We need “semantic” alignment on AI government agents

We live in a time of wonders. And wonders carry confusion with them, not least in how they are named. As that famous visitor in another Wonderland once mused:

“When I use a word,” Humpty Dumpty said, in rather a scornful tone, “it means just what I choose it to mean—neither more nor less.”

*> “The question is,” said Alice, “whether you can make words mean so many different things.”

*> “The question is,” said Humpty Dumpty, “which is to be master—that’s all.”

In the age of AI, we need agreement on what words mean. As Jonathan Rystrom and his co-authors recently wrote, “‘AI’ is everywhere in government – and can refer to almost everything.” With this pervasiveness comes confusion: among 91 highly cited papers reviewed by these researchers, most of them do not specify the system they study, and often make general conclusions about AI that the studied system does not support.

This confusion around names, definitions and concepts is running parallel to a fast deployment of AI in government, by governments and onto governments.

So, what do we mean when we talk about AI agents1 in government services? In particular, what do we mean when we talk about citizen agents, those agents that act as intermediary between citizens and governments?

The rising tide of government AI agents is creating confusion

The Agentic State is quickly turning from an hypothesis to reality. Ukraine’s Diia.AI is executing government services through a chat interface. Abu Dhabi’s TAMM is building conversational access to cross-agency workflows, and Estonia is deploying Burokrat, an AI-based digital assistant, built on decades of interoperable infrastructure. Outside the government, people are already pasting government links into ChatGPT, asking it to untangle administrative processes or even execute them directly.

All these examples could be classified as “citizen agents.” However, this term has become a nebulous container for systems that differ wildly in architecture, in who controls them, in what authority they carry, and in what they imply about the relationship between citizen and state.

Clearly, we need some alignment (to use another “suitcase word”) on what we mean when we talk about AI citizen agents.

This post contributes to that effort by identifying three dimensions along which citizen agents differ:

1. Ownership: Is the agent deployed by the government or onto it? This determines who controls the stack, who bears the cost, and who is accountable.

2. Autonomy: Who starts, and how far does the agent go before checking back with a human? Initiative and discretion determine the legal limits of how far the agent can go.

3. Specialization: Does the agent hold deep expertise in a single domain, or orchestrate across many? This is a question about where domain knowledge lives and who owns it within each public organization running agents.

These three dimensions, and the spectrums that they suggest, will help practitioners see more clearly what they are actually building, buying, or debating. We hope they will help to navigate the design space more consciously and ambitiously, and avoid taking choices under the pressure of wobbly buzzwords.

Ownership

The first dimension relates to the question: is the agent deployed by the government, or onto it?

In one scenario, the government procures the agent, hosts it, controls the data flows, and bears the accountability. Yet increasingly, as Tom Loosemore flagged, citizens are “sending software, not themselves, to interact with governments.” This use of AI to interact with governments is widespread enough for The Economist to talk about how “agentic flooding,” a term coined by Chris Schmitz and colleagues, is breaking the State.

Each of these scenarios come with their challenges.

Agents deployed-by governments demand clear articulation of the stack architecture, permissions and governance to buy insurance against vendor lock-in. This dependency can be on model providers, but also on the agent-orchestrators increasingly capturing the more valuable context layer. Key questions on this category of government AI agents relate to how to create clear authentication frameworks, service level agreements (SLA), and decision rules to ensure accountability.

For agents deployed-onto government, the questions are different. Here the issue is whether governments will enable this deliberately — through structured APIs, machine-readable service descriptions, standardised protocols like MCP — or resist it with CAPTCHAs and rate limits, while it happens anyway. None of these approaches is sustainable longer term, however. How permeable that boundary currently is can now be measured. RADAR, a World Bank-led benchmark covering 166 countries, finds that AI systems describe public services far better than agents can reach them: in every single country, informational legibility exceeds agent operability, and the gap does not shrink with national wealth.

Governments need to set up effective gatekeeping, but here, the tools available to them are different from those in the deployed-by governments scenario. There is nothing to procure, so nothing to specify; no SLA, so no remedy; no pre-deployment testing, because the agent arrives already acting. The government cannot choose the model, cannot see the prompt, cannot audit the reasoning, and cannot tell whether the citizen actually intended what the agent submitted in their name. The middle ground might be forming, though: citizens using their own tools but authenticating through government identity, and governments allowing only certified external agents through controlled gateways.

In the agents deployed-onto government model, cost inverts too. The government bears the serving load of traffic it never provisioned and cannot meter, which makes rate limiting a de facto entitlement policy set by infrastructure teams rather than regulation. And volume becomes the binding constraint: agents file applications, appeals and information requests at machine speed, so administrative capacity is rationed by whoever has the most effective agent.

Where governments set the permeability of the boundary in the agents deployed-onto government scenario will shape the market, the equity, and the political economy of digital services, including who pays. In the deployed-by government case, the cost sits in public budgets and governments should design and invest in the capabilities for control and performance.

Autonomy

The second dimension concerns autonomy: how far the agent runs without being told. That breaks into two questions that are easy to confuse: who starts (initiative), and how far the agent goes before it checks back with a human (discretion).

Most of what exists today is reactive: the citizen asks, the agent delivers. Increasingly, though, governments are becoming proactive. Why? Because citizens often do not claim what they are owed. Non-take-up of benefits by eligible households is a common failure in social protection.

Proactivity is not new, we have been discussing it for at least over two decades. It has long been hardcoded into administrative systems as rule-based triggers. Portugal’s Abono de Família Automático is triggered by the birth registration at the maternity hospital, cross-checks eligibility across institutions, and then sends the family an SMS with a proposed amount that they accept. Estonia’s proactive family benefits, live since 2019, do the same: the state assembles the offer, the parent logs in and confirms. In all these cases, the State moves first, but the citizen still has to press the button.

The next step is when the agent exercises its own discretion to make a judgment on behalf of the citizen. This requires combining initiative with discretion, and opens a whole new set of questions2: What can the agent commit the citizen to? What is reversible? Who is liable when a proactive agent files something wrong? Does the answer change if the citizen never saw it?

Specialization

The last dimension runs from the hyper-specialised domain expert to the general-purpose orchestrator, which is a question about where domain knowledge sits and who owns it.

At one end, the vertical expert: deep expertise in a single domain (health, permits, tax, social benefits…) executing end-to-end. The citizen states what they need, the agent identifies the procedure, checks eligibility, populates forms, requests what is missing, and delivers the result. The agency that owns the service runs the agent.

At the other end, the orchestrator: the general-purpose layer that receives wide-ranging citizen intent and routes it onward. Citizens don’t think in terms of which agency provides what. They think: I just had a baby — what do I need to do? The orchestrator translates from citizen logic to institutional logic.

Two live systems do this. Ukraine’s Diia.AI orders services, generating income statements and pulling pension, insurance, property and tax records inside a single conversation. Abu Dhabi’s TAMM runs comparable workflows across 940-plus services, spanning retrieval, personal-record queries, service execution and support routing.

An important design choice is whether domain knowledge lives inside autonomous specialised agents, or in a machine-readable description of the service that any competent general model can read and act on. The latter is the approach followed by agents in Ukraine and Abu Dhabi.

This design choice is non-trivial, as asking three hundred agencies each to build, host, evaluate and keep an agent alive is costly and with high chances of failure. Asking agencies to publish a well-formed description of the services they already run is a standard problem. Still hard, but a kind of hard that governments have solved before.

Specialization thus refers to which layer holds the domain knowledge, who is accountable when that knowledge is wrong, and whether the general layer is permitted to act on it.

How these dimensions matter

Each dimension encodes different policy choices. Ownership raises questions about accountability and the role of private AI providers that no existing framework adequately governs. Autonomy forces governments to confront how much initiative and discretion to delegate to machines. Specialization determines procurement strategy and organizational design.

Most governments today are building government-operated agents that are mainly reactive, with varying degrees of specialization. These can be reasonable starting points. But choices being made now about data architecture, API exposure, and identity infrastructure will determine which positions on these spectrums become possible later.

Architecture is path-dependent. A government that builds only for the specialised, reactive, government-operated corner may find it expensive to move along any dimension down the line. And there might be possibilities that governments are simply not considering because the headroom is limited, such as betting big on third-party operated agents, and investing on curating strong hooks for these agents to connect with public systems.

The language we use shapes the decisions we make. If AI “citizen agent” remains a single undifferentiated concept, governments will keep making undifferentiated — or worse, unquestioned — choices. The sooner practitioners see these three dimensions, the more deliberate their commitments will be.

[This post was originally published in the Datapolis substack and co-authored with Simone Maria Parazzoli]

**

[1] By “agent” we mean a system that combines language models with tool use, memory, and retrieval to execute actions — not merely to inform or advise. The defining feature is that the system acts: it submits applications, retrieves documents, triggers processes, and coordinates across tasks.

[2] Initiative without discretion is not “dilemma-free”: a loop running on the state's side is continuous assessment of the citizen. Consent, data minimization and the right to be left alone will determine the degree of State initiative citizens are willing to tolerate.