Concept Glossary

The conversational interface through which citizens interact with government services — describing their situation, answering questions, reviewing tasks, and giving consent.

Why it matters: Chat is the primary interface between the citizen and the system. Through a single conversational thread, citizens describe their situation, review what the agent proposes, answer questions, give consent, and confirm actions. Triage — identifying needs, matching services, and proposing a plan — is one of its key capabilities, not its name. The chat also hosts focused service journeys, inline cards, task confirmations, and consent panels.

A discrete unit of delegated work within a journey — something the agent will do or something the citizen must confirm — with a tracked status and an owner.

Why it matters: Tasks are how the citizen stays in control of what the agent does on their behalf. Before the agent submits anything to government, the citizen sees a clear list of tasks: what the agent will do, what choices the citizen has made, and a final confirmation step. Tasks are not forms (that's what cards are for) — they are commitments to action.

A structured data-collection interface embedded within the conversation, replacing traditional government web forms.

Why it matters: Cards allow the agent to collect verified, structured data from citizens within a conversational flow. Fields pre-fill from verified sources (e.g. GOV.UK Wallet credentials), are marked as verified when government-sourced, and only ask for what's genuinely needed.

A focused, single-service interaction where the agent collects data, obtains consent, and advances through the service's state model to completion.

Why it matters: Journeys replace traditional government web forms with a conversational, guided experience. The agent knows what data is needed, what has already been verified, and what state the interaction is in — so the citizen never fills in the same information twice.

The formal result of a completed service journey, presented as a department-branded confirmation with a reference number and next steps.

Why it matters: Outcomes give citizens tangible proof that something happened. They carry department branding, official reference numbers, and clear next steps — so citizens know exactly where they stand and can follow up if needed.

The agent's suggestion of which government services are relevant to a citizen's situation, with a recommended order of action.

Why it matters: Proactive service discovery is one of the most powerful capabilities of the agentic model. Rather than citizens searching for services, the agent proposes them — including services from other departments the citizen may never have heard of.

The system's ability to surface services a citizen is likely entitled to or obligated by — before they ask, and sometimes before they know they exist.

Why it matters: Billions of pounds in benefits go unclaimed each year because citizens don't know they're eligible. Obligations are missed because people don't know about deadlines. Proactivity flips government from "find it yourself" to "we'll tell you what you need to know." When a citizen mentions they're having a baby, the agent doesn't just help with maternity pay — it surfaces Child Benefit, Tax-Free Childcare, Sure Start, and the HICBC risk, ordered by priority and urgency.

A personalised, ordered sequence of government services for a life event — derived from the service graph, filtered by the citizen's circumstances, and tracked to completion.

Why it matters: A plan is the bridge between "I need help" and "here's everything you need to do, in the right order." It takes the abstract service graph and materialises it for a specific citizen: removing services they're not eligible for, ordering the rest by dependency (register the death before applying for probate), and tracking progress as services complete. Plans make the cross-departmental nature of government visible and manageable.

A group of related citizens who share a home and whose government entitlements may depend on each other — making the family unit a first-class concept in the system.

Why it matters: Government services rarely affect just one person. Universal Credit is assessed at the household level. Child Benefit depends on the highest earner's income. Tax-Free Childcare involves both parents. School admissions depend on address and siblings. The household model lets the agent reason about entitlements, obligations, and risks across family members — not just for individuals in isolation.

The ability for one citizen to act on behalf of another — a parent for a child, an executor for a deceased person, a carer for a vulnerable adult, or an attorney for someone who lacks capacity.

Why it matters: Government services are rarely used by individuals in isolation. Parents manage services for children, families coordinate shared entitlements, executors handle the affairs of the deceased, and attorneys make decisions for those who cannot. The delegation model makes these real-world relationships a first-class concept, with scoped permissions and a full audit trail of every action taken on someone else's behalf.

Scoped, granular permissions that control exactly what one person can do on behalf of another — from view-only access to full authority.

Why it matters: "Acting on behalf of" is not binary. A spouse viewing your benefit status is different from an executor submitting a probate application is different from a carer appealing a PIP decision. Relationship permissions ensure that delegation is precise, auditable, and matches the legal authority the person actually holds.

A specific, informed permission from a citizen for the agent to share named data fields with a named department for a stated purpose.

Why it matters: Nothing happens without consent. Every time the agent needs to share citizen data with a government service, it presents a consent grant explaining exactly what data will be shared, where it comes from, why it's needed, and how long the sharing lasts. The citizen explicitly agrees or declines each grant. This is not a blanket "I agree to terms and conditions" — it is granular, informed, revocable consent.

A chronological record of every consent decision a citizen has made — what they agreed to, what they declined, and what they later revoked.

Why it matters: For regulatory compliance and citizen trust. The consent audit gives citizens a complete picture of who has access to their data and why, and gives departments an auditable trail for data protection purposes.

The strict separation between what the AI language model decides and what code decides — the model generates natural language; code enforces rules.

Why it matters: This is the architectural guarantee that the agent cannot hallucinate eligibility, skip consent, or invent entitlements. The language model handles citizen-facing conversation (explaining, clarifying, summarising). All consequential decisions — "is this person eligible?", "has consent been given?", "is this state transition valid?" — are made by deterministic code that evaluates the published policy and state model. The model cannot override this boundary.

A formal model of the valid states a service interaction can be in, and the valid transitions between them — preventing the agent from skipping steps.

Why it matters: Government processes have mandatory sequences. You cannot submit a benefits claim before verifying identity. You cannot make a payment before confirming the amount. The state machine enforces this at the system level, making it impossible for the agent to skip, reorder, or shortcut steps — no matter what the citizen asks or the language model suggests.

Running a citizen's data against the published eligibility rules for a service, returning a definitive pass/fail with reasons.

Why it matters: Eligibility is not a matter of opinion — it is a matter of rules. Policy evaluation means the agent does not guess whether someone qualifies. It evaluates conditions (age ≥ 18, income ≤ threshold, residency = UK) and returns a clear answer with specific failure reasons if ineligible. When eligibility is uncertain, it identifies which data is missing rather than speculating.

Tracking which data fields a service requires versus which have already been collected or verified — so the agent only asks for what is genuinely missing.

Why it matters: Citizens are frustrated by forms that ask for information the government already holds. Field collection cross-references the service's requirements against verified credentials, previously submitted data, and facts already gathered in the conversation — then only asks for the gap.

A single gateway through which every service action passes — ensuring that every invocation is policy-checked, consent-verified, and trace-recorded.

Why it matters: Without a single integration point, individual components might skip consent checks, bypass policy evaluation, or fail to record actions. The capability invoker acts as a unified service gateway, guaranteeing that nothing reaches a government service without passing through the full accountability pipeline.

The open standard for connecting AI agents to external tools and data sources, providing a uniform interface for service discovery and invocation.

Why it matters: Without a standard protocol, every department would need to build bespoke integrations with every agent. MCP provides a common language: each department's services are exposed as MCP tools, allowing the agent to discover available services, understand their inputs and outputs, and invoke them through a single standard interface. This means a new department can become agent-accessible by publishing MCP-compliant tool definitions, without requiring changes to the agent itself.

A department-level view showing how many services have been made legible versus how many remain to be done.

Why it matters: Gap analysis turns the legibility programme from an abstract goal into a measurable one. Departments can see exactly where they stand: "12 of your 201 services have full artefacts. 189 are catalogued but not yet legible." This drives prioritisation and resource allocation.

A per-service assessment of which of the four artefacts (manifest, policy, state model, consent) have been published, and which are missing.

Why it matters: Coverage answers "what does my department still need to do?" at the individual service level. A service with a manifest but no policy can be described but not triaged for eligibility. A service with no consent model cannot share citizen data. Coverage drives the work plan for making services fully legible.

A department-facing platform where service owners author, publish, and monitor the legibility artefacts for their services.

Why it matters: Making services legible must be as straightforward as possible for departments. The Legibility Studio provides tools for authoring manifests, defining policy rules, mapping state models, and specifying consent requirements — alongside gap analysis, evidence audit, and the ability to test how agents will experience a service before it goes live.

A richly modelled citizen profile representing a real-world life situation — with verified credentials, family relationships, employment history, health conditions, and a specific life event triggering their interaction with government.

Why it matters: Personas are how the system is tested and demonstrated. Each persona exercises a different cross-section of government services, relationships, and edge cases. They prove that the architecture works not just for simple transactions but for the complex, messy reality of citizens' lives — bereavement with overseas property, immigration with language barriers, prison release with housing deadlines.