This is Part 4 of “What Lies Beneath”, a five-part public service “thriller” series following Scott* while exploring the concept of administrative truth: what it is, how it works, where it breaks down, and what better-designed systems could look like for people and public service folk. Read the intro and Parts 1, 2 and 3 if you are new to this series :-).
So far this series has mapped the concept of administrative truth, and the consequences of disconnected administrative operative beliefs across jurisdictions (part 1). Part 2 surfaced how something as fundamental as unemployment or disability is defined differently across and inside separate Canadian jurisdictions — producing different laws, policies, programs and services for the same human situation. This leads to filling out a lot of forms, and results in a lot of waiting. Part 3 concluded that administrative truth in Canada has a low level of legibility, contestability, and accountability for both citizens and the public servants trying to serve them. Rushing toward digitization, AI and automation without addressing this issue risks scaling failure and concentrating state power in ways that could erode the citizen trust democratic futures depend on further.
So how do we design for something different? A future that is more connected, more contestable, more legible and accountable — one that better balances state power with citizen agency? That’s what I’ll be exploring in Part 4.
But first, let’s revisit our dear Scotty. How is he doing?
For Scott, money suddenly got pretty tight after paying a few unexpected bills. When on the phone with the service worker to figure out how to submit the divorce paperwork, they mentioned a new-to-him service: hardship assistance. This service could help him bridge a temporary gap while he waits for his (federal) employment employment insurance (EI) and his provincial income assistance to kick in. Scott goes back to his computer and reluctantly opens it. He can’t possibly remember all these different passwords: one for the federal system, one for the provincial system, one for filing his divorce papers in the e-divorce portal. After some help from Chat-GPT he finds the forms for hardship assistance. They are actually in the same app as his provincial income assistance application, just under a hard to find drop down menu. He fills out his details (again), and sends it off. Lots of forms, but still no money for Scott …
*Scott is a fictional character in a speculative fiction story to illustrate the concept of administrative truth. His story returns at the beginning and end of every blog of this series and serves as a vignette to tell a bigger story. It is set in a not so distant, imperfect future, where (mostly invisible) computers – not humans – handle public service delivery.
***
A New Shared Service Journey
Current administrative policies, laws, programs and services all reason from their own logic without an incentive to look over each other’s fence. This has resulted in a pretty unwieldy situation for both Scott and government. What could a better-designed service ecosystem do differently? Here I propose to design and govern for a few new, yet different things:
- what Scott is shown within the jurisdiction that has just established a new administrative truth (“Scott is unemployed”) about him, and
- what he can carry with him in verifiable ways when he needs to work with other jurisdiction’s processes to get access to services
- what different jurisdictions can share (ie. data, but also: each other’s determinations, eligibility criteria) across a shared service journey within a life-event to reduce eligibility checks, cost and time
To do so, we first need to think about a new type of service journey for both the citizen and other folks involved in delivering the service. This journey explicitly reasons from establishing a shared and transparent administrative truth for and about someone – in six stages.
Stage 1: Life Event
Something happens in a person’s life: a job loss, a divorce, a new baby or starting a new business. These are ground truths or life events and they happen in people’s lives, regardless of which institutions, services, laws, policies are in place.
Stage 2: Signal
The life event can enter a government system in a few different ways: a citizen reports it, an institution detects it passively (ie. a person turns a certain age), a human validator (see stage 3) puts it in a system about you, or an automated system could infer it from data it has access to (mostly a distant, future scenario for most jurisdictions). In all scenarios, the system needs to be able to detect the signal and know what to action next.
The governance question at this stage is: who or what can generate a signal, and what weight do different signals carry? Is a citizen-initiated signal less reliable by default than an institution-detected one? This requires agreement about who do we trust across institutional boundaries.
Stage 3: Validation of event to establish system-level administrative truth
An independent credentialed party such as a (human) employer, a physician or nurse, an engineer or a registered assessor confirms the underlying fact: yes, this person had a baby; yes, this person lost their job; yes, this person has a life-long health condition. Event validation is separate from service eligibility assessment. The validator is not deciding whether Scott qualifies for anything. They are just confirming that something happened, to a defined standard, so that the eligibility assessment can proceed from a pretty stable foundation. We could call this a ‘system level’ administrative truth: everyone can safely assume something happened for real.
The governance question at this stage is: how to coordinate across different Ministries, jurisdictions and organisations and decide on who can validate a fact, and what standard of validation is required? For example: can only a physician establish the birth of a baby, or a disability, or also an occupational health therapist and a nurse practitioner?
Stage 4: Service eligibility assessment
The state or province or city applies its own rules. This is – and remains – exclusively the jurisdiction’s domain to ensure sovereignty. Under what legislation, by what criteria, does Scott qualify for this program, and this service, based on this system-level administrative truth? Each jurisdiction adjudicates under its own authority. The assessment runs against a validated signal (so not a raw, unvalidated, personal claim).
The governance question at this stage is: how do jurisdictions maintain their own legislative sovereignty while accepting validated signals from other institutions as inputs to their assessment? Can a provincial program accept a federally-validated employment signal without re-adjudicating the underlying fact? This is where mutual recognition agreements between jurisdictions do their most important work.
Stage 5: Establish a service-level administrative truth
The state establishes a service-level determination, records it formally in an authoritative data registrar and makes a person eligible to receive a service. Scott was employed and now he’s not as of this date. He qualifies for EI under x, y, z criteria, on this legislative basis. That is now an administrative fact that could govern other service operations, triggering multiple service outcomes, depending on how a jurisdiction established its service cascades (ie.: if you’re eligible for A, you are also eligible for service B, C and D without having to apply). And this all needs to be legible to Scott, not just to the institution.
The governance question at this stage is: what makes an established administrative truth legible — to Scott, not just to the institution? What must the record contain, in what form, expressed in what language, so that Scott can understand what was decided about him, why, and what it means for what comes next? This is where the receipt concept lives.
Stage 6: Service outcomes and cross-jurisdictional portability
The determination flows into a service outcome. Scott is now formally unemployed under EI criteria, as of a specific date, under specific legislative authority. He receives his benefit. But an established administrative truth should do more than trigger one outcome in one jurisdiction. It should be able to travel.
Portability works in two ways. The first is citizen-carried. Scott holds a portable, verifiable record of what was established about him — a receipt, in plain language, cryptographically signed, that he can present to other programs and institutions without requiring them to contact the originating system. He controls when he presents it and to whom.
The second is consent-governed cross-jurisdictional sharing. With Scott’s explicit consent, the established administrative truth can be shared directly between systems — from Service Canada (federal) to BC’s income assistance program, for example — so that the receiving jurisdiction can use it as an input to its own eligibility assessment without asking Scott to re-establish the underlying facts.
In both cases, what travels is the verified fact — that Scott was employed and is now not, confirmed by this authority, on this date, under this legislative basis — not the eligibility conclusion. Each jurisdiction still applies its own rules. What portability removes is the requirement to re-prove the underlying reality from scratch every time.
The governance question at this stage is: what standards govern a portable administrative truth? Who can issue one, in what form, with what provenance? How long does it remain valid? How is it revoked or updated when Scott’s situation changes again? How does consent work — what exactly is Scott agreeing to, with what granularity, and how can he withdraw it? And critically: when an established administrative truth from one jurisdiction is used by another, who is accountable if it was wrong?
How This Is Different From a Traditional Service Journey
Most fundamentally: a traditional service journey assumes the person’s situation is something the service itself discovers and responds to. This new design assumes the system could already know and already believes certain things to be true about someone. It asks who holds that knowledge, whether it is accurate, and whether Scott can see it, contest it, and carry it.
This difference is reflected in the traditional service design journey maps which maps the citizen’s experience of interacting with an existing (or new), single public service front door: it shows the touchpoints, the pain points, the moments of friction and delight, and it asks things like: what does this person need, what happens when they found what we (gov) offer, and how do we make that experience better, faster?
This new, more shared service journey is about what is already in the building before the person gets there: the records, the data, the administrative truths that will govern what happens to them the moment they knock. It starts with the event that happened in a person’s life, before any institution knows about it. And it asks not just what the system knows about the person before they arrive, but whether what it knows is still accurate.
Second, the traditional service journey is linear and institution-specific. It maps one person’s path through one service. This new pipeline is cross-institutional and generative: a single validated event in Stage 3 can trigger multiple eligibility assessments in Stage 4, establish multiple administrative truths in Stage 5, and unlock multiple service outcomes in Stage 6. It works across different programs, different ministries, different jurisdictions simultaneously and with consent.
A third difference is the traditional service journey ends at service delivery. This new journey is more like a cascading service pipeline. The administrative truth established in Stage 5 becomes an input to future service pipelines. It travels with Scott and it can be presented, verified, and acted on in contexts and jurisdictions that had nothing to do with the original determination. The pipeline becomes a connected, administrative infrastructure, and could offer opportunities for simplification, simply by recognising each others determinations, effectively reducing the need for re-establishing a truth that is already verified elsewhere. In this way we can reduce complexity, and free up much-needed capacity from already overburdened public service workers.
The Administrative Truth Receipt
What could this new reality actually look like? Let’s design something speculatively, just to play.
When Service Canada completes its assessment and establishes that Scott is eligible for EI, it produces a system-level determination (“Scott is unemployed”) AND a service determination: EI-benefits. In the current system, that service-level determination generates a notification to Scott, and a payment to his bank, but the system-level determination doesn’t do much. It isn’t usable elsewhere by Scott or other government institutions.
A better-designed system would splits the two out and produces a receipt alongside the determination and service decision. This is a structured, signed record of what was decided, on what date, under what legislative authority, based on what authoritative data sources, by what process — and why.
The receipt makes the administrative truth legible to the person it governs (Scott, 1998). It answers the questions Scott currently cannot get answered: what does the system believe about me, as of this moment, for the purposes of this event in my life? The receipt then is a structured attestation of a specific administrative truth, with its origin made visible. A track path or paper trail that shows: where did the information come from, how was the decision made, and by whom (which institution?). This brings accountability, which kind of disappeared into an invisible digital infrastructure, back into the human realm, given institutions (for now) are still governed by human bureaucrats.
Manish Srivastava, who writes about decision accountability in digital government, describes the core elements of what such a receipt could look like:
- the rule version that was applied
- the data sources that were checked
- the verification steps that were performed
- the reasons for the outcome
- the identity of the authority that made the determination
- provide with a signature, so the issuing institution cannot later deny having made the decision (Srivastava, 2026).
Scott can hold this receipt in his hand, or on his phone in a government app, and it’s written in plain language. If it’s also written down in machine-readable format, then this is what another institution can verify via automation.
The idea of a receipt is not a new technical invention. The cryptographic foundations for signed, verifiable records already exist in digital identity infrastructure being built across Canada and other jurisdictions. But the governance layer — which services and decisions qualify for a receipt, what the receipt must contain, how it is verified, how long it remains valid and who mutually acknowledges is — is something that would require cross-boundary discussion and legal and policy coordination. Who mutually recognizes each other truths? And how could they be connected digitally?
What the Receipt Could Do Across Boundaries
The second thing the administrative truth receipt enables is portability.
When Scott applies for provincial income assistance, the provincial system will ask him to establish his employment situation. He has already established it, formally, with Service Canada. With a receipt, Scott can present a verifiable attestation of what Service Canada has determined about him. The provincial system reads the receipt, verifies its origin, and accepts the underlying facts as established. This foregoes having to contact Service Canada and replicate the EI assessment.
The province then still applies its own eligibility rules, as the provincial income assistance service may have different criteria than federal EI. The receipt transfers the verified facts that underpin it and communicates the outcome at the federal level. Scott was employed, now he is laid off. His income was at this level. The province still assesses those facts against its own rules and makes its own decision.
Portability operates through two distinct models depending on the situation. In the first model, Scott holds his receipt and presents it when he needs to: at a program office, a recreation centre, a community service, a retraining intake. He controls when and where he presents it. In the second model, Scott authorizes his established administrative truth to be shared directly between systems (from the federal eligibility engine to the provincial income assistance system – that is if they can talk to each other) with his consent as the trigger and the permission. The models serve different transaction types and carry different governance requirements. Both options should be available to Scott to generate citizen agency.
Correcting the Administrative Untruth
The receipt addresses what travels forward from a new administrative truth. But Scott’s situation also involves an existing administrative truth that is wrong (remember!): his marital status in provincial systems still reflects a marriage that ended a year ago.
An improvement is that he now knows what was wrong pretty quickly through the receipt. A better-designed system would have a designed pathway for Scott to correct this. This would avoid an appeal after a wrong decision and could save him time. The correction pathway would allow him to submit that documentation once, to a designated point of contact, and have the correction propagated to the systems that hold the stale record, with his consent.
This consent dimension is absoluteley critical. Scott’s consent governs which systems receive the correction and for what purpose. He is authorising a specific correction to a specific record, for a specific purpose under his control.
The correction pathway also creates an institutional obligation. Once Scott flags the administrative untruth, the institution is responsible for reviewing it, accepting or rejecting the correction with reasons, and propagating an accepted correction to connected systems within a defined timeframe. Currently, no such legal obligation exists in a coherent form in jurisdictions across Canada.
Designing and Governing for Administrative Truth
Virginia Eubanks found that the automated systems she studied were often built by well-intentioned designers who did not examine the administrative record underpinning their systems carefully enough (Eubanks, 2018). A process of discovery for administrative truth is how designers could avoid that outcome. Before building a new service or intake process, examine what the system already believes about the people it will serve. Where are the records stale? Where are they inaccurate? Where do they reflect a life that no longer exists? Where could they connect? Who needs to align and coordinate? Those are the design problems that matter for discovery in life-events and connecting services.
A new, practical tool for this kind of mapping within a discovery process is what I call a signal chain map. A signal chain map is a named, specific inventory of each signal relevant to a life event: where it originates, what administrative truth it would establish, which services should respond to it, what consent is required, and what governance or technical blocker currently prevents it from flowing. That map could become a conversational document for aligning programs, policies and eligibility criteria (“What are we going to mutually recognize as true? Which truths should travel?”), is what turns the concept of administrative truth into something a delivery team can act on.
NB: It is worth being explicit about what this concept does not claim. It does not argue that every service needs to be accessed digitally, nor that every service needs to fully digitized. Scott should always have the option to meet a front-line human, or call a human. Which service channel Scott uses, is Scott’s choice.
A Note on Magical AI
Artificial intelligence is often presented as the answer to the kind of complexity Scott is navigating. Especially conversational AI and agentic AI that can take actions on a person’s behalf, while a digital twin aggregates data about a person in real-time across programs within a jurisdiction, or even across a country, or internationally. This magical duo of AI agent and digital twin could navigate benefit applications, identify relevant programs, and pre-fill forms. It sounds exactly like what Scott needs, right? It’s supermagical.
I’m not against AI. But I’m all for good, ethical, truth-generating AI that acts on good data plumbing. AI acting on inaccurate administrative truth (untruths) scales problems. An agentic AI reading Scott’s provincial records would find a two-adult household, calculate his means test accordingly, and move fast toward a wrong outcome. A digital twin inheriting that same administrative untruth would propagate it across every program simultaneously, with more apparent confidence than any single system would on its own. The magic duo accelerates the problems described in this series, and could break trust at the speed of light.
Where AI genuinely could help is on top of a governed foundation. Once administrative truths are established, verified, and portable — once the receipt exists within the boundaries that governs it — AI can do real work: detecting likely administrative untruths by spotting cross-system inconsistencies before they cause harm, matching Scott’s verified receipt against a service and eligibility catalogue, help government find duplications and inconsistencies in its own laws, policies, programs and prepare for streamlining, comparing across jurisdictions (if consented), and translating the receipt into plain language he can actually use. All of this depends on the governance layer being in place first, preferably at a federal or national level.
AI built on top of governed administrative truth is a powerful tool for reducing burden on citizens. AI built without that foundation is a faster way to replicate existing failure at greater scale, potentially causing a faster decline in trust with governments. More on AI in the next chapter.
* * *
Back to Scott, on a Futuristic Friday Morning
In this improved, futuristic version of Scott’s life, he submits his EI documentation and receives a government receipt the next day. The government receipt shows him four other federal programs he might be eligible for, based on what Service Canada now knows about his situation.
He presents the receipt to the provincial income assistance office. The caseworker verifies it instantly. She didn’t have to ask him to re-establish his employment history. She asks about his current household composition. Scott explained the divorce and showed the divorce decree. The caseworker updates the record in the correct Authoritative Data Registrar and restarts the assessment against his actual situation. The administrative untruth is corrected at last.
He still had to wait, but just a little while. The system still required him to navigate processes designed by institutions for institutional purposes. It still did all the right, checks. But Scott knew right away what the system already (wrongly) believed about him. And he had a choice: to go digital or meet a human, and both experienced full agency and transparency. He knew which facts had been established and which still needed to be proven. He had not been asked to re-prove his layoff to a second institution. And when the stale marital record surfaced, there was a pathway to correct it — not an adversarial appeal, but a designed correction process with a defined obligation on the institution’s side.
Part 5 makes the case for governing administrative truths across Canada.
* * *
References
Eubanks, V. (2018). Automating inequality: How high-tech tools profile, police, and punish the poor.
Scott, J. C. (1998). Seeing like a state: How certain schemes to improve the human condition have failed.
Srivastava, M. (2026). The minimum digital kernel of an unbundled state. Digital Statecraft.