How departments can make their services work through AI agents — safely, accountably, and under citizen control.
This describes the target operating model. Interface examples are drawn from working prototypes. For full concept definitions, see the Concept Glossary.
More than 1,500 government services exist across dozens of departments. Citizens must find, understand, and complete each one themselves — often during the worst moments of their lives. Billions in benefits go unclaimed every year.
Consider bereavement. When someone’s partner dies, they may face up to 40 separate interactions across the General Register Office, DWP, HMRC, HMCTS, DVLA, and local authorities. They must discover each service, determine eligibility, collect the right documents, fill in the same details repeatedly, and meet deadlines they may not know exist.
This is evolution, not revolution. The operating model builds on foundations government has already laid and extends principles departments already endorse.
Identity verification is not rebuilt — it is reused. The agent authenticates citizens through One Login, the same infrastructure departments already trust.
The Tell Us Once principle — notify government once, not repeatedly — currently applies to death notifications. This model extends that principle to every life event: having a child, becoming a carer, retiring, moving home.
The four artefacts complement GDS’s existing service register and design standards. They add machine-readable descriptions alongside the human-readable guidance departments already publish.
This does not replace departmental back-end systems. It makes them accessible through a new channel — one where citizens are guided rather than left to navigate alone.
The operating model rests on three pillars. Together they define a system where AI helps citizens navigate government, while departments stay in control of their own rules.
Departments publish structured artefacts that tell agents everything needed to act on a service — what it does, who is eligible, what data is required, and in what order.
Citizens see exactly what data is shared, with whom, for what purpose, and can revoke at any time. Nothing is shared without explicit, informed consent.
Every action is traced, receipted, and replayable. Citizens, departments, and auditors share a single source of truth.
A walkthrough of a single citizen journey: Sarah Okafor, age 58, Chelmsford. Her husband David died on 26 February 2026. She is named executor. Estate approximately £645,000. Two adult children. She works part-time as a library assistant.
Sarah opens the app and types her first message. She does not know which services exist, which departments are involved, or what deadlines apply. From a brief conversation, the agent identifies 9 relevant services across 5 departments.
The agent proposes a bereavement plan ordered by dependency and urgency. Sarah reviews the plan and consents to each data-sharing event before anything is submitted. She sees exactly what data, from what source, going to whom, and for what purpose.
Verified fields from One Login and GRO are pre-filled and locked — Sarah only provides what is genuinely new, such as bank details for payment. Before submission, she sees exactly what the agent will do and confirms. Nothing is sent without her explicit approval.
Behind the scenes, every recommendation is traceable to published rules. Sarah and auditors can see why the agent made each decision — for example, that it prioritised the BSP claim because of a 3-month deadline, or that it referred her to HMCTS for probate because the estate value requires it.
Every action the agent takes is receipted with a permanent, auditable record: what was submitted, to whom, when, what data was shared, and the outcome. These receipts are independently verifiable by Sarah, departments, and auditors.
For a service to work through an agent, the department must publish four structured descriptions. Together, these form the complete contract between a department and any agent acting on behalf of a citizen.
What the service does. Department ownership, SLA, fees, redress routes.
Who is eligible. Evaluable conditions published by the department.
The valid sequence of steps. What must happen before what.
What data is shared, from where, with whom, and for what purpose.
| Service name | Renew Driving Licence |
| Department | DVLA |
| Eligibility criteria | Existing licence holder, meets medical requirements |
| Required data fields | Full name, date of birth, driving licence number, address, photograph |
| SLA | 10 working days · Fee: £14 |
| Redress route | Contact DVLA directly, or Parliamentary and Health Service Ombudsman |
The safety architecture ensures that AI handles language while code handles rules. This is not a policy choice — it is an architectural constraint.
Policy rules published by departments are evaluated deterministically. The LLM cannot override, reinterpret, or relax an eligibility condition.
The service workflow requires consent before any data sharing. There is no valid path forward without it.
The evidence plane records independently. Receipts are issued to the citizen. Full replay is possible for audit.
Most government services are not used by a single individual acting alone. Parents act for children. Executors act for the deceased. Carers support vulnerable adults. The model handles these relationships natively.
Every government service has been catalogued. The Legibility Studio shows departments which services are covered, which have gaps, and where to start.
Coverage today stands at 2% — early and deliberate. The 28 services with full artefacts were chosen because they cover the highest-impact life events: bereavement, having a child, becoming a carer. Authoring artefacts for a service takes days, not months — the work is describing rules departments already know, not building new systems. Once the model is proven with these initial services, coverage is designed to scale rapidly across departments.
The most common objections, and how the architecture addresses each one.
Three concrete requests. Each is within an individual department’s authority to grant.
Nominate 3–5 high-volume citizen-facing services. Start with those that appear in the most life events — bereavement, having a child, becoming a carer. These are the services citizens need most and struggle with most.
Identify cross-departmental data flows that would benefit citizens. The consent model enables them technically; legal teams make them real. Start with Tell Us Once and identity verification.
A named senior leader owning legibility for the department. Access to the Legibility Studio and a small team to author artefacts. This is weeks of work, not months.
This is not a technology proposal. It is an operating model proposal. The technology exists. The question is whether departments will publish the structured descriptions their services need to work through agents — or leave citizens to navigate 1,544 services alone.