Keeping an Agentic State Answerable

1. The question

Governments are starting to use AI systems that act: that read a case, query a registry, apply a rule and close the file. A group of government officials writing as the OECD Working Group on Agentic AI in Government put the resulting problem in one sentence in September 2026: "capabilities are developing faster than the governance arrangements needed to ensure AI systems remain safe, secure and trustworthy" [1].

This agenda asks what those governance arrangements would have to be, and treats the answer as a set of research problems rather than a set of positions. Its umbrella question is:

How can counter-power be built into the same architecture that makes a state capable of acting through AI agents?

The agenda does not answer that question. It breaks it into eight questions that can be answered, says how, and says what result would count against the idea behind each one.

2. Where the questions came from, and what is not new

The questions come from a prior-art audit. Thirty claims were extracted from a book-length manuscript by the author and tested against six literature corpora — about 115 papers — in a search run on 2 October 2026. Each claim was given a verdict: established, emerging in parallel elsewhere, or apparently open.

The audit's first result was negative, and it belongs at the front. Four of the manuscript's broad claims sit close to work that already exists. The manuscript's wording and the literature's are not the same, so each line below gives what the cited work argues:

• The manuscript says transaction-based digital government has reached a ceiling. Dunleavy and Margetts argue that data science and AI open a third wave of digital-era governance, beyond bureaucracies built around transactions [2].
• The manuscript says government should be organised around life situations. Scholta and co-authors describe a "no-stop shop", in which services are delivered proactively, triggered by life events, without the citizen applying [3].
• The manuscript says states and citizens face an asymmetry in machine capability. Fourcade and Gordon argue that data-driven statecraft can make the state less accountable [4], and the preprint by Sharp and co-authors argues that unequal access to capable AI agents creates new inequalities of power [5].
• The manuscript says AI can support democratic deliberation. Tessler and co-authors report in Science that an AI mediator helped groups find common ground [6].

None of these is a research question in this agenda. They are cited as the ground the agenda stands on. The name of the field is not ours either: The Agentic State is the title of a vision paper launched in October 2025 by Luukas Ilves, Manuel Kilian and co-authors [7].

The audit's second result is that "agentic government" was, as far as a limited search could tell, not yet a settled academic field in October 2026: recent work exists from several groups [8][9][10][11][12], much of it preprints and workshop papers, without a shared vocabulary. That makes novelty judgments fragile. A question listed here as open may already have been answered in a paper the search did not reach, or may be answered before any study in this agenda is run.

3. The eight questions

Each question is stated with its closest existing work, a hypothesis, a method, the evidence it would need, and the finding that would weaken it. The hypotheses are the author's proposals. None has been tested.

3.1 The citizen agent

Question. Can a publicly funded, structurally independent AI agent available to every citizen — on the model of a public defender — work as a counterweight to government AI agents? Which design features decide whether it succeeds or decays into the underfunding and capture that public defence is criticised for?

Closest work. The administrative-burden framework of Herd and Moynihan [13]; Busuioc on holding algorithms to account [14]; Sharp and co-authors on agentic inequality [5]. Sharp and co-authors come closest: they raise "public-good agents" and "universal basic agency" and ask whether a government should provide a public-option AI agent. They pose these as open questions and do not specify an independent body on the public-defender model, or how it would be funded. The first two works do not propose the institution.

Hypothesis. An agent funded by a caseload-indexed formula and governed by a body separate from the agencies it may challenge will produce higher citizen trust and willingness to contest decisions than a government-embedded or commercially run alternative — but only if both funding independence and governance independence are present.

Method. Comparative institutional analysis of public-defence funding models and their failure modes; a design-science prototype against one bounded administrative dispute, such as a benefit-eligibility appeal; a three-arm survey experiment comparing government-run, independent-body and market-vendor framings of an otherwise identical agent.

Evidence needed. Secondary literature on public-defence funding (not yet reviewed); original experimental data; a working demonstration prototype.

What would weaken it. No significant difference in trust or willingness to contest across the three governance models. That would be reported as a null result. A further weakness is already visible: the public-defender analogy may not transfer, and caseload-indexed funding has a mixed record in public defence itself.

3.2 Law as a prompt

Question. Does the natural-language instruction that steers an AI system's exercise of administrative discretion function as a distinct, legally significant form of rule alongside statute, regulation and code? And does giving an affected person a case-specific right to see the instruction that governed their case change contestation behaviour, or does disclosure without enforcement become a comfort?

Closest work. Kaminski and Malgieri on multi-layered explanations [15]; Grimmelikhuijsen's experimental work on algorithmic transparency and perceived trustworthiness [16]; Salah and co-authors on democratic authorisation and on discretion [9][10]. The central counter-citation is Cath and Jansen's "Dutch Comfort", on the limits of AI governance through municipal registers [17]. Any work on this question has to be designed against that objection, not merely mention it.

Hypothesis. An operative instruction differs from code (it steers a probabilistic model and is never fully deterministic) and from published legal text (it is operational and not published by default). A case-specific disclosure right closes an accountability gap that general registers do not — but only when paired with enforcement and redress.

Method. Part one: doctrinal and comparative legal analysis specifying the right (version-pinning, a two-tier security exception, integration with the appeal record). Part two: a vignette survey experiment comparing contestation behaviour under general-register and case-specific-disclosure conditions.

Evidence needed. A small corpus of actually disclosed government system prompts, which is the hardest evidence in this agenda to obtain; original experimental data. Two public facts show the object exists. A 2025 US executive order directs that vendors be permitted to show transparency "through disclosure of the LLM's system prompt, specifications, evaluations, or other relevant documentation" [18]. And Australia's agentic-AI addendum to its technical standard lists, among the prompting practices agencies should consider, "treating prompts and system instructions as controlled artefacts that should be logged, approved, versioned and have rollback-capabilities" [19]. Neither gives the affected person anything.

What would weaken it. No difference in contestation behaviour between the two disclosure conditions. That would support the sceptics, and the doctrinal part would have to stand on its own.

3.3 Anti-monopoly inside the state

Question. Can the structural-separation logic that scholars apply to concentration in AI markets be extended coherently to a state's own AI functions — goal-setting, data, modelling, execution, audit, explanation, feedback? Does the European Union's AI Act governance structure already approximate such a separation, or fall short of it?

Closest work. Korinek and Vipra on concentration and market structure in AI [20]; Novelli and co-authors on the AI Act's governance bodies — the AI Office, AI Board, Scientific Panel and national authorities [21]; Simoncini on separation of powers and the administrative branch in the EU [22]. Birkstedt and co-authors' review of AI-governance research lists the field's knowledge gaps [23]. Separation of functions inside the state is not among the themes it covers. The audit read that as absence; the review does not itself name it as a gap.

Hypothesis. Mapped against a seven-function framework, the AI Act's architecture leaves two or three functions — probably explanation and feedback — without an independent body responsible for them.

Method. Doctrinal and comparative institutional analysis: map the Act's bodies and documented powers against the seven functions, identify gaps, and test the mapping against existing critiques. A non-EU comparator would strengthen it.

Evidence needed. AI Act implementing documents and early enforcement material. The timing matters: Regulation (EU) 2026/1744 moved the application of the Act's high-risk requirements to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems [24], so any assessment made now is provisional.

What would weaken it. A mapping showing the existing bodies already cover all seven functions. The mapping method would survive; the gap claim would not.

3.4 Crash-testing a rule before it takes effect

Question. Would a structured, adversarial pre-deployment test — running a rule against synthetic cases built to violate its implicit assumptions — have caught the failure modes behind well-documented administrative disasters before real people were harmed?

Closest work. Peeters and Widlak on administrative exclusion in the Dutch childcare-benefit case [25]; Alfrink and co-authors on contestable AI by design [26]. Our audit found the diagnosis well documented and this specific testing mechanism unaddressed.

Hypothesis. A protocol that generates cases designed to break a rule's assumptions, runs the rule against them before deployment, and requires documented remediation would have surfaced the failure modes in two cases — Australia's Robodebt scheme, examined by a Royal Commission that reported in July 2023 [27], and the Dutch case — using only information available at the time.

Method. Design science: specify the protocol formally, then apply it retrospectively to each case using only period-appropriate information.

Evidence needed. The Royal Commission record and the public record of the Dutch case. Neither has been analysed for this purpose yet.

What would weaken it. The protocol, honestly restricted to what was knowable before deployment, fails to surface either failure. That is a reportable negative result about the method's power. The obvious objection is hindsight bias, and the restriction to period-appropriate information has to be a rule of the method, not an aside.

3.5 Differentiated vision, uniform rights

Question. Do real federal systems already hold data at different granularity at different levels of government while keeping legal rights uniform, and is that associated with faster detection of local problems?

Closest work. Qian and Weingast on federalism as commitment [28]; Ishkhanyan on digital federalism in AI governance [29]. Qian and Weingast treat the decentralisation of information and authority as features of federalism that make commitments credible. Ishkhanyan's "digital federalism" is a multi-level model running from local to global, not a study of domestic federal systems. On our reading of the abstracts, neither examines how fine-grained the data held at each level of government is while rights stay uniform.

Hypothesis. In at least one federation, municipal and regional levels collect and act on finer-grained data than national aggregates capture, and jurisdictions that formalise the difference detect local problems faster.

Method. Comparative document and administrative-data analysis across at least two federal systems; Germany and Switzerland are the candidates.

Evidence needed. Reporting-requirement documents by level of government; local service-outcome data. Neither has been collected.

What would weaken it. Data-granularity practices that turn out to be uniform across levels. Causal identification is weak in any case: this would be a first descriptive study, and should say so.

3.6 An off-switch test for AI dependency

Question. Applied consistently to different kinds of AI and compute partnership, does a formal test — can either party walk away without the other being able to disable its core capability? — produce stable, defensible classifications of alliance versus dependency? Does it need a second component for "soft" influence that falls short of formal control?

Closest work. Weymouth on techno-blocs and strategic sovereignty [30]; Lehdonvirta, Wú and Hawkins on Compute North and Compute South [31]; Beaumier and Cartwright on weaponisation in the semiconductor supply chain [32]; Obendiek and Seidl on ideational business power in digital security governance [33]. Pohle and Thiel's analysis of digital sovereignty [34] is the standing challenge to treating sovereignty as something that can be tested at all.

Hypothesis. A two-part test — formal and contractual dependency, plus an assessment of softer commercial and ideational influence — classifies cases differently, and more defensibly, than either part alone.

Method. Comparative case study using existing dependency-mapping methods, applied to a set of cases spanning an intelligence-sharing alliance, a cloud-infrastructure consortium, a multilateral AI partnership and a bilateral commercial compute partnership. The two parts are reported separately, not collapsed into a score.

Evidence needed. Public contract, investment and governance data. This is the question closest to being executable from existing public material.

What would weaken it. Formal and soft measures that disagree unpredictably across cases, which would undercut the claim that combining them adds anything.

3.7 A state that learns from its own failures

Question. Can blameless, structured incident investigation, as practised in aviation safety and site-reliability engineering, be combined with public-administration work on organisational learning and with what is known about gaming of performance measures, to give government an institutional memory of policy failure that officials report to honestly?

Closest work. Moynihan on goal-based learning and performance management [35]; Hood and Piotrowska on Goodhart's law and the gaming of UK public spending numbers [36]. The aviation and site-reliability literatures have not yet been reviewed for this agenda.

Hypothesis. An error-memory that is blameless, scoped to decisions rather than individuals, and disconnected from individual performance evaluation will produce more complete incident documentation than one missing any of the three features.

Method. Comparative institutional case study, then a design-science specification; a pilot or natural experiment only if a site can be found.

Evidence needed. Institutional documentation from incident-investigation bodies and from government inquiry mechanisms. No pilot site exists.

What would weaken it. Evidence that existing government inquiry mechanisms already achieve comparable completeness. A known disanalogy must be named: aviation has a far narrower definition of an incident than government has of a policy failure.

3.8 Does convergence matter?

Question. Do three features of AI-mediated government — proactive service with no real way to refuse, individual-level predictive scoring, and consolidation on a single vendor or model — produce a loss of perceived citizen control larger than the sum of their separate effects?

Closest work. Wuttke, Rauchfleisch and Jungherr's preprint on why people feel they lose control when government uses AI [37]; Alibašić's risk framework for agentic AI in the administrative state [11].

Hypothesis. There is an interaction effect: the three together reduce perceived control disproportionately.

Method. A factorial vignette experiment manipulating each feature independently and measuring perceived control, trust and willingness to contest, building on an existing instrument where its authors permit.

Evidence needed. Original survey data, with a sample sized for the interaction term rather than only the main effects.

What would weaken it. Purely additive effects. That would mean "convergence" is a label and not a mechanism — a result that would count against a framing the author has used elsewhere, and would be reported.

4. Order of work

The eight questions are largely independent, so the order follows readiness and risk rather than logic.

• First: 3.6 and 3.4, because both can be done from existing public records.
• Second: 3.1 and 3.2, the two with the largest potential contribution, each needing something built first — a prototype for 3.1, a corpus of disclosed prompts for 3.2.
• Third: 3.3, 3.5, 3.7 and 3.8, which need accumulated enforcement material, data access, a pilot site or permission to extend another team's instrument.

Before any drafting, four literature searches remain to be done: independent fiscal institutions; automation complacency and cognitive offloading; right-to-be-forgotten doctrine; and scholarship on social-credit systems. Twelve further directions were identified and deliberately held back, among them whether sustained reliance on an administrative AI agent erodes people's own administrative competence — judged the strongest candidate for promotion once the human-factors literature has been searched.

5. What the agenda does not propose

No large cross-national survey, no multi-year panel and no production-scale deployment. Each would be out of proportion to the claim being tested. The prototype in 3.1 is a research artefact, not a product.

6. Results

There are none. No study in this agenda has been run. The only empirical-adjacent output of the programme so far is a working paper, The Agentic State: Capability and Counter-Power as One Architecture, which sorts current government systems by evidence status. It is a field paper, not a study.

7. Conclusions and practical implications

Three things can be said at this stage, and they are modest.

First, anyone writing about agentic government should cite the work that already holds the broad positions — a third wave of digital-era governance, proactive delivery around life events, data-driven statecraft and agentic inequality, AI-supported deliberation — rather than restate them as discoveries. This agenda's own starting manuscript needed that correction.

Second, the questions that appear open are institutional rather than technical: who funds and governs the citizen's side, whether the operative instruction is treated as a rule, whether the state's own AI functions are separated, whether anything is tested before it is applied to people. Two of them already have public artefacts that make them concrete [18][19].

Third, every question here is stated with the result that would count against it. For a practitioner, that list of falsifiers is the usable part: it says what evidence a government should ask for before accepting any of these ideas, including from us.

8. Limitations and open questions

• This is a plan. It contains hypotheses, not findings.
• Search limits. The literature search had no access to Scopus, Web of Science or JSTOR and ran through open indexes, publisher pages and preprint servers on a single date. "Not found" is not "does not exist".
• AI-assisted audit, single author. The audit was carried out with AI assistance on one author's manuscript. For this page, the bibliographic record of every cited work was re-opened on 4 October 2026. On 5 October the descriptions of what the works argue were compared with the works themselves: with the full text where an open copy exists, and otherwise with the abstract. Several descriptions were corrected as a result (sources 2, 3, 4, 5, 23 and 28 are affected), including the statement of how close existing work comes to the citizen agent in 3.1. Where only an abstract was available the description stays at that level, and each work will need a full-text read before any article is written.
• Skills the programme does not have. Three of the eight questions need formal experimental design, pre-registration and ethics approval. The programme has no collaborator with that training, no ethics-review route and no academic partner. Two questions would benefit from a co-author with formal legal training.
• No external review. No independent researcher has read this agenda.
• Feasibility is uneven. A disclosed-prompt corpus, a pilot site and cross-level administrative data may each prove unobtainable; the corresponding questions would then shrink to their conceptual halves.
• Novelty will date. Several adjacent works are preprints from 2025–2026.
• An open question about the agenda itself: the eight questions share a concern but not a theory. Whether a common framework can be built under them, or whether they are better left as separate projects, is unresolved.

Sources

Bibliographic records and URLs were opened on 4 October 2026. Quotations and descriptions were checked again on 5 October 2026.

1. OECD Working Group on Agentic AI in Government (2026, 25 September). Governing with agentic AI: when machines act on government's behalf. OECD.AI. https://oecd.ai/en/wonk/governing-with-agentic-ai-when-machines-act-on-governments-behalf
2. Dunleavy, P., & Margetts, H. (2023). Data science, artificial intelligence and the third wave of digital era governance. Public Policy and Administration. https://doi.org/10.1177/09520767231198737
3. Scholta, H., Mertens, W., Kowalkiewicz, M., & Becker, J. (2019). From one-stop shop to no-stop shop: An e-government stage model. Government Information Quarterly, 36(1). https://doi.org/10.1016/j.giq.2018.11.010
4. Fourcade, M., & Gordon, J. (2020). Learning Like a State: Statecraft in the Digital Age. Journal of Law and Political Economy, 1(1). https://doi.org/10.5070/lp61150258
5. Sharp, M., Bilgin, O., Gabriel, I., & Hammond, L. (2025). Agentic Inequality. arXiv:2510.16853 (preprint). https://arxiv.org/abs/2510.16853
6. Tessler, M. H., Bakker, M. A., Jarrett, D., Sheahan, H., et al. (2024). AI can help humans find common ground in democratic deliberation. Science. https://doi.org/10.1126/science.adq2852
7. Ilves, L., Kilian, M., Parazzoli, S. M., Peixoto, T. C., Velsberg, O., et al. (2025). The Agentic State: Rethinking Government for the Era of Agentic AI (vision paper). https://agenticstate.org/paper.html
8. Schmitz, C., Rystrøm, J., & Batzner, J. (2025). Oversight Structures for Agentic AI in Public-Sector Organizations. REALM workshop, ACL Anthology. https://aclanthology.org/2025.realm-1.21/
9. Salah, M., Abdelfattah, F., Al Araimi, A., & Noor, A. A. S. (2026). Before agentic AI scales in government: the democratic authorization gap. Frontiers in Political Science. https://doi.org/10.3389/fpos.2026.1956489
10. Salah, M., & Alnoor, A. M. (2026). Agentic AI, Street-Level Bureaucracy, and the Recomposition of Discretion in Public Administration. International Journal of Public Administration. https://doi.org/10.1080/01900692.2025.2605225
11. Alibašić, H. (2026). Governing Agentic AI in the Administrative State: Human Oversight, Cybersecurity Accountability, and Risk in Autonomous Digital Systems. Future Internet. https://doi.org/10.3390/fi18100528
12. Rystrøm, J., Schmitz, C., Davies, N., Hammerschmid, G., Meijer, A., & Russell, C. (2026). A Technical Typology of AI Systems in Public Administration. arXiv:2606.31755 (preprint). https://arxiv.org/abs/2606.31755
13. Herd, P., & Moynihan, D. P. (2018). Administrative Burden: Policymaking by Other Means. Russell Sage Foundation. https://doi.org/10.7758/9781610448789
14. Busuioc, M. (2021). Accountable Artificial Intelligence: Holding Algorithms to Account. Public Administration Review, 81(5). https://doi.org/10.1111/puar.13293
15. Kaminski, M. E., & Malgieri, G. (2020). Algorithmic impact assessments under the GDPR: producing multi-layered explanations. International Data Privacy Law. https://doi.org/10.1093/idpl/ipaa020
16. Grimmelikhuijsen, S. (2022). Explaining Why the Computer Says No: Algorithmic Transparency Affects the Perceived Trustworthiness of Automated Decision-Making. Public Administration Review. https://doi.org/10.1111/puar.13483
17. Cath, C., & Jansen, F. (2022). Dutch Comfort: The Limits of AI Governance through Municipal Registers. Techné: Research in Philosophy and Technology. https://doi.org/10.5840/techne202323172
18. Executive Order 14319, "Preventing Woke AI in the Federal Government", 23 July 2025, 90 FR 35389, section 4(a)(ii). https://www.whitehouse.gov/presidential-actions/2025/07/preventing-woke-ai-in-the-federal-government/
19. Digital Transformation Agency (Australia). Agentic AI addendum to the AI technical standard for Australian Government, last updated 4 June 2026, statements for the Train stage, criterion AGT.5.3 (read in a browser, 5 October 2026). https://www.digital.gov.au/policy/ai/agentic-ai-addendum-statements-train
20. Korinek, A., & Vipra, J. (2024). Concentrating Intelligence: Scaling and Market Structure in Artificial Intelligence. NBER Working Paper 33139. https://doi.org/10.3386/w33139
21. Novelli, C., Hacker, P., Morley, J., Trondal, J., & Floridi, L. (2024). A Robust Governance for the AI Act: AI Office, AI Board, Scientific Panel, and National Authorities. European Journal of Risk Regulation. https://doi.org/10.1017/err.2024.57
22. Simoncini, M. (2025). The separation of powers and the administrative branch in the European Union. International Journal of Constitutional Law. https://doi.org/10.1093/icon/moaf048
23. Birkstedt, T., Minkkinen, M., Tandon, A., & Mäntymäki, M. (2023). AI governance: themes, knowledge gaps and future agendas. Internet Research, 33(7). https://doi.org/10.1108/intr-01-2022-0042
24. Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 (Digital Omnibus on AI), OJ L, 2026/1744, 24.7.2026. https://data.europa.eu/eli/reg/2026/1744/oj
25. Peeters, R., & Widlak, A. C. (2023). Administrative exclusion in the infrastructure-level bureaucracy: The case of the Dutch daycare benefit scandal. Public Administration Review, 83(4). https://doi.org/10.1111/puar.13615
26. Alfrink, K., Keller, I., Kortuem, G., & Doorn, N. (2022). Contestable AI by Design: Towards a Framework. Minds and Machines. https://doi.org/10.1007/s11023-022-09611-z
27. Royal Commission into the Robodebt Scheme. Report, presented and tabled 7 July 2023. https://robodebt.royalcommission.gov.au/publications/report (the site does not answer automated requests; opened in a browser, 5 October 2026)
28. Qian, Y., & Weingast, B. R. (1997). Federalism as a Commitment to Preserving Market Incentives. Journal of Economic Perspectives, 11(4). https://doi.org/10.1257/jep.11.4.83
29. Ishkhanyan, A. M. (2025). The sovereignty-internationalism paradox in AI governance: digital federalism and global algorithmic control. Discover Artificial Intelligence, 5. https://doi.org/10.1007/s44163-025-00374-x
30. Weymouth, S. J. (2025). Digital Disintegration: Techno-Blocs and Strategic Sovereignty in the AI Era. International Organization. https://doi.org/10.1017/S0020818325101070
31. Lehdonvirta, V., Wú, B., & Hawkins, Z. A. (2024). Compute North vs. Compute South: The Uneven Possibilities of Compute-based AI Governance Around the Globe. Proceedings of the AAAI/ACM Conference on AI, Ethics, and Society, 7(1). https://doi.org/10.1609/aies.v7i1.31683
32. Beaumier, G., & Cartwright, M. (2024). Cross-Network Weaponization in the Semiconductor Supply Chain. International Studies Quarterly, 68(1). https://doi.org/10.1093/isq/sqae003
33. Obendiek, A. S., & Seidl, T. (2023). The (False) promise of solutionism: ideational business power and the construction of epistemic authority in digital security governance. Journal of European Public Policy, 30(7). https://doi.org/10.1080/13501763.2023.2172060
34. Pohle, J., & Thiel, T. (2020). Digital sovereignty. Internet Policy Review, 9(4). https://doi.org/10.14763/2020.4.1532
35. Moynihan, D. P. (2005). Goal-Based Learning and the Future of Performance Management. Public Administration Review, 65(2). https://doi.org/10.1111/j.1540-6210.2005.00445.x
36. Hood, C., & Piotrowska, B. M. (2020). Goodhart's Law and the Gaming of UK Public Spending Numbers. Public Performance & Management Review, 44(2). https://doi.org/10.1080/15309576.2020.1749092
37. Wuttke, A., Rauchfleisch, A., & Jungherr, A. (2025). Artificial Intelligence in Government: Why People Feel They Lose Control. arXiv:2505.01085 (preprint). https://arxiv.org/abs/2505.01085