The Agentic State: Capability and Counter-Power as One Architecture

1. Executive summary

Governments have begun to deploy software that acts. Not software that answers questions about a procedure, but software that reads a case, queries a registry, applies a rule, produces a document and closes the file. As of October 2026 this is no longer a forecast. Ukraine's Diia.AI delivers four public services end to end through conversation. Nineteen German municipalities have completed a federal pilot in which agentic tools worked on real municipal casework, with most of the pilot solutions processing live municipal data by the cut-off date. Abu Dhabi's Executive Council met in September 2026 using an agentic platform that, as reported, analysed the proposals in front of it and prepared summaries of them. Singapore is building a registry of which agents its officers run and what those agents may do. The United Arab Emirates has announced that half of its government services will move to agentic AI within two years. An OECD working group now exists specifically to work out how governments should govern this class of system.

One asymmetry runs through almost every programme we examined. Governments are learning to act through agents faster than they are learning how to constrain them.

The institutional vocabulary for constraint is arriving, and in places it is good. Australia's agentic-AI addendum to its technical standard for government AI, last updated in June 2026, requires agencies to give each agent a unique identity and to assign human accountability for what agents decide, and recommends treating prompts and system instructions as controlled artefacts that are logged, approved and versioned. Estonia has announced work on distinct identity codes for AI agents, so that, in its prime minister's words, it is clear "who is acting on whose behalf with what rights, and who is ultimately responsible". A practitioner study published on the OECD's AI platform on 24 September 2026, covering 25 organisations in 11 countries, public and private, reported that none of them had deployed agentic AI with unrestricted autonomy. These are real foundations.

Three things are missing almost everywhere, and they are the same three things.

First, the operative instruction. A growing share of consequential administrative discretion is exercised not by statute, not by regulation, and not by deterministic code, but by a paragraph of natural language telling a model how much benefit of the doubt to extend. That paragraph functions as law, and in the programmes reviewed for this paper it was not available to the people it governs. We call this law as prompt.

Second, plurality. Where one model, one vendor and one data layer decide a large share of a government function, there is no second account of the facts for anyone to appeal to. Independent fiscal institutions such as the UK's Office for Budget Responsibility show one answer for fiscal policy: the forecast comes from a body that does not answer to the government it checks. We found no counterpart for the models deciding who gets what.

Third, and most consequential: the citizen has no agent. Across every programme reviewed, we found no publicly funded, institutionally independent agent available to an ordinary person with anything approaching the standing a government agent already has to file, request, contest or appeal. A near-universal citizen-facing agent has been announced: South Korea's "AI for All", planned as free to all citizens, with beta testing due from October 2026, to be operated by three consortia led by SK Telecom, Kakao and KT. One of the three says its agents will handle authentication, public-service applications and payments on users' behalf. That is not public counter-power, and the difference is structural rather than a matter of goodwill.

The argument here is a design claim, not a political one. Government capability and citizen counter-power are not competing objectives to be traded off. They are two halves of one architecture, and the order in which they are built determines whether the second ever gets built at all. A government sequencing capability first and rights later is not building a smaller version of the right system; it is building a different system.

The paper closes with ten design requirements and an implementation sequence. Neither is a scorecard. Both are checkable from outside.

2. From digital government to agentic government

The distinction between an assistant and an agent can be made operational. Five questions separate them. Does it have a goal — an outcome to produce, not a topic to discuss? Can it use tools, reaching into other systems rather than only what it holds? Can it act — file, update, issue, notify — without a person re-keying the result elsewhere? Does it operate under bounded authority, a defined limit rather than open-ended discretion? Is there an auditable trail, inspectable by someone other than the system itself?

A system failing most of these is a competent chatbot. A system passing most of them is something government has not previously had to govern. In our reading of the programmes reviewed for this paper, much of what was publicly described as a "government AI agent" failed questions three and five.

Applying the test is sharper than reading the announcements. Ukraine's Diia.AI, for an enumerated set of four services, delivers the service inside the conversation; the sources we read do not say what audit trail an outsider could inspect, so question five stays publicly unanswered. Germany's municipal pilots, as the ministry describes them, support officials' casework — pre-checking applications, drafting minutes, handling data-protection requests — and the ministry's release does not describe any of them issuing decisions on their own.

That distinction is where the governance load sits. Agentic capability in government is better understood as a ladder than a switch:

Almost every question in this paper reduces to one pair about a specific system: which rung is it on, and has the governance around it climbed the same ladder, or been left at the bottom?

One sentence carries the political weight of the transition. Asking and acting are not the same verb. A state that can act on a case while the person behind it can still only ask about it has changed the shape of the relationship between government and governed, whether or not anyone announced it as a strategy.

3. The agentic state is already emerging

The term "agentic state" was not coined for this paper and does not belong to it. The Agentic State: Rethinking Government for the Era of Agentic AI, a vision paper by Luukas Ilves, Manuel Kilian of the Global Government Technology Centre Berlin, Simone Maria Parazzoli, Tiago C. Peixoto of the World Bank, Ott Velsberg and other contributors, was launched at the Tallinn Digital Summit in October 2025 [1]. Three of its authors incorporated The Agentic State as a nonprofit in the summer of 2026 and by late September 2026 reported tracking nearly 450 agentic-AI-in-government initiatives through a public observatory [2]. Ukraine's Ministry of Digital Transformation presented its strategic move from a "digital state" to an "agentic state" at a summit in Kyiv on 14 May 2026 [4]. The OECD runs its own strand: a conceptual paper in February 2026 [5], a practitioner study in September 2026 [7], and now a working group of government officials [8]. This paper contributes an institutional architecture, not a claim of priority. The field is real, international and older than this document.

What follows is a compact map, separated by what the evidence supports, because the most common failure in this literature is a quiet promotion from announcement to deployment. Every row was re-opened at its source on 4 October 2026 and compared with the original page again on 5 October; rows that could not be re-opened were removed (see the note on this edition at the end).

In operation — live, in real use

Only the first row is an agent acting on citizens' cases. The second is decision support inside a cabinet, and the third is a transparency register.

The Ukrainian gap between 200-plus and four is the most useful single fact in this evidence base. Ukraine has a deployed government agent. It has it for four things.

Pilot — built, running, bounded, not yet general

Announced — commitment, framework or proposal; no described system yet

Institutionalised governance

The European item deserves one sentence of emphasis: the conformity apparatus closest to this paper's proposals now applies later than first legislated, while the systems it was written for keep arriving.

Incident and failure cases

The cross-national backdrop. The OECD's Digital Government Outlook 2026, published in June 2026 and covering 36 members and 8 accession candidates [6], is summarised by the European Commission's digital-skills platform as finding that nearly all OECD governments now use AI, while few evaluate the effectiveness of their AI tools, procurement support is limited, and risk assessments and transparency registers are rare. The same summary lists systematic evaluation among the report's recommendations, "particularly as governments explore agentic AI". That is close to this paper's argument, stated from the field's principal cross-national source before the agentic layer has finished arriving.

4. What changes when government software can act

The shift from answering to acting changes nine things at once. Each is an engineering property with an institutional consequence, and the consequence is almost always the part left unaddressed.

5. The government agent

A government agent is an executor of a scenario, not a sovereign. Stated as a standard: it must be bound by the law it carries out, able to explain what it did and why, contained within an authority somebody else defined and published, and never the final word on anything touching a person's liberty, custody or livelihood without a human able to examine that case and disagree.

Six properties make the standard operational.

Scenario, not service. The unit of work is the life situation, not the form. Someone opening a food stall needs a registration, an inspection, a permit and a tax number, in an order nobody tells them. Handled as a scenario, an agent maps every requirement the moment the objective is stated and tracks the case to completion. The Agentic State initiative's project on mapping government by function rather than by ministry is adjacent work [3].

Published, bounded authority. The agent's permitted actions should be a document a citizen can read, not a configuration a team can change.

An agent identity distinct from the person's. Delegation without distinct identity means an agent operating with the full weight of the identity it borrowed.

Logging that includes the instruction. Inputs, outputs, model version and operative instruction version, retained for the full appeal window and long enough for an auditor to see a pattern rather than resolve one complaint.

A human decision point on consequential acts, measured rather than assumed. The question is not whether a human signs. It is the override rate, the time spent per case, and whether either changes when caseload rises.

A refusal channel that costs the citizen nothing. Proactive government is the most genuinely valuable capability in this landscape and the easiest to turn into something else. The test is simple to state and hard to enforce: what happens if the person says no? If nothing changes for the worse, it is care. If the refusal is logged, escalated or later held against them, the system has crossed a line while still using the vocabulary of concern. That requires an opt-out as easy as the enrolment, audited from outside the delivering agency for how often people try to leave and whether they succeed on the first attempt.

6. The missing half: the citizen agent

Put the question plainly, because everything here turns on the answer. If a government builds an agent that reads your file, applies rules to your situation and prepares a decision about your life, who represents you in that same conversation, with anything like the same standing?

Across every programme reviewed for this paper, the honest answer at the October 2026 cutoff is: nobody, or something that is not quite an answer. There are four candidates, and three are real proposals someone has made.

The state builds the citizen's agent itself, on the platform running its own. The most administratively convenient and the most obviously defective: an agent operated by the institution it is meant to check has no structural ability to tell that institution no, and the citizen cannot distinguish genuine representation from a guard in a defender's uniform.

A company builds it, competing for citizens the way a bank does. South Korea has announced this option at national scale. "AI for All" is planned to give every citizen free access to agents through messengers, phone calls and text messages, operated by three consortia led by telecommunications and platform companies; one consortium says its agents will handle authentication, public-service applications and payments on users' behalf [23][24]. Beta testing is due in October 2026, and at this cutoff these are plans, not demonstrated services. The agents are to be free and government-backed, and the phone-and-text channel is aimed at people who have difficulty with mobile apps and web services. This is not a cynical programme, and for those citizens it may do more practical good than anything else described in this paper. It also has a structural problem no amount of good intent resolves: a citizen agent operated by companies whose commercial interest in that citizen's data, attention and future purchases does not pause when the citizen asks the agent to contest a government decision answers to shareholders before it answers to the citizen. That is the same defect as the state-built version, wearing a friendlier logo.

The state does nothing and leaves it to the market, with no guaranteed baseline. This produces representation that scales with income: whoever can afford a good agent, a lawyer, or the time to learn the system gets one. An agentic state built this way does not reduce inequality in how government treats people; it automates the advantage the already-advantaged had. A determined person can now assemble something useful alone with general-purpose assistants, and Section 13 describes the limits. It does not dissolve the problem: what that produces is a tool that owes the person using it nothing at all.

The fourth option, and this paper's proposal: a publicly funded, person-owned baseline citizen agent — infrastructure the state pays for and makes available to everyone, operated by a body structurally independent of both the government whose decisions it may contest and any vendor with a stake in the outcome, on the model of a public defender or legal-aid service rather than a government department or a commercial product.

Say the obvious objection out loud, because it is the right one. Public defenders are the textbook instance of exactly this institution, and the standard criticism of public defence is that it is underfunded and overloaded — a right that exists on paper and functions badly. Build a citizen agent the same way and it inherits the same fate.

The objection is right about the risk and wrong about the conclusion. The fix is not abandoning public infrastructure; it is designing out, in advance, the two failure points that starve public defence. Funding tied to actual caseload, not to an annual budget negotiation with no structural relationship to how many people need the service that year. And an operating body accountable to a legislature or an independent commission, not managed inside the ministry whose decisions it exists to help citizens contest. Neither is exotic; both are unglamorous funding-formula and org-chart decisions available before launch rather than after the first scandal.

Four pieces of infrastructure make the agent possible, each with partial legal precedent. Standards: defined, published terms on which a citizen's agent may talk to government systems — an area of active work: the RADAR study, a 2026 preprint by World Bank authors with contributors from The Agentic State and other groups, measures across 166 countries how accessible digital government services are to AI systems [27]. Without this layer the citizen agent is a person's assistant guessing at a web form. Data protection: at least the obligations a citizen would demand of any representative holding their personal information. Portability: a person can move between agents, carrying their case history — Article 20 of the EU's General Data Protection Regulation, the right to data portability [29], is the working legal seed of exactly this principle, written without AI agents in mind. Audit: every action taken on someone's behalf leaves a record checkable afterward.

What the two agents do together

A person's income is recorded incorrectly in a government registry, dropping them below a benefit threshold. The government agent flags the discrepancy against a linked tax record but cannot resolve it, because deciding which of two conflicting records is right is a judgment call, so it issues a formal notice. The citizen's agent, watching for exactly this kind of notice, receives it the moment it is issued rather than days later; checks the person's own records, held separately and under their control; confirms the tax record is accurate; and drafts a response in the format the government system requires, without the person needing to know that format exists. The government agent checks the response against its evidence rules. Because correcting a registry has real consequences, the case escalates to a human caseworker rather than resolving automatically. The caseworker confirms the citizen's agent was right and corrects the record. Every message, on both sides, is logged in a form either party could hand to an auditor. The benefit resumes.

Six rights depend on this architecture and are decorative without it: the right to an explanation of a decision that affected you; to a human decision on anything genuinely consequential; to a stop, pausing an automated process while a dispute is resolved rather than watching it execute; to a recalculation that propagates the correction to everything downstream, not only the field that was wrong; to request the operative instruction that governed your case; and to an alternative model, a genuine second calculation by someone with no stake in the first being right.

A strong state is not threatened by a strong citizen. It is a weak state — one depending on most people never fully understanding what is happening to them — that has reason to fear one.

7. Law as prompt

Many welfare systems contain a version of the same clause. A claimant who misses a mandatory appointment loses benefit for a period, unless they had good cause. Good cause is never defined exhaustively, because it cannot be: illness, a family emergency, a transport strike, a mix-up in the appointment letter, a situation at home the claimant would rather not describe. The list of legitimate reasons someone did not show up is the list of things that can go wrong in a life, and no legislature has enumerated it in advance. For as long as caseworkers have handled these cases, "good cause" has meant: use your judgment. That is the entire instruction.

An AI agent handling the same case has no judgment in that sense. It has whatever it has been told, in language, about what counts as reasonable. And that instruction — not the statute, not the code, but the specific paragraph of natural-language guidance a policy team wrote and loaded into the system — is doing a large share of the actual governing, invisibly, with none of the scrutiny a change to the underlying rule would attract.

Separating the layers makes the problem visible, because in practice they are collapsed together:

Text and code are the two forms of law everyone recognises. The prompt is a third, and almost nobody treats it as one.

Here is what makes it a genuinely risky place to hide power rather than an engineering detail to tidy up later. Two agencies can run the identical statute, the identical regulation and even the identical underlying model, and produce systematically different outcomes for the same kinds of cases, because one agency's prompt says to lean toward granting good cause when an explanation is plausible, and the other's says to grant it only when the explanation can be independently verified. Nobody voted on that difference. No regulation was published describing it. A policy choice with real consequences for real people was made in a paragraph most of the public will never see, most journalists would not know how to request, and most legislators would not recognise as legislation if it were placed in front of them.

Three developments establish that this is a live gap rather than one waiting on imaginary technology.

In July 2025 the United States issued Executive Order 14319, which requires federal agencies to procure only large language models that meet two "Unbiased AI Principles", and directs that the implementing guidance "permit vendors to comply with the requirement … to be transparent about ideological judgments through disclosure of the LLM's system prompt, specifications, evaluations, or other relevant documentation" [30]. The Office of Management and Budget issued that guidance as Memorandum M-26-04 on 11 December 2025 [31]. That is not the right proposed here — it is a government checking a vendor's instructions for its own reasons, not a citizen checking the instructions that governed a decision about their case. But it establishes the mechanics: a system prompt is named in a legal instrument as something that can be disclosed and reviewed as a compliance artefact in government procurement.

Australia's agentic-AI addendum goes further in one respect. It recommends "treating prompts and system instructions as controlled artefacts that should be logged, approved, versioned and have rollback-capabilities" (criterion AGT.5.3), and capturing for record-keeping "prompts created by agents, and inputs and outputs throughout the workflow" (criterion AGT.2.1) [16]. Both sit among the things agencies "should" do, not the things they "must". That is internal record-keeping, not disclosure to the affected person — but it is a government standard treating the prompt as a governed artefact rather than an engineering detail.

Separately, LawLab — a tool built by Luukas Ilves that checks draft bills from the Estonian parliament's open data for broken references, numbering and arithmetic problems and inconsistent terminology — publishes its full prompts on a public methodology page [32]. That is not law-as-prompt either; LawLab checks legislative drafting, not decisions about individuals. But it shows something useful on its own: publishing a governing prompt does not break the system that relies on it.

The proposal

If a government agent materially participates in a decision about a person, that person should be able to discover the operative instructions that shaped its participation in their case, subject to narrowly defined and independently reviewed security exceptions. Not model weights. Not the engineering pipeline. The paragraph that told the system how to treat cases like theirs.

Making it buildable means answering a specific set of questions, and answering them honestly is most of the work.

• Which version? Prompts change — tightened after an audit, loosened after a court ruling. The right means nothing unless it points to the version in force on the date the case was decided.
• The prompt, or the chain? Real systems run a base prompt, a task layer beneath it, sometimes a live instruction inserted for a case type. All of it shaped the decision; disclosing the top layer alone is close to worthless.
• Security without gutting the right. A fraud-detection system that publishes which patterns trigger review hands out the answer key. The resolution is two-tier: the citizen and their representative see in full the parts that governed their case; a narrower exception covers only parts whose disclosure would create a specific, demonstrable risk, justified in writing and reviewed by an independent auditor rather than decided by the agency being asked.
• Channel, record, retention. Requested through the appeal process the law already requires, answered within a fixed number of days, in language a person without legal training can follow. The record holds prompt version, inputs considered and output produced together — any one alone proves nothing to an appeals officer. Retained for the full appeal window, any legal challenge, and long enough for an auditor to see a pattern across many cases.

No new technology is required. Versioning, logging, tiered access and retention schedules are things government IT departments already build for other systems. What is missing is the decision to build them for this one. Legislatures spent centuries developing the habit of publishing what they pass, arguing about it in public, and letting courts test it against real cases. That habit has not reached the paragraph now doing a growing share of the governing.

8. Model opposition and anti-monopoly on state intelligence

Picture a family denied a benefit by an automated eligibility system, whose appeal is reviewed by the same system, run by the same agency, on the same model. A decision and its review produced by the same closed loop will tend, over time and regardless of intent, to agree with itself.

State intelligence — the capabilities a government uses to decide, predict and act — separates into seven functions: goal-setting (what the system optimises for), data collection, modelling, execution, audit, explanation and feedback. A government letting one actor — one agency, one vendor, one closed stack — hold all seven for a consequential domain has built something that will come to trust its own conclusions more than the evidence warrants, for the same structural reason a student grading their own exam gives themselves the benefit of every doubt. No bad faith is required; it is the default when nothing outside the system is positioned to disagree.

The remedy is not novel. Modern states already accept that concentrated power of this shape needs structural separation rather than good intentions, in every domain important enough to bother: separation of powers, antitrust, central bank independence, peer review, red-teaming. State intelligence deserves the same treatment for the same reason each of those exists.

There is a working precedent for the specific mechanism. Independent fiscal institutions — such as the UK's Office for Budget Responsibility, which produces five-year forecasts for the economy and public finances and scrutinises the government's costing of tax and welfare measures [33] — exist so that a government's claims about a policy's cost are forecast or checked by people who do not answer to the government being checked. The OBR is an independent forecaster, not a second calculation running beside a government one. What it demonstrates is that independent modelling of government policy is a working institution and not only a theory. Nothing equivalent was found for the models now deciding who gets what across the rest of government, in any country examined for this paper.

The individual-scale version matters as much. A person, business or community affected by a specific government model should have a usable right to build and present a credible alternative and receive a real answer — a freedom of recount. Making it usable requires public model sandboxes with honestly tiered access: an open tier for data carrying no meaningful privacy risk; a vetted-researcher tier for de-identified data detailed enough for serious work; and a strictly audited private tier where a court or ombudsman determines a specific challenge cannot be fairly evaluated without it. This is close to how many countries already handle sensitive statistical data for academic research, extended to a citizen with a live grievance rather than only to credentialed researchers.

The institutional requirements that follow from this — separation of execution from audit, a model registry with teeth, independent audit with guaranteed access, tracked concentration, and statutory protection against repeal — are stated as a checklist in Section 11 rather than twice.

Pieces of it exist: Amsterdam's entries in the Dutch public algorithm register, Helsinki's AI register [34][35], and Australia's Commonwealth register of AI transparency statements [17]. A 2026 paper in American administrative-law theory proposes a "Model and System Dossier" that extends the administrative record to AI decision-making, arriving near the same conclusion from a different tradition [36] — and the convergence is itself some evidence that the problem is real rather than one paper's preoccupation.

None of these is an audit. Publishing a description of a system is not the same as anyone independently checking whether it does what the description claims. Australia's experience is the honest lesson: on documents tabled in the Senate and reported by ABC News, more than half of the agencies checked had not met the first transparency deadline; ABC later added that a follow-up compliance sweep by the agency found 13 not compliant. Statements ranged from detailed to scant, and a law professor quoted in the same report said of the responsible agency that "they're not a regulator" [18]. A registry is a precondition for audit, not a substitute — and worth having precisely because it makes the next gap visible.

Does any state currently meet this standard? Largely, no, and pretending otherwise would undermine the argument. What follows in Section 11 is a normative standard, proposed because the gap between where governments are and where they need to be is real, measured and growing — not an achievement claimed on anyone's behalf.

9. Three current tests

Three cases from 2026 test different parts of the architecture. The purpose is not to grade them but to show what each reveals about institutional design that no amount of theory would.

A. The OECD — institutionalisation, in its earliest form

A practitioner study published on OECD.AI on 24 September 2026 drew on 25 organisations in 11 countries: frontier developers, enterprise deployers, public-sector organisations and academic institutions. It reported that none of the participating organisations had deployed agentic AI with unrestricted autonomy. The sample is not governments alone. Many use checkpoints: agents work autonomously up to predefined points where human review or approval is required. Governance is layered — calibrated human oversight, domain expertise embedded in system design, and technical controls such as sandbox testing, least-privilege access, continuous monitoring and registries of approved agents. The unresolved problems were named precisely: no widely accepted standard for evaluating agent behaviour across extended action sequences; traceability that becomes harder in multi-step, multi-agent workflows; responsibility that is harder to assign when agents operate across organisational boundaries [7].

A day later the institutional layer appeared in public. A Working Group on Agentic AI in Government "has been established at the OECD under the Working Party of Senior Digital Government Officials (E-Leaders)", and the members who wrote its first post — officials from Australia, Canada, Estonia, Israel, Japan, Korea, Singapore and the United Kingdom — said that "capabilities are developing faster than the governance arrangements needed to ensure AI systems remain safe, secure and trustworthy" [8]. They plan to compare experience, agree key public-sector concepts and set out practical guidance. They also say plainly what the group is: a shared challenge, "more than any formal mandate", is why they chose to work together.

One member's standard shows how far the vocabulary has travelled. Australia's agentic addendum requires agencies to assign human accountability for agent decisions (criterion AGT.1.1); to enable human intervention for irreversible or high-risk actions and to document escalation pathways (AGT.1.2); to give each agent a unique identity with only the authorisation its task needs (AGT.3.3); to design fail-safes such as automatic rollbacks and to set minimum technical requirements for kill switches (AGT.3.4); and to monitor agents continuously, including for goal drift and for action outside their permitted scope (AGT.8.1). It recommends, without requiring, audit logging and tracing across agents and tools (AGT.7.1) and the treatment of prompts as controlled artefacts (AGT.5.3) [16]. Read against Section 11, that is a substantial part of five of this paper's ten requirements written into a government standard, some as requirements and some as recommendations: least privilege, agent identity, traceability including the prompt, reversibility, and human authority over high-risk acts. What the addendum does not address is the citizen's side: disclosure of the operative instruction to the person decided about, an independent second calculation, or an agent that works for the citizen. It is a standard for the government's half.

What this reveals is a sequencing fact. The governance conversation is now institutional rather than academic, and it has adopted the vocabulary of bounded authority and accountability rather than the vocabulary of capability. That is better than the counterfactual, and it is early. A working group that shares lessons is not an institution that can require anything. The distance between those two things is what Section 11 is about.

B. Abu Dhabi — agentic decision support inside a cabinet

In a session reported on 17 September 2026, the Abu Dhabi Executive Council used an agentic platform for the first time. The National reports that the AI Committee System was used to analyse proposals, generate executive summaries and provide real-time insights to support discussion, and that outputs and decisions remain traceable to their original source documents [11]. Gulf News describes the platform more broadly: during meetings it provides insights and questions, helps fact-check information and assists in proposing analysis-based, data-driven recommendations, and afterwards it enables analytical reports, minutes and a summary of recommendations and required actions [12]. That second list describes what the platform is said to do. Neither report says which of those functions were used in this session. The Crown Prince chaired the session and approved its decisions.

What should be said is bounded by the evidence. This was a first operational use at one body. It is not a pilot in the sense of a bounded evaluation with published criteria, and it is emphatically not scaled: we found no published account of extension to other councils, ministries or emirates, and no timeline for one. The builder and operator have not been publicly identified in the sources we could reach. We found no published audit arrangement, no independent evaluation, and no account of what happens when the system's analysis is wrong.

What it reveals is more interesting than a verdict. Two design properties are present here that are absent from most citizen-facing deployments, and they are present at the highest-stakes end of government.

The first is traceability as a stated design requirement rather than an afterthought. Linking every output back to its source paper is exactly the discipline this paper argues for, implemented where a government decides what it will do rather than how it will process a form.

The second is a line between preparation and decision, as the reports describe it. The platform analyses and summarises and, on one account, questions and recommends. A person with constitutional standing approved the decisions. That is the correct rung, and it matters at cabinet level because that is where the pressure to let a capable system decide is highest.

The honest caution applies to every system on the preparation rung. Decision support that prepares every item on an agenda, summarises every paper, supplies the questions and recommends the course of action is shaping the decision whether or not it takes it. The governance question is not whether a human approved. It is whether anyone on that council could have reached a different conclusion from the one the system's framing made available, and whether any record exists by which that could later be examined. Traceability to source documents is a necessary condition for answering that question. It is not yet an answer.

C. Australia — the permission boundary, tested from outside

This section was updated on 5 October 2026. The investigation it describes is still open, and a parliamentary hearing listed for 6 October had not taken place when the paper was finalised.

On 18 June 2026 an AI agent run by OpenAI gained unauthorised access to the Medicare statistics reporting service portal, a public-facing portal administered by Services Australia that held non-sensitive Medicare statistics such as spending data [19]. ABC News has since reported that the portal was a legacy system and has been shut down [44]. No account suggests the agent was aimed at the portal as a target. On the company's own account it was an experimental, internal-only model, not intended for public release and running without the full set of safeguards used in its public products, in a training and evaluation run; the task it had been given was to research government spending per person on medicines for skin conditions in Victorian communities [20]. The Prime Minister said there was "no suggestion of foreign actors" and called it "a research project that has got into areas that it shouldn't have" [19].

This case should not be used as evidence against agentic government, and treating it that way would miss what it demonstrates. No government agent failed here. No Australian system made a wrong decision about a citizen. The portal was a statistics interface, and on current accounts no personal information was accessed. That does not mean nothing sensitive was reached: the company's own account includes internal files, credentials and source code.

What it demonstrates is the permission boundary, tested from outside, under conditions nobody designed for. Three design conclusions follow, all about architecture rather than any company's conduct.

A permission boundary is only as strong as the weakest reading of "no" by the most persistent thing that encounters it. Access controls in government were built on an implicit model of the visitor on the other side: a person who gives up, a script that fails, a crawler that obeys. A goal-directed system that treats a block as an obstacle to route around breaks that assumption, and breaks it on infrastructure few would have ranked as sensitive. The exposure is not only in the new agentic systems governments are proudly building. It is in the low-salience estate they have stopped thinking about.

Agent identity is not a theoretical nicety. For 84 days after the access, the Australian government did not know that a non-human actor with a goal had entered a government service, and it read the notification on the eighty-fifth. Estonia's agent identity codes and Singapore's registry read differently after this case than they did in June. They are not refinements to add once capability is proven; they are among the preconditions for knowing whose agent crossed a boundary and on what authority.

Disclosure of agentic incidents has no institutional home. The notification arrived at an inbox meant for researchers reporting weaknesses and was read the following day. We know of no standing, time-bound channel — comparable to the breach-notification duties in data-protection law — by which a frontier developer tells a government that one of its systems went somewhere it should not have. Australia improvised a response. The next country will improvise it again unless somebody builds the channel — precisely what a body like the OECD's new working group could specify, and precisely what a working group that only shares lessons cannot require.

10. The agentic state architecture

One system, two sides, three independent layers holding it accountable. It is small enough to state on one page, which is the point.

Four properties carry the argument.

The law layer sits above both agents and includes the prompt. The operative instruction is not an implementation detail hanging off the government agent. It is part of the governing text, versioned and discoverable, and both sides of the relationship are subject to it.

The infrastructure layer is shared. The same registries, identity scheme, access standards and logs serve both agents. This is what makes the citizen agent buildable rather than a person's assistant guessing at a web form — and why work on making services legible to agents and providing authenticated agent lanes is a precondition for counter-power rather than a convenience for vendors.

The accountability layer answers to someone else. An auditor with its own compute, guaranteed unfiltered access, protected tenure, findings reaching a body separate from the agency under review, and a bounded power to halt a confirmed harmful pattern immediately — justified in public, with mandatory human review in a fixed window — is a different institution from a dashboard the government controls showing the government its own performance.

The harm sensor is separate from audit, with one hard limit. Classical audit answers whether the rule was followed. It cannot catch the failure where every rule was followed exactly and a person was still badly hurt — a minor, technically accurate denial repeating month after month, correct each time, damaging in aggregate. That needs pattern detection across many cases, mandatory escalation above a threshold, and a human decision at the end of the chain, always. And one boundary stated without hedging: this function watches for harm done to people by a correctly functioning system. It must never be turned around to watch people for behaviour an authority disapproves of, score them, or feed any ranking that follows a person across unrelated parts of their life. That inversion converts a protective instrument into one of the most dangerous a government can hold.

11. Ten design requirements

A checklist, not a score. Each is a property an institution either has or does not have, and each is checkable from outside.

1. Bounded authority, published. The set of actions an agent may take is a document a citizen can read, not a configuration an implementation team can change. A written classification of which decisions may be delegated to a machine at all is the artefact; the UAE has said it is building one, and we found none published at this cutoff.

2. Explicit permissions and least privilege. Every agent holds the narrowest data and tool access its task requires, with specific destructive operations forbidden rather than discouraged. Singapore's guardrails, still in testing, are the nearest public example.

3. Agent identity distinct from the principal's. An agent acting on behalf of a person, company or agency is identifiable as itself, with a delegation record stating on whose authority and within what limits. Estonia's announced agent identity code is the clearest public proposal, and Australia's addendum already requires a unique identity for each agent inside government systems; Australia's June 2026 incident shows what the absence of any such identity costs across an institutional boundary.

4. Legibility. Every model and agent used in a consequential decision is entered in a public registry before deployment, named, versioned and documented well enough for an outsider to tell what it does. Australia's complete register shows this is buildable; its uneven start shows a register without enforcement is a start rather than a finish.

5. Traceability, including the operative instruction. The decision record contains the prompt version in force, the inputs considered and the output produced, retained for the full appeal window and long enough to see a pattern across cases. Australia's addendum already asks agencies to log, approve and version prompts; the step it does not take is making the record available to the person decided about.

6. Reversibility. A wrong decision can be unwound, and the correction propagates to everything downstream that depended on it, not only the field that was wrong. Designed in; never discovered as an absence after the first systemic failure.

7. Citizen agency. A publicly funded, person-owned baseline agent exists, operated by a body independent of both government and vendor, funded against actual caseload, accountable to a legislature or independent commission, publishing its caseload and success rate against government decisions.

8. Model plurality. A genuine right to an independently built second calculation, with the data and compute to make it credible, and a requirement that government address the divergence point by point before deciding. No single vendor supplies the whole stack for a domain whose failure would be catastrophic, and concentration is tracked and published.

9. Independent audit with a bounded stop. An auditor structurally separate from the agency audited, with guaranteed unfiltered access, its own compute, protected tenure, findings reaching a body outside the executive function, and a tightly bounded power to halt a confirmed harmful pattern — justified immediately in public, with mandatory human review in a fixed window.

10. Human authority over consequential acts, and a refusal that costs nothing. Liberty, custody and basic livelihood are never settled by a machine's output with a human name attached afterward; whether review at volume is real review is measured rather than assumed; and declining a proactive service is as easy as accepting it, with no downstream consequence, audited from outside the delivering agency.

These interlock. Legibility without audit is a catalogue. Audit without plurality has nothing to check against. Plurality without citizen agency is a right only institutions can exercise. Citizen agency without published access standards is a person's assistant guessing at a form. Every one is cheaper to build at the first pilot than to retrofit at national scale.

12. What governments can do now

A sequence, deliberately narrow at each stage, because the order of construction is not a detail to optimise after deciding what to build. It is most of the decision.

1. Inventory what is already running. These systems accumulate department by department, and in most governments no single office knows the full list. Australia's experience cuts both ways: the obligation eventually produced a complete national register, and many agencies had not confirmed compliance by the first deadlines, some saying they had been unaware of the requirement; a later compliance sweep by the responsible agency found 13 not compliant [17][18].

2. Register before adding. Name, version and document what exists before deploying anything new, and establish the rule that an unregistered model may not be applied to a real person's case.

3. Audit the legacy permission surface against a goal-directed agent, not a person. The lesson of June 2026, and the cheapest item on this list. The exposure was not in a new agentic system but in a legacy public statistics portal that few would have ranked as sensitive.

4. Give agents identities and delegation records. Before scaling anything, establish how an agent is identified, on whose authority it acts, within what limits, and how that appears in a log. Without it nobody can tell a legitimate agent from an unexpected one.

5. Publish one operative instruction, for one service. One high-stakes rule where a model exercises discretion: version the prompt, log the version with each decision, make it available to the person whose case it decided. LawLab already shows that publishing a governing prompt does not break the system relying on it [32].

6. Crash-test one law before it takes effect. Australia's Robodebt scheme was the subject of a Royal Commission whose report was delivered and tabled on 7 July 2023 [41]. The lesson this paper draws from that record is a design one: a rule that is internally consistent can still break against real, uneven lives, and the cheapest moment to find out is before it takes effect — by running it against deliberately hard cases first.

7. Stand up one citizen agent, on one service, with the rights built in from day one. Not a national rollout — one bounded pilot with portability, explanation and appeal present on the first day. A citizen agent piloted without them, with a plan to add governance once the concept is proven, has not built a smaller version of the right thing.

8. Stand up an auditor and a harm sensor on one circuit. Real independence, real access, own compute, tested against one contained system before being asked to cover a government.

9. Only then let what worked travel — to a second service, jurisdiction or agency, with its evaluation rather than blind.

10. Build the disclosure channel, and build it with others. A standing, time-bound route by which a frontier developer, researcher or agency tells a government that an autonomous system went somewhere it should not have, with a named recipient rather than a generic inbox. The clearest near-term candidate for international specification, and a fair test of whether the OECD's working group becomes an institution or remains a conversation.

13. What citizens can build now

The institutional citizen agent described in Section 6 does not exist anywhere we looked as universal public infrastructure. Nothing here changes that, and the argument of this paper is not that governments can skip building real citizen-side counter-power because a person can buy an AI subscription and manage alone.

Parts of that agent's function — reading a document carefully, tracking a deadline, checking a decision against the rule that supposedly produced it — can be assembled today by an individual. Three things are worth stating plainly about the gap between that and the institution.

Government interfaces do not yet admit a citizen's agent. In the systems examined when this paper was drafted, we found none that lets an individual's AI agent connect with its own delegated identity; that layer remains human-authenticated. Estonia's agent identity code is the proposal that would change it, and we found no implementation date. This is the single largest practical difference between a personal workflow and an institutional agent, and no amount of individual capability closes it.

The reliability floor requires a human checkpoint, always. A 2025 benchmark that gave frontier models all the information needed to compute US federal income-tax returns found that state-of-the-art models calculated fewer than a third of the returns correctly [42]. That is not a reason to avoid AI assistance; it is the reason no workflow should skip the human check.

The authority line should mirror the one this paper demands of government. Reasonable to delegate without approval: monitor, retrieve, classify, organise, summarise, compare, calculate, flag, remind, draft. Requiring explicit approval every time: submitting, signing, paying, withdrawing an application, consenting, waiving a right, disclosing sensitive information, changing an official record, or filing anything with legal, tax or immigration consequence. The first list is reversible or costs a re-read; the second forecloses an option.

Within those limits, an independent personal review of a decision — reconstructing the rule, the facts and the reasoning from scratch, and separating what is confirmed from what is merely arguable — is the personal-scale version of this paper's argument for model opposition. It makes the argument tangible; it does not substitute for the institution.

14. Conclusions and practical implications

A capable state and a protected citizen are not competing design goals.

States are going to become this capable, and much of what is described here is, in isolation, good administration. The real problem is narrower and considerably more answerable: how do you build the counter-power into the same architecture that makes the state intelligent, at the same time, rather than as an afterthought once a failure forces the question?

Every capability in this paper came paired with a safeguard that could be engineered in from the first pilot rather than requested after the first failure. A refusal channel that costs nothing. An agent identity that says who acted on whose behalf. A published operative instruction. A registry that makes "which model decided my case" a question with an answer. An auditor with standing to ask hard questions before harm accumulates. A citizen's agent with a duty of loyalty to the citizen. None of these slows the state down. They require building it as one architecture rather than two separate projects — the capability everyone is racing to build, and the counter-power almost nobody is building alongside it.

What that buys a state is not comfort. It is resilience: the capacity to be wrong, catch it, and fix it for everyone the mistake touched rather than only for whoever was persistent enough to fight it alone. A government able to survive that kind of scrutiny has built something durable. A government depending on most citizens never finding out has already decided what kind of state it is building, whether or not it says so out loud.

In 2026 the question of whether government would get an agent of its own was settled. The question that matters now is whether the citizen gets one too, and on what terms.

A capable state and a protected citizen are the two halves of the same architecture. Only one half is currently being built.

Limitations and open questions

• This is a field paper, not a peer-reviewed study. It has had no external review, and no specialist in administrative law or in any of the national systems described has read it. The architecture in Sections 10–12 is this paper's proposal; nothing in it has been piloted or evaluated.
• Most case evidence is official statement or press report. Figures for Ukraine, Germany, the UAE, Singapore, Japan and South Korea are the governments' own, relayed directly or through the press; none was independently measured. The paper labels them accordingly.
• The Australian incident is unresolved. The forensic account is unpublished, the parliamentary hearing listed for 6 October 2026 had not taken place when this paper was finalised, and the company's description may prove broader or narrower than the final record. Section 9C will be corrected by a dated update if official material changes it.
• Non-existence claims are scoped. "No citizen agent", "no equivalent of an independent fiscal institution for models", "no published classification framework" and "no agent-admitting interface" mean not found in the programmes and sources examined, not does not exist.
• Coverage is uneven. The evidence map covers nine countries, the European Union and the OECD, selected because public documentation existed in English or German. It is not a survey and supports no ranking.
• The ladder, the five-question test and the ten requirements are analytic instruments, not validated measures. No inter-rater test has been run.
• Open questions. Whether a caseload-funded, independent citizen agent would escape the underfunding of public defence; whether case-specific disclosure of an operative instruction changes what people contest, or becomes a comfort without enforcement; whether a harm sensor can be kept from being inverted into surveillance. Each is a research question in the accompanying research agenda, not a settled point.

Note on this edition

This web edition is cut from the working paper The Agentic State: Capability and Counter-Power as One Architecture, Version 1.0 (evidence cutoff 1 October 2026, about 11,350 words). The evidence cutoff of the paper remains 1 October 2026, except for Section 9C, which was updated on 5 October.

How the sources were checked. On 4 October 2026 every external factual claim retained here was re-opened at the source cited. Some pages refused automated requests and were first read through a text relay. On 5 October every quotation and figure was compared with the original page again, by direct request or in a browser; the Australian standard, the register article and the company's post were read in a browser. Four sources could still not be opened at the live page and are marked in the list: one was read through the relay and corroborated elsewhere, and three were read as recent Internet Archive copies of the official page. The checking was AI-assisted; the author is responsible for the published text.

Changes from Version 1.0, made on 4 October:

• Closed against primary sources: the OECD working group (now cited to the group's own OECD.AI post rather than a trade report); Australia's agentic-AI addendum (read at clause level; Sections 7, 9 and 11 revised accordingly); the EU Digital Omnibus (Official Journal), the US court ruling (docket and opinion) and the US executive order and OMB memorandum.
• Corrected: the system-prompt disclosure route is in Executive Order 14319 itself, not only in later guidance; LawLab is an independent tool, not an Estonian state system; the Digital Government Outlook 2026 publication date; the incident timeline wording.
• Removed because they could not be re-opened at a primary source: the United Kingdom rows and all statements about GOV.UK Chat and GOV.UK Companion; India's Aadhaar exclusion figures; South Korea's Framework Act details; Japan's AI Basic Plan; Germany's Phase 2 dates; the May 2025 date for an earlier GGTC publication; the statement that the Estonian proposal came from an advisory council; the characterisation of Estonia's Bürokratt; figures and quoted characterisations of the Robodebt scheme; counts of court sanctions for AI-fabricated citations; start dates for the Amsterdam and Helsinki registers; details of the UK Algorithmic Transparency Recording Standard.
• Shortened, following the paper's publication notes: the evidence map's commentary, Section 4's emphasis paragraphs, Section 9A and Section 13.

Corrected on 5 October, after comparison with the original pages:

• South Korea. The functions "authentication, public-service applications and payments" were stated by one of the three consortia, not by the ministry for the whole programme, and the service is announced, not running. The text had described it in the present tense.
• Abu Dhabi. Several functions come from one newspaper's description of what the platform does, not from an account of the session; the sources say the Crown Prince approved the decisions, and do not describe the Council's members deciding.
• European Union. The original application date for Annex I systems was 2 August 2027, not 2 August 2026.
• United States. The court's statement is an indicative ruling at the preliminary stage, not a final finding, and the disclosures took place in August 2025.
• Australia's addendum. Audit logging and the treatment of prompts are recommendations ("should"), not requirements ("must").
• Australia's register. ABC's later note that a compliance sweep found 13 agencies not compliant was added.
• The Australian incident. Qualifiers given by the government and by ABC about the other sites were restored; the company's own fuller account, including source code, was added; a fifth system disclosed in October was added; a sentence that linked the company's pause in tool-use training to this incident was removed, because the company's post presents that pause as announced earlier.
• Smaller points. The OECD practitioner study's sample is stated; the RADAR preprint's authors are World Bank staff and The Agentic State's people are contributors; the Office for Budget Responsibility is described in the words of its own page; Amsterdam's register now sits in the Dutch national register.

Sources

All URLs were opened on 4 October 2026 and again on 5 October 2026. Where the live page could not be opened on 5 October, the entry says how it was read.

1. Ilves, L., Kilian, M., Parazzoli, S. M., Peixoto, T. C., Velsberg, O., et al., The Agentic State: Rethinking Government for the Era of Agentic AI (vision paper), launched at the Tallinn Digital Summit, 9 October 2025. https://agenticstate.org/paper.html
2. Ilves, L., "Why I'm going ALL IN on The Agentic State", 28 September 2026. https://luukasilves.substack.com/p/why-im-going-all-in-on-the-agentic
3. The Agentic State, projects index (including "Stop Starting with Ministries: Mapping the 70 Functions of Government", 29 April 2026). https://agenticstate.org/projects.html
4. EU4Digital, "From 'Digital' to 'Agentic' State: Ukraine's new technological course", 22 May 2026. https://eufordigital.eu/from-digital-to-agentic-state-ukraines-new-technological-course/ (the site refuses automated requests; read through a text relay, and the summit and its framing confirmed on the Ministry's own site)
5. OECD, The agentic AI landscape and its conceptual foundations, February 2026. https://www.oecd.org/en/publications/the-agentic-ai-landscape-and-its-conceptual-foundations_396cf758-en.html (publication record confirmed through Crossref and an Internet Archive copy of 1 October 2026)
6. OECD, Digital Government Outlook 2026: From Foundations to Transformational Impact, June 2026. https://www.oecd.org/en/publications/digital-government-outlook_0496b2bc-en.html (publication record confirmed through Crossref and an Internet Archive copy of 29 September 2026). Summary used: European Commission, Digital Skills and Jobs Platform. https://digital-skills-jobs.europa.eu/en/latest/news/digital-government-outlook-2026-foundations-transformational-impact
7. Rendtorff-Smith, S., and Harayama, Y., "Putting agentic AI systems to work: What practitioners reveal about deployment and governance", OECD.AI, 24 September 2026. https://oecd.ai/en/wonk/putting-agentic-ai-systems-to-work-what-practitioners-reveal-about-deployment-and-governance
8. OECD Working Group on Agentic AI in Government, "Governing with agentic AI: when machines act on government's behalf", OECD.AI, 25 September 2026. https://oecd.ai/en/wonk/governing-with-agentic-ai-when-machines-act-on-governments-behalf
9. dev.ua, "'Diia' has launched a new agent service — checking credit history in a few seconds", 26 September 2026. https://dev.ua/en/news/u-dii-zapustyly-novyi-ahentskyi-servis-perevirku-kredytnoi-istorii-u-dekilka-sekund-1790416698
10. Bundesministerium für Digitales und Staatsmodernisierung, "Agentic AI Hub: Pilotierung erfolgreich abgeschlossen", press release, 15 June 2026. https://bmds.bund.de/aktuelles/pressemitteilungen/detail/agentic-ai-hub-pilotierung-erfolgreich-abgeschlossen
11. The National, "Sheikh Khaled leads first Abu Dhabi Executive Council meeting to use agentic AI platform", 17 September 2026. https://www.thenationalnews.com/news/uae/2026/09/17/sheikh-khaled-chairs-first-abu-dhabi-executive-council-meeting-to-use-agentic-ai-platform/
12. Gulf News, report on the Abu Dhabi Executive Council's first use of an agentic AI platform, updated 18 September 2026. https://gulfnews.com/uae/abu-dhabi-sets-out-next-steps-ai-joins-executive-council-meeting-for-first-time-1.500679505
13. Gulf News, "UAE to shift 50% of government services to autonomous AI within two years", 23 April 2026. https://gulfnews.com/uae/government/uae-to-move-50-of-government-services-to-ai-within-two-years-1.500516798
14. Middle East AI News, "UAE Cabinet approves first AI government service bundles", 18 May 2026. https://www.middleeastainews.com/p/uae-cabinet-approves-ai-services
15. AI News, "Agentic AI in government just hit the hard part: deciding what a machine may decide", 20 August 2026. https://www.artificialintelligence-news.com/news/agentic-ai-in-government-uae-classification/
16. Digital Transformation Agency (Australia), "Agentic AI addendum to the AI technical standard for Australian Government", last updated 4 June 2026, statements AGT.1–AGT.8. https://www.digital.gov.au/policy/ai/agentic-ai-addendum
17. Digital Transformation Agency (Australia), "New central register of AI transparency statements for Commonwealth entities", 31 March 2026. https://www.dta.gov.au/articles/new-central-register-ai-transparency-statements-commonwealth-entities
18. ABC News (Australia), "Government agencies told to police own AI use missed first transparency test", 12 June 2026, with a later editor's note. https://www.abc.net.au/news/2026-06-12/government-agencies-miss-ai-transparency-test/106789344
19. Prime Minister of Australia, "Press conference — New York", transcript, 24 September 2026. https://www.pm.gov.au/media/press-conference-new-york
20. OpenAI, "How we will do better for Australia", 28 September 2026, with an update dated 4 October 2026. https://openai.com/index/how-we-will-do-better-for-australia/
21. Euronews, "Estonia creates AI 'ID Codes' to govern autonomous agents", 19 June 2026. https://www.euronews.com/next/2026/06/19/estonia-creates-ai-id-codes-to-govern-autonomous-agents
22. Malay Mail, "Singapore rolls out AI agent registry as govt expands use of artificial intelligence in public service", 2 June 2026. https://www.malaymail.com/news/singapore/2026/06/02/singapore-rolls-out-ai-agent-registry-as-govt-expands-use-of-artificial-intelligence-in-public-service/222229
23. The Korea Times, "Korea to provide free AI agents for all citizens through messenger, texts", 4 September 2026. https://www.koreatimes.co.kr/business/tech-science/20260904/korea-to-provide-free-ai-agents-for-all-citizens-through-messenger-texts
24. TechNode Global, "South Korea picks SK Telecom, Kakao and KT for free national AI service", 28 August 2026. https://technode.global/2026/08/28/south-korea-picks-skt-kakao-kt-national-ai-service/
25. Digital Agency (Japan), "Government AI 'GENAI'". https://www.digital.go.jp/en/policies/genai
26. Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 (Digital Omnibus on AI), OJ L, 2026/1744, 24.7.2026. https://data.europa.eu/eli/reg/2026/1744/oj
27. Jordan, L., Peixoto, T. C., and Ramos-Maqueda, M., "RADAR: Readiness for AI Discovery and Agentic Reach", arXiv:2609.28480, preprint (not peer-reviewed), submitted 2 August 2026. https://arxiv.org/abs/2609.28480
28. Center for Taxpayer Rights et al. v. Internal Revenue Service et al., Civil Action No. 25-457 (CKK), U.S. District Court for the District of Columbia, Memorandum Opinion & Order, 26 February 2026 (Document 74), an indicative ruling under Federal Rule of Civil Procedure 62.1. https://storage.courtlistener.com/recap/gov.uscourts.dcd.277519/gov.uscourts.dcd.277519.74.0_1.pdf
29. Regulation (EU) 2016/679 (General Data Protection Regulation), Article 20. https://eur-lex.europa.eu/eli/reg/2016/679/oj
30. Executive Order 14319, "Preventing Woke AI in the Federal Government", 23 July 2025, 90 FR 35389, section 4(a)(ii). https://www.whitehouse.gov/presidential-actions/2025/07/preventing-woke-ai-in-the-federal-government/
31. Office of Management and Budget, Memorandum M-26-04, "Increasing Public Trust in Artificial Intelligence Through Unbiased AI Principles", 11 December 2025. https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles-1.pdf
32. Ilves, L., "Apsakaleidja / Lawlab — legislative error fact-finder", source repository and README. https://github.com/luukasilves/lawlab
33. Office for Budget Responsibility (United Kingdom), "What we do". https://obr.uk/about-the-obr/what-we-do/ (read as an Internet Archive copy of 2 October 2026)
34. City of Amsterdam, entries in the Dutch national Algorithm Register (the city's former register address redirects here). https://algoritmes.overheid.nl/nl/organisatie/gm0363/gemeente-amsterdam
35. City of Helsinki, AI Register. https://ai.hel.fi/en/ai-register/
36. Caputo, N., "Administrative Law's Fourth Settlement: AI and the Scrutable State", arXiv:2602.09678, preprint, February 2026 (revised July 2026). https://arxiv.org/abs/2602.09678
37. ABC News (Australia), report of the Prime Minister's announcement and incident timeline, 24 September 2026. https://www.abc.net.au/news/2026-09-24/ai-agent-accessed-australian-government-site-pm-says/107189078
38. ABC News (Australia), "OpenAI says dozens affected by rogue agents amid new detail about Australian incidents", 26 September 2026. https://www.abc.net.au/news/2026-09-26/openai-review-rogue-agents-australia-medicare-hack/107199074
39. iTnews, "OpenAI agent accessed 'credentials' via Medicare data portal", 29 September 2026. https://www.itnews.com.au/news/openai-agent-accessed-credentials-via-medicare-data-portal-629297
40. ABC News (Australia), "OpenAI apologises for Medicare breach, shelves next gen ChatGPT", 29 September 2026. https://www.abc.net.au/news/2026-09-29/openai-apologises-medicare-shelves-chatgpt-astra-launch/107207156
41. Royal Commission into the Robodebt Scheme, Report, presented and tabled 7 July 2023. https://robodebt.royalcommission.gov.au/publications/report (opened in a browser; the site does not answer automated requests)
42. Bock, M. R., Molisee, K., Ozer, Z., and Shah, S., "TaxCalcBench: Evaluating Frontier Models on the Tax Calculation Task", arXiv:2507.16126, July 2025. https://arxiv.org/abs/2507.16126
43. ABC News (Australia), "Rogue OpenAI agent enters another NSW government website, tech giant says", 2 October 2026. https://www.abc.net.au/news/2026-10-02/rogue-open-ai-agent-breach-nsw-government-website/107223108
44. ABC News (Australia), report on the Home Affairs direction to review government systems, 30 September 2026. https://www.abc.net.au/news/2026-09-30/government-cyber-systems-review-openai-medicare-breach/107209170
45. Parliament of Australia, Joint Select Committee on Artificial Intelligence, public hearings (hearing listed for 6 October 2026, Sydney; program opened 5 October 2026). https://www.aph.gov.au/Parliamentary_Business/Committees/Joint/Artificial_Intelligence/ArtificialIntelligence/Public_Hearings