35. Government Use Case

35.1 Scenario Context #

“Department of Public Services” is a constructed national government department administering benefits, employment support, and pension services, interacting with tax, health, housing, and local authorities, and serving 11 million citizens through digital, telephone, and in-person channels.

The problem it cannot solve — stated carefully. Citizens experience government as a single entity and are administered by many. A person who has recently become unemployed, has a housing arrears notice, has missed two healthcare appointments, and has a pending benefit claim held for verification is, from the citizen’s perspective, having one crisis. From the state’s perspective they are four unconnected cases in four systems, each progressing at its own pace, none aware of the others.

The correlation opportunity is real. So is the correlation danger, and this chapter treats them with equal weight.

35.2 The Two Faces of Government Correlation #

35.3 Constrained Correlation Architecture #

flowchart TB
    subgraph SRC["Departmental Sources — separate legal bases"]
        direction LR
        S1["Benefits administration"]
        S2["Employment services"]
        S3["Pension records"]
        S4["Contact channels<br/><i>digital, phone, in-person</i>"]
        S5["Case management"]
        S6["Correspondence"]
    end

    subgraph EXT["Cross-Departmental — statutory gateways only"]
        direction LR
        E1["Tax authority<br/><i>gateway: income verification</i>"]
        E2["Local authority<br/><i>gateway: housing support</i>"]
        E3["Health liaison<br/><i>gateway: capability assessment</i>"]
    end

    subgraph CTRL["Statutory Control Layer"]
        direction TB
        G1["<b>Published scope register</b><br/>every correlation scope is<br/>publicly documented"]
        G2["<b>Statutory purpose gate</b><br/>correlation permitted only for<br/>purposes named in legislation"]
        G3["<b>Prohibited-purpose list</b><br/>enumerated purposes for which<br/>correlation MUST NOT occur"]
        G4["<b>Independent oversight</b><br/>external body reviews scopes,<br/>audits outcomes, publishes findings"]
        G5["<b>Citizen transparency</b><br/>subject may see which correlations<br/>concern them and contest them"]
    end

    subgraph SCOPES["Permitted Scopes — illustrative"]
        direction TB
        SC1["<b>svc.compound_need.v2</b> — L2<br/>M2·negative<br/>Identify citizens with multiple<br/>concurrent open interactions<br/><i>purpose: service simplification</i>"]
        SC2["<b>svc.process_failure.v2</b> — L3<br/>M1·negative<br/>Identify cases stalled by<br/>administrative failure, not<br/>citizen action<br/><i>purpose: service quality</i>"]
        SC3["<b>svc.access_barrier.v1</b> — L1<br/>M2·M5 · aggregate<br/>Which cohorts experience<br/>disproportionate friction?<br/><i>purpose: policy evaluation</i>"]
        SC4["<b>ops.demand_forecast.v3</b> — L3<br/>M1·M5 · aggregate<br/>Anticipate channel and<br/>caseload demand<br/><i>purpose: resource planning</i>"]
    end

    subgraph PROHIB["Explicitly Prohibited"]
        direction TB
        P1["✘ Correlation for enforcement<br/>targeting without judicial basis"]
        P2["✘ Automated benefit determination<br/>or sanction"]
        P3["✘ Correlation with commercial data"]
        P4["✘ Any purpose not in the<br/>published register"]
    end

    SRC --> CTRL
    EXT --> CTRL
    CTRL --> SCOPES
    PROHIB -.enforced by.-> G2 & G3

    classDef src fill:#1b2f3d,stroke:#5b8fb0,color:#e6f2fa
    classDef ctrl fill:#3a2540,stroke:#a878c0,stroke-width:2px,color:#f6eaff
    classDef sc fill:#0a5570,stroke:#3fd0f0,color:#ffffff
    classDef proh fill:#4a2020,stroke:#d07070,stroke-width:2px,color:#ffeaea
    class SRC,S1,S2,S3,S4,S5,S6,EXT,E1,E2,E3 src
    class CTRL,G1,G2,G3,G4,G5 ctrl
    class SCOPES,SC1,SC2,SC3,SC4 sc
    class PROHIB,P1,P2,P3,P4 proh

Figure 49. Government inter-agency service correlation workflow (illustrative). The statutory control layer sits between sources and scopes, enforcing a published register, a statutory purpose gate, an enumerated prohibited-purpose list, independent oversight, and citizen transparency. No scope exceeds L3, and no scope makes eligibility determinations.

35.4 The Most Valuable Scope Is a Negative One #

svc.process_failure.v2 deserves emphasis because it inverts the usual direction of government analytics.

Conventional administrative analytics examines citizen behaviour: who claims, who complies, who appeals. This scope examines administrative behaviour: which cases are stalled because a verification request was never sent, a document was received but not processed, a referral was made but not acknowledged, or a decision deadline passed without action.

These are negative relationships — expected administrative events that did not occur. They identify failures of the state rather than failures of the citizen, and they are, in the author’s view, the single most defensible and most valuable application of correlation in government.

They also carry no meaningful privacy risk in the direction that matters: the subject of the finding is the administrative process, not the person.

35.5 Automated Decision-Making Constraints #

The framework’s position for government is more restrictive than for commercial contexts:

Table 71. Autonomy constraints for government decision types. Three categories are prohibited outright rather than capped, reflecting that automated adverse determinations about citizens are, in the author’s assessment, illegitimate regardless of accuracy.

35.6 Equity Auditing as a First-Class Requirement #

Any government correlation system must be able to answer: does this system treat comparable people comparably?

The framework’s requirements for government deployment:

• Every scope’s outputs are analysed for disparate impact across protected characteristics, using aggregate analysis that does not itself require individual-level protected-characteristic data where avoidable.
• Disparate impact findings are published, not merely reported internally.
• A scope demonstrating unexplained disparate impact is suspended pending investigation, not merely flagged.
• Independent oversight has access to the analysis and the underlying methodology.

This is more demanding than commercial practice and appropriately so: the state’s obligation to treat citizens equally is qualitatively different from a company’s obligation to its customers.

35.7 What Makes This Hard #

Legal basis and statutory gateways. Cross-departmental data sharing in most jurisdictions requires specific statutory authority for a specific purpose. The purpose intersection rule will block most cross-departmental correlation, which is correct. Enabling legitimate correlation requires legislation, not engineering.

Historical data quality in legacy administration. Government administrative data is frequently decades old, migrated multiple times, with inconsistent identity practices. Entity resolution across such data is difficult and error-prone, and the consequence of over-merging two citizens is severe — one person’s record affecting another’s entitlement.

Public legitimacy is not a communications problem. Public concern about government data correlation is substantively well-founded given historical precedent. It is not addressed by better explanation; it is addressed by genuine, enforceable, externally-verified constraint.

Scope creep is the predictable failure. A system built for service integration will be asked to support enforcement. The published register, the statutory purpose gate, and the prohibited-purpose list exist specifically to make this transition visible and difficult rather than gradual and administrative.

Next: 36. Telecommunications Use Case →