": "evidence"
        },
        {
          "name": "Find a Tender — G-Cloud 15 tender notice (015819-2025)",
          "jurisdiction": "UK",
          "year": 2025,
          "source": "https://www.find-tender.service.gov.uk/Notice/015819-2025",
          "tier": "primary",
          "anchor": "g-cloud-15"
        },
        {
          "name": "AGA — Hosting Certification Framework",
          "jurisdiction": "Australia",
          "source": "https://architecture.digital.gov.au/standard/hosting-certification-framework",
          "tier": "primary",
          "anchor": "aga-hcf"
        }
      ],
      "assurance": "Government must match the sovereignty it requires of the hosting infrastructure to the data classification of the transaction: a low-risk interaction may proceed on foreign-hosted infrastructure with disclosure, while high-sensitivity data must be held to sovereign hosting that no foreign entity can compel.",
      "access": "A tier signal written in the data-classification scheme's own language excludes users who never learned what 'PROTECTED' means. They can't tell whether a tier protects them, and end up proceeding or abandoning the service based on a signal they couldn't read.",
      "openings": [
        "Make the tier legible without the classification system behind it.",
        "Lead with the plain verdict ('the protection here already matches what you're doing'), and keep the legal detail one step away for those who want it.",
        "Make the indicator operable and announced through assistive technology, with its meaning stated in words rather than color."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "SovereigntyTier",
            "annotation": "The surface leads with a plain verdict that the protection already matches the task, and keeps whose law can compel the data as a detail the user can open."
          }
        ]
      },
      "whereThingsGoWrong": "Tiering would not change a flawed calculation, but the discipline of matching infrastructure assurance to data sensitivity reflects a proportionality that high-stakes automated processes often lack. The tier itself depends on a classification decision made upstream; a transaction classified below its real sensitivity routes to weaker hosting than the data warrants, with no one recorded as having made that call. A provider can also meet a tier's ownership test on paper through a local subsidiary while a foreign parent still holds operational control, meeting the label's letter without closing the exposure it exists to close.",
      "framing": "Matching the sovereignty of the infrastructure to the sensitivity of the\ninteraction: routine tasks proceed with disclosure, sensitive ones require hosting\nno foreign entity can compel. A person raising a sensitive matter gets the\nstronger hosting automatically rather than by knowing to ask for it.\n",
      "challenge": "Not all government interactions pose the same sovereignty risk. Filing a general\nfeedback form is different from submitting a tax return, which is different from\ninteracting with defense or intelligence services. A uniform sovereignty\nrequirement across all tiers either over-constrains low-risk interactions or\nunder-protects high-risk ones. What fits is graduated sovereignty signaling,\nmatched to the sensitivity of the transaction.\n",
      "precedentsNote": "**[Australia's Hosting Certification Framework](#s-hcf).** The framework\nestablishes a tiered certification for cloud providers hosting Australian\nGovernment data, and at the highest tier, Certified Strategic, providers\nmust meet enhanced sovereignty, ownership-structure, and supply-chain\ntransparency requirements. That tier is required for data classified at\nPROTECTED and above. The [first four Certified Strategic\nproviders](#s-hcf-first-four) were AWS, Vault Cloud, Sliced Tech, and\nAUCloud.\n\n**[GAIA-X label levels](#s-gaia-x) (EU).** The initiative introduced three\nlevels: Level 1 covers basic transparency and interoperability, Level 2\nadds security controls, and Level 3 requires European-controlled operations\nso that no non-EU entity can compel data access. The [Trust Framework 3.0\nrelease](#s-gaia-x-danube) added federated trust structures across domains\nand geographies. Control of the operator, and not location of the servers,\nis what the top level tests.\n\n**[The UK G-Cloud framework](#s-g-cloud-15).** G-Cloud 15 provides a\nstructured marketplace for public-sector cloud procurement, valued at GBP\n14 billion over four years. The framework does not mandate sovereignty\ntiers, and the procurement guidance increasingly distinguishes sovereign\nfrom non-sovereign offerings. The tier is emerging in guidance ahead of the\nframework itself.\n\n**[Hosting Certification Framework](#s-aga-hcf) tiers against data\nclassification.** The\nInformation Security Manual sets classification levels running OFFICIAL,\nOFFICIAL: Sensitive, PROTECTED, SECRET, and TOP SECRET, and those levels\ndetermine hosting requirements directly. Below PROTECTED, agencies have\nbroader hosting options; at PROTECTED and above, only certified strategic\nproviders qualify. Sensitivity constrains hosting through an existing\nclassification scheme, without a separate sovereignty ladder.\n",
      "transferability": "The tiering concept transfers directly. When a user's agent interacts with a\ngovernment service, the system should signal the sovereignty tier of the\nunderlying infrastructure. For low-sensitivity interactions a foreign-hosted model\nmay be acceptable with appropriate disclosure; for high-sensitivity interactions\n(tax, health, welfare, identity) the system should enforce, and visibly signal,\nsovereign hosting requirements. The design pattern is a \"sovereignty badge\" that\nmaps to the data classification of the transaction.\n\nThe HCF and GAIA-X models provide the policy infrastructure. The user-facing\npresentation that surfaces this tiering is the part still to be designed: a visual\nlanguage that makes a sovereignty tier legible without requiring the user to\nunderstand the classification system behind it.\n"
    },
    {
      "id": "9.3",
      "title": "AI system transparency registers",
      "territory": 9,
      "slug": "ai-system-transparency-registers",
      "maturity": "emerging",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For government AI registers, operating in the UK and Netherlands."
        },
        {
          "level": "emerging",
          "note": "For mandatory disclosure obligations under the EU AI Act, in force from August 2026."
        },
        {
          "level": "frontier",
          "note": "For real-time, contextual AI system disclosure at the point of user interaction."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "GOV.UK — Algorithmic Transparency Recording Standard Hub",
          "jurisdiction": "UK",
          "source": "https://www.gov.uk/government/collections/algorithmic-transparency-recording-standard-hub",
          "tier": "primary",
          "anchor": "atrs"
        },
        {
          "name": "GOV.UK — ATRS Mandatory Scope and Exemptions Policy",
          "jurisdiction": "UK",
          "year": 2024,
          "source": "https://www.gov.uk/government/publications/algorithmic-transparency-recording-standard-mandatory-scope-and-exemptions-policy/algorithmic-transparency-recording-standard-atrs-mandatory-scope-and-exemptions-policy",
          "tier": "primary",
          "anchor": "atrs-scope"
        },
        {
          "name": "Data in Government blog — Making ATRS mandatory",
          "jurisdiction": "UK",
          "year": 2025,
          "source": "https://dataingovernment.blog.gov.uk/2025/05/08/making-the-algorithmic-transparency-recording-standard-atrs-mandatory-across-government/",
          "tier": "primary"
        },
        {
          "name": "OECD.AI — Algorithm and AI Register",
          "jurisdiction": "Netherlands",
          "source": "https://oecd.ai/en/dashboards/policy-initiatives/algorithm-and-ai-register",
          "tier": "evidence"
        },
        {
          "name": "Algorithm Register of the Dutch government",
          "jurisdiction": "Netherlands",
          "source": "https://algoritmes.overheid.nl/en",
          "tier": "primary",
          "anchor": "dutch-register"
        },
        {
          "name": "Dutch government — 1000th algorithm published in the Algorithm Register",
          "jurisdiction": "Netherlands",
          "year": 2025,
          "source": "https://www.nldigitalgovernment.nl/news/1000th-algorithm-published-in-algorithm-register/",
          "tier": "primary"
        },
        {
          "name": "Autoriteit Persoonsgegevens — Algorithm registration in the Netherlands needs improvement",
          "jurisdiction": "Netherlands",
          "year": 2025,
          "source": "https://www.autoriteitpersoonsgegevens.nl/en/current/algorithm-registration-in-the-netherlands-needs-improvement",
          "tier": "primary",
          "anchor": "ap-report"
        },
        {
          "name": "EU AI Act — Article 50",
          "jurisdiction": "EU",
          "source": "https://artificialintelligenceact.eu/article/50/",
          "tier": "evidence"
        },
        {
          "name": "EU Digital Strategy — Draft guidelines on transparency obligations",
          "jurisdiction": "EU",
          "source": "https://digital-strategy.ec.europa.eu/en/library/draft-guidelines-implementation-transparency-obligations-certain-ai-systems-under-article-50-ai-act",
          "tier": "primary",
          "anchor": "ai-act-50-guidelines"
        },
        {
          "name": "EU AI Act — Article 13",
          "jurisdiction": "EU",
          "source": "https://artificialintelligenceact.eu/article/13/",
          "tier": "evidence"
        },
        {
          "name": "EUR-Lex — Regulation (EU) 2024/1689 (AI Act), Article 13",
          "jurisdiction": "EU",
          "source": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng",
          "tier": "primary",
          "anchor": "ai-act-13"
        },
        {
          "name": "Ministry of Armed Forces notifies a framework agreement to Mistral AI — communiqué",
          "jurisdiction": "France",
          "year": 2026,
          "source": "https://www.defense.gouv.fr/sites/default/files/ministere-armees/Communiqu%C3%A9_A_le%20minist%C3%A8re%20des%20Arm%C3%A9es%20et%20des%20Anciens%20combattants%20notifie%20un%20accord-cadre%20%C3%A0%20Mistral%20AI%20pour%20renforcer%20la%20souverainet%C3%A9%20technologique%20de%20la%20d%C3%A9fense.pdf",
          "tier": "primary",
          "anchor": "mistral-defence"
        }
      ],
      "assurance": "Government must keep a verifiable, machine-readable account of which AI system powers each service, recording its purpose, training data, underlying technology, and risk controls. A user or an agent can then confirm what is handling an interaction and who answers for it. A record that exists only on a register a user never reaches does not meet that requirement at the point of use.",
      "access": "Register-only disclosure excludes users who don't know a register exists, or who lack the time or technical confidence to read one. They act without knowing what system handled them. A disclosure repeated on every interaction excludes the same people differently: fatigue trains everyone to click past it.",
      "openings": [
        "Bring the register's facts into a glanceable, contextual indicator at the point of use: 'powered by X, hosted in Y, registered under Z'.",
        "Write it in plain language, and trigger fuller disclosure only where the jurisdiction genuinely changes the user's position.",
        "Make the indicator reachable by keyboard alone and read out by a screen reader, with the model, jurisdiction, and register status announced as text rather than implied by an icon."
      ],
      "surface": {
        "instances": [
          {
            "domain": "service",
            "kind": "interactive",
            "component": "TransparencyRegister",
            "annotation": "At the point of use, one line names the system, where it is hosted, and the public register entry that describes it."
          }
        ]
      },
      "whereThingsGoWrong": "The failure mode is an algorithm whose purpose, training data, and risk controls are never exposed, so a flawed design cannot be contested before it scales. A mandatory, public transparency register makes it contestable in advance. A register entry can also be filed and still say nothing useful: a generic purpose statement and stock risk-control language satisfy the mandate without naming the training data or the specific risk the record exists to expose. That entry passes a check for whether the field was completed, not a check for whether the system can be contested.",
      "framing": "A public, machine-readable account of which AI system powers each government\nservice, delivered to the user at the point of use rather than left in a register. A\nperson challenging an outcome can name the specific system that produced it, the\nfact every accountability process needs first.\n",
      "challenge": "A user has no way to establish which system is handling an interaction, who built\nit, where it is hosted, or what data it was trained on, and neither does the agent\nacting on their behalf. That gap widens as more government services come to\nrun on AI. Without that account, a decision cannot be checked against who is\naccountable for it, and the jurisdiction the system answers to stays invisible at\nthe moment it matters.\n\nThe system behind a service has to be identifiable to a user or an agent at the point of\nuse, not only to those who go looking in a register.\n",
      "precedentsNote": "**[The UK Algorithmic Transparency Recording Standard](#s-atrs).** The UK\nmandated ATRS reporting across all government departments, and the [scope\npolicy](#s-atrs-scope) extended it to arm's-length bodies providing public\nor frontline services or routinely interacting with the general public.\nWhat is caught are tools that significantly influence a decision with\npublic effect, or interact with the public directly, and the standard\nrequires disclosure of purpose, training data, underlying technology, and\nrisk-management strategies. More than 125 records have been published.\n\n**[The Netherlands Algorithm Register](#s-dutch-register).** The\nNetherlands launched a public algorithm register inviting government bodies\nto publish the algorithms they use rather than obliging them to, and 1,520\nare listed. The [Dutch Data Protection Authority](#s-ap-report) found that\nmore than half of municipalities and over three-quarters of independent\nadministrative bodies had registered nothing, that only 5 percent of\nregistered algorithms carried a fundamental-rights assessment, and called\nfor registration to be made mandatory. The distance between what is listed\nand what is in use is the measure of a voluntary register.\n\n**[EU AI Act Article 50](#s-ai-act-50-guidelines), transparency\nobligations.** Providers of AI systems intended to interact directly with\nnatural persons must ensure those persons are informed they are interacting\nwith an AI system, and providers of systems generating synthetic content\nmust mark outputs in a machine-readable format. Non-compliance draws\nadministrative fines of up to EUR 15 million or 3 percent of worldwide\nannual turnover. The higher tier applies to prohibited practices, and not\nto transparency breaches.\n\n**[EU AI Act Article 13](#s-ai-act-13), information for deployers.**\nProviders of high-risk AI systems must deliver instructions that are\n'concise, complete, correct and clear', covering intended purpose, accuracy\nmetrics, and details of training and validation data. The duty creates an\ninformation chain running provider to deployer to user.\n",
      "transferability": "The ATRS and Dutch register models provide the structural template for AI system disclosure.\nHowever, they are currently registry-based, published on a government website for those who\nseek them out. In an agent-mediated interaction, the disclosure needs to be surfaced at point\nof use, not discovered in a register after the fact.\n\nThe design challenge is adapting registry information into a glanceable, contextual\nindicator. The Article 50 obligation provides the legal mandate and the registries provide\nthe data; the part still to be built is the interaction that brings that data to the user\nat the point of use.\n\nA government can already disclose which model powers a function at the level of a\nprocurement notice, as France did in notifying its framework agreement with Mistral AI.\nWhat does not follow from that is the disclosure a user meets: a procurement notice is\nread by those who go looking for it, which is the same limitation the registers carry.\n"
    },
    {
      "id": "9.5",
      "title": "Cross-border data transfer as a design obligation",
      "territory": 9,
      "slug": "cross-border-data-transfer-mechanisms-as-ux-obligations",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For the legal transfer mechanisms themselves."
        },
        {
          "level": "emerging",
          "note": "For cloud-switching portability rights."
        },
        {
          "level": "frontier",
          "note": "For surfacing transfer-mechanism status in user-facing interactions, and agent-queryable transfer-mechanism APIs."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "European Commission — Standard Contractual Clauses",
          "jurisdiction": "EU",
          "source": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en",
          "tier": "primary",
          "anchor": "sccs"
        },
        {
          "name": "European Commission — New Standard Contractual Clauses: questions and answers",
          "jurisdiction": "EU",
          "source": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/new-standard-contractual-clauses-questions-and-answers-overview_en",
          "tier": "primary"
        },
        {
          "name": "Hunton — Key Provisions of the EU Data Act",
          "jurisdiction": "EU",
          "source": "https://www.hunton.com/privacy-and-cybersecurity-law-blog/key-provisions-of-the-eu-data-act-take-effect",
          "tier": "evidence"
        },
        {
          "name": "Garrigues — Data Act and cloud switching",
          "jurisdiction": "EU",
          "source": "https://www.garrigues.com/en_GB/garrigues-digital/data-act-and-cloud-switching-keys-new-rules-changing-cloud-service-providers",
          "tier": "evidence"
        },
        {
          "name": "MeitY — Digital Personal Data Protection Rules 2025 (G.S.R. 846(E))",
          "jurisdiction": "India",
          "year": 2025,
          "source": "https://www.meity.gov.in/documents/act-and-policies/digital-personal-data-protection-rules-2025-gDOxUjMtQWa",
          "tier": "primary",
          "anchor": "dpdp-rules"
        },
        {
          "name": "China Briefing — Cross-Border Data Transfer Certification",
          "jurisdiction": "China",
          "source": "https://www.china-briefing.com/news/china-cross-border-data-transfer-certification/",
          "tier": "evidence"
        },
        {
          "name": "Library of Congress — China Certification Measures",
          "jurisdiction": "China",
          "year": 2026,
          "source": "https://www.loc.gov/item/global-legal-monitor/2026-02-19/china-certification-measures-issued-for-cross-border-transfers-of-personal-data/",
          "tier": "primary",
          "anchor": "china-certification"
        },
        {
          "name": "European Commission — Data Act explained (factpage)",
          "jurisdiction": "EU",
          "year": 2025,
          "source": "https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained",
          "tier": "primary",
          "anchor": "data-act"
        }
      ],
      "assurance": "Government must make the legal basis for a cross-border transfer (an adequacy decision, standard contractual clauses, or negative-list clearance) checkable before a user's data moves. An agent can then confirm a valid basis still holds rather than committing data on the assumption that it does. If a basis is recorded only in a contract between organizations, it does not meet that requirement at the moment of transfer.",
      "access": "When a status is surfaced as the name of a legal instrument, it reaches only readers of legal instruments. 'Standard contractual clauses in place' tells a user nothing. They may commit their data, or abandon the service, based on a signal they couldn't interpret.",
      "openings": [
        "When no valid basis holds, keep the data where it is and move the task to an onshore path rather than ending it.",
        "Resolve the mechanism's status into a plain assurance the user can read directly ('a valid legal basis for this transfer exists'), with the instrument's name one step beneath for those who can use it.",
        "Make the status flag operable by keyboard and announced by a screen reader, stating the assurance in words rather than through a color-coded icon alone."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "TransferBasis",
            "annotation": "The legal basis for sending data abroad is resolved before the submit step and reported as a plain assurance that one exists."
          }
        ]
      },
      "whereThingsGoWrong": "Checking that a lawful basis exists before data moves is a procedural safeguard of the kind the worst cases bypass. Encoding it as a pre-processing gate makes the legality of a transfer a precondition. The flag itself can be wrong without anyone lying: China's certification pathway is valid for three years, and a status check built on a cached record rather than a live one can keep reporting 'valid' after the underlying approval has expired. An agent that trusts a stale flag commits data on a basis that has already lapsed. No one decided to bypass the safeguard.",
      "framing": "Making the legal basis for a cross-border data transfer checkable before the data\nmoves: an agent queries the status, the user sees a plain assurance. A transfer\nwhose legal basis has lapsed fails before the data moves.\n",
      "challenge": "A user's data crosses a border whenever their agent uses a foreign-hosted model or a\ngovernment service runs on overseas infrastructure. Whether that move is lawful turns on\nlegal arrangements made between organizations, out of the user's sight. The agent\ncommitting the data usually has no way to check that a valid basis for the transfer still\nholds, and the user has no way to see it at all.\n\nThe buried legal status has to become something an agent can check before it acts, and\nsomething the user sees when it matters.\n",
      "precedentsNote": "**[GDPR Standard Contractual Clauses](#s-sccs).** SCCs are the primary\nmechanism for transferring personal data from the EU to non-adequate\ncountries, and they require enhanced transparency, notification of\ngovernment access requests, and additional safeguards. The Commission is\nrevising them a second time to cover importers directly subject to Article\n3(2). They are a business-to-business legal instrument, imposing\nobligations on exporters and importers and none on a user-facing interface.\n\n**[EU Data Act cloud-switching provisions](#s-data-act).** The Act requires\ncloud providers to remove barriers to switching between providers and to\ntake reasonable measures to resist data-access demands that conflict with\nEU law, with core provisions already applying and interoperability and\nportability requirements following. Penalties are left to each Member\nState, which the Act requires to be effective, proportionate, and\ndissuasive. Where personal data is involved, GDPR fines apply on top.\n\n**India's [Digital Personal Data Protection Rules](#s-dpdp-rules), a\nnegative-list approach.** The Digital\nPersonal Data Protection Act permits cross-border transfers by default,\nwith the central government maintaining a list of countries to which\ntransfers are restricted. Rather than requiring an affirmative legal basis\nfor each transfer, it prohibits transfers to listed jurisdictions. The\nenabling rule sits in a tranche that commences later, and no\nrestricted-country list has been notified.\n\n**[China's three-pathway system](#s-china-certification).** China completed\nits cross-border framework with certification measures for personal\ninformation transfer, under which a data processor must satisfy one of\nthree pathways: a CAC security assessment, personal-information protection\ncertification, or standard contracts. Approval is valid for three years. It\nis the most restrictive of the major frameworks, requiring affirmative\ngovernment approval for sensitive transfers.\n",
      "transferability": "Transfer mechanisms are currently invisible to end users by design; they operate\nbetween organizations. In an agent context, this invisibility becomes a problem: a\nuser's agent may route data through a model hosted in a jurisdiction where the\ntransfer mechanism has lapsed or been invalidated. The agent should be able to\nquery whether a valid transfer mechanism exists for the user's data before\nprocessing it.\n\nThe design pattern needed is a \"transfer-mechanism status indicator\": a\nmachine-readable signal that an agent can check and, for high-sensitivity\ntransactions, surface to the user. India's negative-list approach is the\nsimplest to implement as a binary check (\"is this destination blacklisted?\"). The\nEU's SCC model is more complex but more nuanced.\n"
    },
    {
      "id": "9.6",
      "title": "Sector-specific data residency",
      "territory": 9,
      "slug": "sector-specific-data-residency-as-design-constraint",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For sector-specific data-residency law in health and finance."
        },
        {
          "level": "emerging",
          "note": "For integrating data-residency requirements into cloud procurement frameworks."
        },
        {
          "level": "frontier",
          "note": "For agent-platform routing that enforces sector-specific residency, and user-facing assurance indicators."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "My Health Records Act 2012, s 77 — requirement not to hold or take records outside Australia",
          "jurisdiction": "Australia",
          "source": "https://www.legislation.gov.au/C2012A00063/latest",
          "tier": "primary",
          "anchor": "mhr-s77"
        },
        {
          "name": "HHS OCR — FAQ 2083: use of CSPs storing ePHI outside the United States",
          "jurisdiction": "US",
          "source": "https://www.hhs.gov/hipaa/for-professionals/faq/2083/do-the-hipaa-rules-allow-a-covered-entity-or-business-associate-to-use-a-csp-that-stores-ephi-on-servers-outside-of-the-united-states/index.html",
          "tier": "primary",
          "anchor": "hipaa-faq"
        },
        {
          "name": "APRA — Australia's prudential regulator (issuer of CPS 234 / CPS 230)",
          "jurisdiction": "Australia",
          "source": "https://www.apra.gov.au/who-we-are",
          "tier": "primary"
        },
        {
          "name": "APRA — Prudential Standard CPS 234 Information Security",
          "jurisdiction": "Australia",
          "year": 2019,
          "source": "https://www.apra.gov.au/standards/cps-234",
          "tier": "primary",
          "anchor": "cps-234"
        },
        {
          "name": "Atlassian — FinServ Compliance: CPS 234",
          "jurisdiction": "Australia",
          "source": "https://www.atlassian.com/blog/announcements/apra-cps-234",
          "tier": "evidence"
        }
      ],
      "assurance": "A sector may set a statutory data-residency limit stricter than general privacy law. Government must treat that limit as a hard constraint on the platform: before a request is routed, it is confined to compliant infrastructure, and the user is told the limit held. A constraint that depends on later audit rather than enforcement before routing does not meet the requirement the law sets.",
      "access": "A residency assurance written in regulatory boilerplate, or omitted because the constraint is assumed, fails users least familiar with a sector's rules. They can't distinguish a real statutory protection from a routine notice, so they end up trusting or distrusting the service blind.",
      "openings": [
        "Surface the assurance contextually and plainly: 'processed within Australia, as the My Health Records Act requires'.",
        "Distinguish a constraint required by law from one required only by policy.",
        "Repeat the same assurance on phone and in-person channels, where the same sensitive data flows for users without reliable internet access."
      ],
      "surface": {
        "instances": [
          {
            "domain": "service",
            "kind": "interactive",
            "component": "ResidencyAssurance",
            "annotation": "A sector's residency rule becomes a routing constraint the user never has to think about, stated back to them as a plain assurance."
          }
        ]
      },
      "whereThingsGoWrong": "Encoding a statutory constraint as a hard pre-routing gate, and telling the user it held, is exactly the kind of enforceable, visible safeguard whose absence lets a system operate unlawfully at scale. The gate depends on the data being classified correctly before it routes. Section 77 itself carves out an exception for data reclassified as non-identifiable operational data. A system under pressure to route cheaply could lean on that exception to send data offshore anyway. An assurance that reports the gate held only checks the classification it was given, not whether that classification was made honestly.",
      "framing": "Encoding a sector's data-residency law as a hard constraint the platform\nenforces before routing, with a plain assurance to the user that it held.\nHealth and finance data stays where the statute says.\n",
      "challenge": "Some sectors, like health and finance, place stricter limits on where data may be processed\nthan general privacy law does. The agent and the platform behind it have to honor those\nlimits whenever a user reaches a government service in one of those sectors through an AI\nagent, keeping the data on compliant infrastructure. The user should be able to see that it\nheld.\n\nA sector's residency rule has to be something the platform enforces before it routes a\nrequest, and something the user can see held.\n",
      "precedentsNote": "**[My Health Records Act section 77](#s-mhr-s77) (Australia).** All My\nHealth Record data must remain in Australia, including every copy and\nbackup, with no exception unless it is non-identifiable operational data\nheld by the System Operator. States and territories impose further\nrestrictions on disclosure outside their own jurisdiction without consent.\nIt is an absolute geographic restriction, written into the statute.\n\n**[HHS guidance on ePHI stored outside the United States](#s-hipaa-faq).** HIPAA mandates\nno US-only storage, requiring instead encryption, access controls, audit\ntrails, and a business associate agreement with cloud vendors. Many\nenterprise health-system customers contractually require US-based hosting,\nwhich makes residency a market constraint rather than a regulatory one. For\nhealthcare AI the question covers where protected health information is\nstored, processed, queried, and where inference runs.\n\n**[APRA CPS 234 and CPS 230](#s-cps-234) (Australia).** CPS 234 is the\nmandatory information security standard for APRA-regulated entities, and\nCPS 230 replaced the outsourcing standard with a broader\noperational-resilience framework covering cloud risk. Together they\nconstrain where and how a regulated service may process data, reaching\nthrough its cloud and AI providers.\n",
      "transferability": "Sector-specific data-residency requirements create a design constraint that AI\nagent platforms must encode and enforce, and the form they take varies by\njurisdiction. Under Australia's My Health Record regime, for instance, an agent\nmust ensure no data is processed offshore: not the prompt, not the response, not the\ninference computation. Under the APRA financial-services regime, an agent must\nsatisfy CPS 234 and CPS 230, including personal accountability of executives.\n\nThe US HIPAA framework offers a useful counterpoint, since not all\ndata-residency requirements are statutory. The pattern should distinguish a\nconstraint required by law from one required only by policy.\n"
    },
    {
      "id": "9.7",
      "title": "Sovereign AI model selection and disclosure",
      "territory": 9,
      "slug": "sovereign-ai-model-selection-and-disclosure",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "emerging",
          "note": "For sovereign AI model selection as government policy, anchored to the French Ministry of Armed Forces' own communiqué notifying its Mistral AI framework agreement, not only trade-press coverage."
        },
        {
          "level": "frontier",
          "note": "For user-facing AI model provenance labeling, and machine-readable model-provenance metadata for agent-to-agent queries."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "Ministry of Armed Forces notifies a framework agreement to Mistral AI — communiqué",
          "jurisdiction": "France",
          "year": 2026,
          "source": "https://www.defense.gouv.fr/sites/default/files/ministere-armees/Communiqu%C3%A9_A_le%20minist%C3%A8re%20des%20Arm%C3%A9es%20et%20des%20Anciens%20combattants%20notifie%20un%20accord-cadre%20%C3%A0%20Mistral%20AI%20pour%20renforcer%20la%20souverainet%C3%A9%20technologique%20de%20la%20d%C3%A9fense.pdf",
          "tier": "primary",
          "anchor": "mistral-defence"
        },
        {
          "name": "BMDS — France and Germany join forces with Mistral AI and SAP SE to launch a sovereign AI for public administration",
          "jurisdiction": "Germany",
          "year": 2025,
          "source": "https://bmds.bund.de/aktuelles/pressemitteilungen/detail/france-and-germany-join-forces-with-mistral-ai-and-sap-se-to-launch-a-sovereign-ai-for-public-administration",
          "tier": "primary",
          "anchor": "mistral-sap"
        },
        {
          "name": "DSIT — first backing through the UK's Sovereign AI Unit",
          "jurisdiction": "UK",
          "year": 2026,
          "source": "https://www.gov.uk/government/news/ai-firms-pioneering-drug-discovery-cheaper-supercomputing-and-more-get-first-backing-through-uks-sovereign-ai",
          "tier": "primary",
          "anchor": "uk-sovereign-ai"
        },
        {
          "name": "The Register — Europe gets serious about cutting US digital umbilical cord",
          "jurisdiction": "EU",
          "source": "https://www.theregister.com/2025/12/22/europe_gets_serious_about_cutting/",
          "tier": "evidence"
        },
        {
          "name": "AI Agent Index (MIT) — safety-disclosure findings",
          "jurisdiction": "International",
          "year": 2025,
          "source": "https://aiagentindex.mit.edu",
          "tier": "evidence",
          "anchor": "agent-index"
        },
        {
          "name": "Arxiv — On the Regulatory Potential of User Interfaces for AI Agent Governance",
          "year": 2025,
          "source": "https://arxiv.org/pdf/2512.00742",
          "tier": "evidence",
          "caveat": "preprint",
          "anchor": "ui-governance"
        }
      ],
      "assurance": "When a government chooses which AI model powers a service, it must make that sovereignty choice visible at the point of interaction. The disclosure names the model provider, the training jurisdiction, the inference-hosting jurisdiction, and the legal framework that governs the data. A choice held only at the policy level, unseen by the user the model decides about, does not meet that requirement.",
      "access": "A single form of disclosure reaches one kind of reader and excludes the rest. A dense page label loses users with low literacy. A glanceable badge gives an AI agent nothing to evaluate. Either way, someone ends up weighing the system handling them on a signal not built for them.",
      "openings": [
        "Offer the disclosure at graduated depth (a static page label, a contextual plain-language tooltip, machine-readable metadata), so users with different needs, and their agents, can each read it.",
        "Present sovereignty as an informed choice across the range of provenance, rather than a single domestic-or-foreign verdict.",
        "Make the label and tooltip operable by keyboard and read out by a screen reader, with the provenance facts announced as text rather than left to an icon or color."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "ModelProvenance",
            "annotation": "A provenance label names who built the model, where it was trained and hosted, and whose law governs it."
          }
        ]
      },
      "whereThingsGoWrong": "The failure mode is an opaque automated decision with no record of which model decided a case, or under whose law it ran. Labeling that provenance makes the deciding system contestable. The most direct risk to this exact label is a service that calls itself sovereign without the stack to back it: a model trained on a foreign hyperscaler's infrastructure, fine-tuned on a foreign platform, or served through an undisclosed sub-processor can still show a domestic-provider label on the front end. A label naming only the provider on the box, not the dependencies underneath, tells the user the opposite of what governs their data.",
      "framing": "A provenance label for the AI model behind a government service: who built it,\nwhere it was trained, where it runs, whose law governs it. A person can see\nwhether the model handling their case answers to their own country's law.\n",
      "challenge": "As governments make explicit choices about which AI model powers\na public service, that choice will keep happening with no visibility for the\nuser relying on it. Which model a government deploys in a user-facing service,\nand who controls that model, is a sovereignty question. A service powered by\na US-headquartered model provider is subject to different legal and political\nrisks than one powered by a domestically developed or EU-sovereign model.\n",
      "precedentsNote": "**[France's defense framework agreement with\nMistral](#s-mistral-defence).** The Ministry of Armed Forces notified a\nframework agreement to Mistral AI, managed by the Agency for Defense\nArtificial Intelligence and giving the armed forces, ministry directorates,\nand supervised bodies including the CEA, ONERA, and SHOM access to\nMistral's models in secure environments. The ministry's notice states no\nfixed duration. Model selection is an explicit sovereignty decision at the\nlevel of a defense procurement.\n\n**[The France-Germany sovereign AI partnership](#s-mistral-sap).** France\nand Germany announced a partnership with Mistral AI and SAP to build a\nsovereign AI capability for public administration, with selected use cases\nto be deployed in administrations over several years. Two governments are\njointly procuring a model layer for administration rather than each\ncontracting separately.\n\n**[Wider sovereign-AI investment](#s-uk-sovereign-ai).** Other governments\nback sovereign AI capacity by different routes, the UK through equity\nstakes in domestic AI companies and the EU through public investment in\ncompute infrastructure. A service's choice of model is becoming a\ndeliberate sovereignty decision rather than a default.\n\n**[The AI Agent Index](#s-agent-index) on disclosure.** Across the 30\nagents indexed, half of developers publish a safety framework, 23 of 30\nreport no third-party testing, and 25 of 30 disclose no internal safety\nresults; of the 13 agents at frontier levels of autonomy, 4 disclose any\nagentic safety evaluation. Basic transparency about the system is uneven,\nbefore sovereignty-relevant detail like model provenance and hosting\njurisdiction is reached.\n",
      "transferability": "The France/Mistral model demonstrates sovereign AI selection at policy level. The part still\nto be built is user-facing disclosure at the point of interaction.\n\nThe pattern is an \"AI model provenance label\" that discloses: (a) the model provider, (b) the\nmodel's training jurisdiction, (c) the inference-hosting jurisdiction, and (d) the legal\nframework governing data processed through it. None of the cited precedents test what depth\nof disclosure reaches a user or an agent; that design is still to be built.\n\nThe 2025 AI Agent Index disclosure gap suggests that market forces alone will not produce\nthis transparency. Regulatory mandate, building on Article 50 of the EU AI Act, is likely\nnecessary.\n"
    },
    {
      "id": "9.8",
      "title": "Concentration-risk and supply-chain disclosure",
      "territory": 9,
      "slug": "concentration-risk-and-supply-chain-disclosure",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "emerging",
          "note": "For the SBOM as structural precedent, and concentration-risk oversight in financial regulation."
        },
        {
          "level": "frontier",
          "note": "For an AI sovereignty BOM, and agent-queryable supply-chain jurisdiction metadata."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "Bank of England — PS16/24 Critical Third Parties",
          "jurisdiction": "UK",
          "year": 2024,
          "source": "https://www.bankofengland.co.uk/prudential-regulation/publication/2024/november/operational-resilience-critical-third-parties-to-the-uk-financial-sector-policy-statement",
          "tier": "evidence",
          "anchor": "ctp-ps16"
        },
        {
          "name": "Financial Services and Markets Act 2000, s 312L — designation of critical third parties",
          "jurisdiction": "UK",
          "source": "https://www.legislation.gov.uk/ukpga/2000/8/section/312L",
          "tier": "primary"
        },
        {
          "name": "FCA Handbook — CTPS 3.2, the CTP Fundamental Rules",
          "jurisdiction": "UK",
          "year": 2025,
          "source": "https://www.handbook.fca.org.uk/handbook/CTPS/3/2.html",
          "tier": "primary",
          "anchor": "ctps-rules"
        },
        {
          "name": "FCA Handbook — CTPS 4.7, Requirement 6: Mapping",
          "jurisdiction": "UK",
          "year": 2025,
          "source": "https://www.handbook.fca.org.uk/handbook/CTPS/4/7.html",
          "tier": "primary",
          "anchor": "ctps-mapping"
        },
        {
          "name": "FCA Handbook — CTPS 4.8, Requirement 7: Incident management",
          "jurisdiction": "UK",
          "year": 2025,
          "source": "https://www.handbook.fca.org.uk/handbook/CTPS/4/8.html",
          "tier": "primary"
        },
        {
          "name": "EUR-Lex — EU Data Act, Regulation (EU) 2023/2854 (Article 32)",
          "jurisdiction": "EU",
          "source": "https://eur-lex.europa.eu/eli/reg/2023/2854/oj",
          "tier": "primary",
          "anchor": "data-act-32"
        },
        {
          "name": "Executive Order 14028 — Improving the Nation's Cybersecurity (SBOM)",
          "jurisdiction": "US",
          "year": 2021,
          "source": "https://www.federalregister.gov/documents/2021/05/17/2021-10460/improving-the-nations-cybersecurity",
          "tier": "primary",
          "anchor": "eo-14028"
        }
      ],
      "assurance": "Government must make the jurisdictional exposure of the whole AI processing chain inspectable, not just the sovereignty of the service at the top. A user's agent can then find hidden foreign dependencies before committing data to a nominally sovereign service. A sovereignty claim that covers only the visible layer, while sub-processors and upstream training infrastructure go undisclosed, does not meet that requirement.",
      "access": "A raw component manifest is legible only to someone who can read a supply chain. That excludes exactly the users the disclosure is meant to protect. They see a list they can't interpret, and can't tell whether the service is exposed to a foreign dependency.",
      "openings": [
        "Render the manifest as a summary sovereignty label, legible at a glance and in plain words.",
        "Make the detailed manifest agent-queryable for high-sensitivity interactions, so an agent can evaluate on the user's behalf what the user should never have to parse."
      ],
      "surface": {
        "instances": [
          {
            "domain": "policy",
            "kind": "interactive",
            "component": "SovereigntyStack",
            "annotation": "A per-layer card shows where each part of the stack sits and whose jurisdiction it answers to."
          }
        ]
      },
      "whereThingsGoWrong": "Hidden foreign dependencies are an accountability gap of the same family as a hidden calculation assumption. A queryable manifest of the stack makes those buried exposures inspectable before harm occurs. A sovereignty BOM is only as complete as what the filer chooses to disclose: a provider can list its direct sub-processors and leave out an nth-party dependency further down the chain, filing a manifest that is accurate as far as it goes and silent about the layer where the foreign exposure sits. A manifest built from self-reported components, with no independent check on completeness, can pass as filed while missing exactly the dependency it exists to surface.",
      "framing": "Making the whole AI supply chain's jurisdictional exposure inspectable, not\njust the top layer's: a sovereignty bill of materials an agent can query\nbefore committing data. A sovereign front end with foreign dependencies\nunderneath is disclosed as exactly that.\n",
      "challenge": "A government may pick a sovereign cloud provider or a domestically hosted model. The\nsupply chain behind that service can still hide foreign dependencies. A nominally sovereign\nmodel may have been trained on a foreign hyperscaler's infrastructure, fine-tuned on a\nforeign platform, or served through networks that route data across borders. The user's\nagent, committing data to what looks like a domestic service, has no way to see those buried\nexposures.\n\nThe jurisdictional exposure of the whole stack has to be inspectable before data is\ncommitted.\n",
      "precedentsNote": "**[Executive Order 14028 and the SBOM](#s-eo-14028) (US).** The order\nrequired software bills of materials for software sold to the federal\ngovernment, disclosing all components and dependencies. The concept has\nsince been extended to AI systems as AI bills of materials listing training\ndata, architecture, and dependencies. A machine-readable manifest of every\ncomponent is a shape that transfers.\n\n**[The UK Critical Third Parties regime](#s-ctp-ps16).** HM Treasury can\ndesignate a cloud provider as critical to the UK financial sector, and the\n[CTP Fundamental Rules](#s-ctps-rules) bind it from designation.\n[Requirement 6](#s-ctps-mapping) makes the designated provider map the\nresources and interdependencies behind each systemic service, which puts\nnth-party concentration on the record. One sector's regulator has already\nobliged a provider to draw the supply chain beneath its own contracting\nlayer.\n\n**[EU Data Act Article 32](#s-data-act-32).** The Act requires cloud\nproviders to take reasonable measures to prevent unlawful non-EU government\naccess and to challenge access requests that conflict with EU law. The\nobligation extends through the supply chain, so a sovereign provider using\nUS-based sub-processors must ensure those sub-processors resist unlawful\naccess too.\n",
      "transferability": "When a user's agent makes a tool call (invoking an API, querying a database, or\nprocessing data through a model), the agent may trigger cross-border data flows\ninvisible to both the user and the government service. The agent selects and invokes\nthose tools autonomously, with no visibility into the jurisdiction hosting them.\n\nThe design pattern is an \"AI sovereignty BOM\": a machine-readable manifest\ndisclosing the jurisdictional exposure of every component in the AI processing\nchain. For high-sensitivity government interactions, this BOM is queryable by the\nuser's agent before committing data.\n"
    },
    {
      "id": "9.9",
      "title": "Context-triggered disclosure",
      "territory": 9,
      "slug": "the-when-it-matters-trigger",
      "maturity": "frontier",
      "maturityLevels": [
        {
          "level": "established",
          "note": "For progressive disclosure, and risk-based disclosure thresholds in financial regulation, described here from general regulatory practice rather than a source cited in this card."
        },
        {
          "level": "emerging",
          "note": "For risk-based step-up in identity systems, standardized via OpenID Connect step-up authentication (acr_values / max_age) and IETF RFC 9470."
        },
        {
          "level": "frontier",
          "note": "For machine-evaluable sovereignty checkpoints on AI agent interactions, and data-classification-to-sovereignty-tier matching."
        }
      ],
      "status": "published",
      "dependsOn": [],
      "seeAlso": [],
      "precedents": [
        {
          "name": "Nielsen Norman Group — Progressive Disclosure (Jakob Nielsen)",
          "year": 2006,
          "source": "https://www.nngroup.com/articles/progressive-disclosure/",
          "tier": "evidence",
          "anchor": "progressive-disclosure"
        },
        {
          "name": "OpenID Connect Core 1.0 — step-up authentication (acr_values / max_age)",
          "jurisdiction": "International",
          "source": "https://openid.net/specs/openid-connect-core-1_0.html",
          "tier": "primary",
          "anchor": "oidc-stepup"
        },
        {
          "name": "IETF RFC 9470 — OAuth 2.0 Step-Up Authentication Challenge Protocol",
          "jurisdiction": "IETF",
          "source": "https://datatracker.ietf.org/doc/html/rfc9470",
          "tier": "primary",
          "anchor": "rfc-9470"
        }
      ],
      "assurance": "Government must tie sovereignty disclosure to a check it can run before processing, comparing the data classification of an interaction against the sovereignty tier of the available infrastructure. The user is then asked to engage only when the two diverge. A blanket rule that discloses on every interaction, or none, does not meet the requirement that disclosure fire when jurisdiction changes the user's protection.",
      "access": "The trigger's calibration is itself the access question. Set too loose, it buries users in disclosures they learn to ignore. Set too tight, it stays silent on the transfers that change their protection. Both failures land hardest on users with low literacy, and those without reliable internet access, who are least able to seek out the information themselves or send an agent to do it. Either way, someone is left uninformed at the moment it mattered.",
      "openings": [
        "Trigger disclosure only when data crosses a boundary that changes legal protections.",
        "Default to a minimal plain-language indicator with detail on demand.",
        "Present a real, symmetrical choice wherever an alternative exists.",
        "Make the indicator and the escalation it triggers operable by keyboard and announced by a screen reader. State any mismatch in words, never color alone."
      ],
      "surface": {
        "instances": [
          {
            "domain": "interaction",
            "kind": "interactive",
            "component": "SovereigntyCheckpoint",
            "annotation": "Disclosure scales with how sensitive the data is, reaching the user only when the sensitivity and the infrastructure do not match."
          }
        ]
      },
      "whereThingsGoWrong": "The failure mode is one crude rule applied to every case, with no escalation when stakes and infrastructure mismatch. A checkpoint that escalates a sensitive-data-on-inadequate-infrastructure mismatch to a human is the proportionate, exception-surfacing control that prevents it. The checkpoint depends on an honest classification of the data; a service under pressure to avoid friction can classify sensitive data one notch below its real sensitivity, and the mismatch that should trigger escalation never fires. The person harmed is the one whose data crossed the boundary that mattered, with no disclosure and no record that anyone made that classification choice.",
      "framing": "Firing sovereignty disclosure only at the moments jurisdiction changes\nthe user's protection: silent when infrastructure matches the data's sensitivity,\nunmistakable when it doesn't. Because the warning fires only when the user's\nprotection changes, users keep reading it.\n",
      "challenge": "The hard part of sovereignty disclosure is calibrating when it fires. Surfaced on every\ngovernment interaction, it goes the way of the cookie banner, dismissed reflexively until it\ninforms no one. Surfaced on none, it leaves users unaware of the jurisdictional risks that\nchange their position.\n\nThe trigger has to surface sovereignty information in proportion to the data at stake, and\nit has to be something an agent can evaluate before it acts.\n",
      "precedentsNote": "**[Nielsen Norman Group on progressive\ndisclosure](#s-progressive-disclosure).**\nProgressive disclosure shows a person only what they need at each stage,\nwith the ability to go deeper on demand, and it is the foundational pattern\nfor managing information complexity. Applied to sovereignty it means a\nminimal default signal, with provider, location, certification level, and\napplicable law available behind it.\n\n**[OpenID Connect step-up authentication](#s-oidc-stepup).** Multi-factor systems use\nrisk-based step-up, so a low-risk action needs a password and a high-risk\naction needs a second factor, with the trigger attached to the specific\naction rather than to the session. [RFC 9470](#s-rfc-9470) defines the\nchallenge a resource server returns to demand it. The action carries the trigger, which is the part that transfers.\n",
      "transferability": "For agent-mediated interactions, the trigger should be machine-evaluable: the agent\nshould be able to determine, before processing data, whether the sovereignty profile\nof the available infrastructure is adequate for the data classification of the\ntransaction. If there is a mismatch (sensitive data being processed on\nnon-sovereign infrastructure), the agent should escalate to the user.\n\nThe design pattern is a \"sovereignty checkpoint\": a machine-readable pre-processing\ncheck that compares the data classification of the interaction against the\nsovereignty tier of the processing infrastructure. The checkpoint avoids the\ncookie-banner failure mode by triggering only on genuine jurisdictional boundary\ncrossings, and avoids information overload through progressive disclosure.\n"
    }
  ]
}