Observatory essay · 4 August 2026

The Case for Assurance Infrastructure

The technical argument that checking AI-generated evidence, not producing it, is the binding constraint on government analysis; the research avenues that would relax it; and sixteen tractable projects, ranked by probability of delivery.

Listen to this briefing2 min 41 sec · AI-generated voice · download · transcript

Sometime in the next few years, a government analyst will be able to do something no analyst has ever done: read everything. Every consultation response, every local plan, every hospital account, every published study bearing on a question — one agent pass per document, overnight, for less than the cost of a contractor's day. The raw capability is arriving on schedule. At fixed capability, the price of a unit of agent work has been falling at a median of around fifty-fold per year on the published series; task horizons on clean technical benchmarks have doubled every few months; and one UK deployment, a tool called Consult, has already categorised over 50,000 consultation responses for £240 of machine time. The question usually asked of these trends is what a department could do with a million agent sessions. This essay argues that it is the wrong question, and that everything worth having in that future turns on a different one: who checks the output, against what, and at what cost. Human checking already dominates the cost of agent-assisted analysis, and for the class of work where mass agents genuinely pay, it binds the throughput as well. The reading-everything future is real, and it is buyable — but only by whoever builds the verification machinery first.

This essay makes three arguments. First, the technical case: quantitative bounds on redundancy, serial structure, information, and chain reliability imply that the value of mass agent work turns on the verification machinery around it, and that human assurance already dominates the cost of agent-assisted analytical products. Second, the case survives the failure of its own forecasts. Even if agent capability stalls, the same cheap generation is available to everyone who submits evidence to government, so provenance and assurance infrastructure is required under every branch of the capability forecast. "Dominant" is used here in a deliberately loose decision-theoretic sense: not that the recommendation strictly beats every alternative in every state of the world, but that it pays under each branch of the forecast that carries non-trivial probability, at a cost that is bounded and known. Third, assurance infrastructure is a research programme, one whose component problems are unusually tractable, and it is the part of the agentic future that nobody is racing to build. The later sections lay out the avenues that would make assurance cheaper, simpler, and more capable, then a ranked list of specific projects, deliberately stated so that a funder or laboratory in any jurisdiction could pick one up, each with a falsifiable resolution criterion and a calibrated probability of delivery.

The wrong unit of analysis

Public discussion of government AI runs on an implicit production function: policy insight = f(agent sessions). More sessions, more insight. Every bound examined below says the same thing about this function: it is not stable, and it is not architecture-invariant. A session is not a unit of useful work. What a session contributes depends on the machinery around it, and the main thing that machinery decides is which ceiling applies.

The replacement is a pipeline with three stages: generation → verification → authorisation. Agents generate candidate analysis. Verification establishes which of it is true, sourced, and reproducible. Authorisation is the human act of standing behind it: officials act in ministers' names, and ministers answer to Parliament, so this stage retains a human signature as a matter of constitutional doctrine, not of capacity. The throughput of the pipeline is the minimum across its stages, and its output is not sessions but assured evidential information: claims a decision-maker can rely on because something other than the generating model says they hold.

The unit of analysis that works. Sessions feed the first stage only; what a decision-maker can use is what survives verification and carries a human signature, and total throughput is set by the narrowest stage.

This framing has formal backing. Yang and colleagues prove that the performance of multi-agent systems is capped by intrinsic task uncertainty (the uncertainty the answer retains given the input), and that the relevant bounds are governed by the number of effective channels, not the raw call count. Sessions are an input. The binding constraints live elsewhere, and the next section names them.

Four bounds on useful scale

Four panels of computed curves. Effective independent opinions flatten at one over rho: one hundred for correlation 0.01, ten for 0.1, two for 0.5. Amdahl speedup flattens at twenty times for a five per cent serial fraction and about three times for thirty per cent. Chain success falls to 37 per cent over one hundred steps at per-step reliability 0.99, but holds 90 per cent at 0.999. Sampled checks needed to certify an error bound stay flat, at 300 for one per cent and 3,000 for a tenth of a per cent, as corpus size grows from ten thousand to a million. — The four ceilings, drawn to their own arithmetic. More agents move a deployment along each curve; architecture and verification machinery decide which curve it is on.

Redundancy: a million calls buy 1/ρ analysts

When agent outputs are redundant estimates of the same quantity, correlated at pairwise level ρ, the Kish design effect converts N nominal observations into N_eff = N/(1+(N−1)ρ) effectively independent ones. As N grows, N_eff converges to 1/ρ no matter how large N becomes. At ρ = 0.01, a million calls carry the statistical weight of one hundred independent opinions. At ρ = 0.1, ten. At near-total correlation, one.

This is not a theoretical worry. Bertalanič and Fortuna imported this machinery into the multi-agent literature, derived a two-parameter scaling law from the Kish design effect, and found that thirty densely debating agents produce no more answer diversity than one on MMLU-Hard. Within their tested configurations, only architectural diversity (genuinely heterogeneous teams) lowered the correlation floor. Changing how the agents communicated did not, and much of the apparent benefit of "debate" came from re-evaluation rather than peer content, since a noise placebo tracked self-correction.

Two further results close off the cheap escapes. Goel and colleagues find that model mistakes are becoming more similar as capabilities increase, which points to a correlation floor across model families that rises as models improve. And in Kim and colleagues' study in Nature Machine Intelligence, a preliminary heterogeneity check found no evidence that mixing model families bypasses the saturation threshold; their centralised heterogeneous configurations underperformed strong-model homogeneous ones by a mean of 12.6 percentage points.

The bound has one honest escape, and it is the important one. It applies to redundant answers to the same question. If a million episodes each address a different subquestion — different documents, different data pulls, different code paths — the Kish algebra does not bite, because the episodes are not estimates of a common quantity. Architecture determines whether a deployment sits in the voting regime, with its ceiling of 1/ρ, or the coverage regime, whose ceiling is set by the corpus. It selects the regime; it does not lift the ceiling.

Serial structure: Amdahl's law with agent-team evidence

If a fraction s of a task is inherently sequential, no number of agents delivers speedup beyond 1/s. At s = 5 per cent the cap is 20×; at s = 30 per cent, about 3×; sixteen agents or a million, the ceiling is the same.

The Anthropic compiler project supplied an unusually clean illustration. When its parallel agents reached the Linux kernel, every agent hit the same bug, fixed it, and overwrote each other's changes. Sixteen agents did not help, because each was stuck on the same serial obstacle. Progress resumed only when the human operator converted the obstacle into parallel structure, using GCC as a known-good oracle: most of the kernel was compiled with GCC, and only the remaining files with the agents' compiler. Kim and colleagues measured the same structural dependence across domains. Multi-agent performance ranged from +80.8 per cent on a finance task that decomposes naturally into revenue, cost, and market factors, to −70 per cent on sequential planning; their conclusion is that sequential interdependence, not complexity, determines whether coordination pays. Coordination itself has superlinear cost (they fit reasoning turns growing as roughly (n+0.5)^1.72 in the number of agents), so serial structure is punished twice.

Gustafson's counterpoint supplies the escape route. If the workload scales with the machine (more documents, more jurisdictions, more model specifications, instead of deeper reasoning on one thread), the serial fraction of the scaled job shrinks. Policy questions of the form "what does this one causal chain imply" have large s and low ceilings. Questions of the form "what do all 50,000 responses say" have tiny s.

Information: the census class

No amount of processing extracts more information about the world than the inspected sources contain; this is the data-processing inequality, and Yang and colleagues state the formal version. Combined with the correlation bound, the practical consequence is that a million episodes re-reading the same 200 documents cannot outperform a few dozen well-diversified readings of them. (Compute-heavy work on fixed inputs, such as proof search or counterexample hunting, is a real exception, but it draws out logical consequences of the sources, adds no new information about the world, and is not what mass policy-agent proposals describe.) Mass episodes earn their keep only when the corpus is vast relative to human reading bandwidth, so that agents function as extraction machinery rather than extra opinions.

Call this the evidence census: one episode, or a small tree of episodes, per source object, over corpora of 10⁴ to 10⁶ objects — every consultation response, every local plan, every published trust account, every Hansard column bearing on a question. The Consult deployment is the census prototype at 5×10⁴ objects. Census workloads are exactly where very large episode counts are arithmetically and epistemically coherent: the episodes are parallel by construction, address distinct evidence, and are bounded by a corpus large enough to justify the count. The strongest defensible version of a million agent sessions on one policy question is not a million agents deliberating; it is a census over the question's entire documentary base, with a thin synthesis tree on top. Outside the census class, the correlation and serial bounds cap useful scale at numbers closer to the multi-agent literature's tens, with the logistic saturation past 1,000 agents reported by Qian and colleagues marking about the furthest documented point between.

Reliability: chains, and why the verifier is load-bearing

When a chain of k steps stands only if every step holds, and each step holds with reliability a given that its predecessors did, end-to-end correctness is a^k. At a = 0.99, a 100-step chain succeeds 37 per cent of the time. At a = 0.999, 90 per cent. Retries, tests, and checkpoints can break out of this decay, but each of those is itself a verification mechanism. Long-horizon autonomy is a verification problem wearing a capability costume.

The compiler project's author reports that the task verifier had to be nearly perfect, otherwise the agents would solve the wrong problem, and that most of the human effort went into tests, build scripts, and continuous integration rather than into the agents. Kim and colleagues measured the failure side of the same mechanism: architectures without centralised verification propagated errors at up to 17.2 times baseline, against 4.4 times for centralised designs whose validation bottlenecks intercept errors before aggregation.

Two cautions attach. METR's time horizons are measured at 50 per cent success; policy use requires far higher reliability, so operational horizons for unchecked chains are much shorter than headline horizons. And the Goel result warns that using models to verify models recovers less than it appears, because their errors increasingly coincide. The strong form of verification is a mechanically independent oracle — a compiler, a re-computation, a source-document hash — not a second opinion from a statistical cousin.

What the trajectories actually support

Prices. Decompose cost-per-task into price-per-token × tokens-per-task. At fixed capability, both components fall: Epoch AI's series shows declines of 9× to 900× per year with a median of 50×, and a post-January-2024 subset median of 200× per year, with Epoch's own evaluation-cost cross-check closing the loophole that token counts might be rising to compensate. A Monte Carlo over those series — its mixture parameters assumed and declared up front, a decision aid with no claim to official-estimate status — takes as its unit of work a documented real agent session from the compiler project, roughly 70,000 output tokens, about £8 at 2026 prices, and gives a median of roughly 475,000 purchasable 2026-capability sessions per £50,000 by end-2030, with an 80 per cent interval of about 53,000 to 2.8 million. Even the pessimistic decile funds a fifty-thousand-episode census. Purchasing power is not where this argument should be contested.

Capability. Under METR's TH1.1 update, the post-2023 fit gives a horizon doubling time of 130.8 days, the post-2024 fit gives 88.6 days, and the full-series fit is slower than either. From the January 2026 frontier point (320 minutes), a 40-hour horizon arrives between roughly September 2026 and mid-2027, depending on which fit persists; METR itself reports the trend with caution, noting sensitivity to task composition and wide confidence intervals. The deeper problem is that the measuring instrument runs out first. The implied end-2028 horizon spans 230 to 22,500 hours across the three fitted rates, far beyond a suite in which only 5 of the 31 tasks estimated at eight hours or longer have measured human baselines. During 2027 the doubling law stops being a measurement and becomes a forecast about a construct. Capability growth is real and fast, and about to become unmeasurable by the very trend line being quoted; 2030 claims resting on the extrapolation should carry that label.

Compute. Epoch's crunch analysis expects demand growing around 10× per year against supply growth of 3.4× per year, but concludes that in a crunch, everyday users shift to cheaper models while the largest models are reserved for work that justifies frontier prices, and that tomorrow's smaller models quickly match today's frontier. Fixed-capability census workloads sit in the insulated tier; frontier, long-context, and security-accredited access sits in the exposed one. Wall-clock time is a non-issue: a 70,000-output-token session decodes in about half an hour at interactive speeds, so a million sessions at ten-thousand-way concurrency complete in about two days. The operative constraints are provider quotas, accreditation of secure environments for OFFICIAL-SENSITIVE material, and the independence of what the sessions produce.

None of these trajectories rescues the naive production function. All of them make the pipeline's second stage more binding: generation gets cheaper on every branch, and verification gets cheaper only where somebody builds the machinery that makes it so.

Verification already dominates the cost

This is not a prediction. In the Consult deployment, categorising over 50,000 consultation responses cost £240 of machine time and 22 hours of expert checking. At £50 to £80 per loaded expert hour, assurance was 82 to 88 per cent of the exercise's direct cost, in 2025, before the generation side had fallen further. (Development, integration, and security costs sit outside both terms; the comparison is between the two marginal inputs to the analytical product itself, which is the ratio that scales with volume.) Twenty-two expert hours over 50,000 responses is 1.58 seconds per response: necessarily an aggregate, sample-based audit, not item review. And the machine did not scrape through. Consult agreed with one or both expert groups almost 83 per cent of the time, while the two practised human groups agreed with each other only 55 per cent of the time; its F1 alignment scores were 0.79 and 0.82 against an inter-human 0.74. Machine categorisation at or above human reliability, checked by sampling, with assurance nonetheless dominating the budget. As generation costs compound downward, the assurance share rises mechanically unless the productivity of assurance itself improves. That conditional is what the research programme later in this essay is for.

Sampling theory explains why the verification bottleneck is task-structure-dependent. For homogeneous outputs, the rule of three says that certifying an error rate below p at 95 per cent confidence needs about 3/p clean sampled checks (300 items for one per cent, 3,000 for a tenth of a per cent), independent of corpus size. Assurance of census outputs therefore scales with the required error bound, not with N. The rule carries conditions worth stating plainly. The sample must be random; the sampled items must be classifiable without error; and errors must not cluster in strata the sample is unlikely to reach, which is where an adversary, or an unlucky prompt template, will concentrate them. An average error rate is also not always the right target, since one fabricated quotation can matter more than a thousand harmless misclassifications; risk-weighted and stratified designs appear in the research agenda below for that reason. What does not sample at all is the unique heterogeneous chain: a single deep synthesis whose steps each need bespoke checking, where a^k decay makes per-step verification mandatory.

So the bottleneck localises, and it localises on a verifiability stack:

Extractable facts and citations: machine-checkable — the source is hash-frozen so it cannot drift, and the claim is resolvable to the passage that is supposed to support it. (The hash proves the source has not changed; whether the passage entails the claim is a semantic check, and automating that honestly is one of the research problems below.)
Statistical claims: re-computable from frozen data by deterministic replay. Replay certifies that the computation produces the stated number; whether the computation was the right one remains a human question, but a much cheaper one.
Causal and identification claims: partially formalisable, as rank conditions, null-space certificates, and countermodel searches. The algebra can be certified; the substantive assumptions that give it causal meaning cannot.
Framing and value judgements: not delegable. Machines can map stakeholder positions and expose trade-offs, but no schema converts a value choice into a checkable claim.

The verifiability stack. The layers are not equally expensive: the bottom checks run exhaustively at near-zero marginal cost, and the scarce resource, human judgement, belongs at the top.

Government's leverage point is to push analytical products down this stack (schema-level claims, source receipts, deterministic replay) so that scarce human assurance concentrates where only humans can supply it. Two cautions attach. Correlated model errors limit how much AI-checking-AI recovers. And once assurance is the scarce stamp, Goodhart pressure to rubber-stamp becomes the failure mode to design against.

The argument that does not need the forecast

Everything above conditions on government adopting agents. The strongest reason to build assurance infrastructure does not.

Mass fabrication of public evidence did not wait for cheap frontier agents. The New York Attorney General's investigation established that nearly 18 million of the more than 22 million comments the FCC received in its 2017 net-neutrality rulemaking were fabricated. That total includes 9.3 million fake supporting comments mostly submitted by a single 19-year-old using automated software, and an industry campaign that paid roughly $4.2 million for 8.5 million comments: about 49 cents each, pre-LLM, for text of template quality. Current generation costs are three to four orders of magnitude lower and the output is individually styled. Whatever a department decides about running agents itself, the evidence channels it receives through — consultations, calls for evidence, correspondence — face this at scale. The contamination itself is close to certain; the forecastable event is its detection and documentation, and a documented UK case by end-2029 is assessed here at 0.65.

This is what makes the recommendation robust. If the capability forecasts hold, government needs assurance infrastructure to use agents at scale. If they fail, government needs much of the same infrastructure to defend its evidence channels against everyone else's agents. The overlap between the two problems is real but partial, and it pays to be exact about it. The shared core is provenance and sampled audit: receipts for how evidence was produced, frozen corpora, and statistical machinery for certifying error rates over large collections of documents nobody will read in full. Internal use additionally needs replay and claim schemas. Inbound defence additionally needs submission provenance and campaign transparency, together with identity machinery whose costs to anonymous participation have to be designed for explicitly. The forecast changes how soon and how much; it does not change whether the shared core is needed.

The recommendation also lands on existing scaffolding. The UK's roadmap to trusted third-party AI assurance already commits government to professionalising the AI assurance market: a skills framework, an £11 million AI Assurance Innovation Fund from spring 2026, against a market of over 524 firms worth about £1.01 billion in 2024 and projected at £18.8 billion by 2035. That programme assures AI systems — the models and the processes around them. The gap is assurance of AI-generated evidence products: claim schemas, frozen corpora, citation resolution, replay commands, sampled human audit, and an inbound-evidence provenance requirement. Extending the roadmap's machinery from systems to evidence products is a bounded, fundable act. The cost worth admitting is standardisation risk, since schemas fixed in 2026 can ossify around 2026-shaped outputs; the mitigation is to version the standards, sunset them, and pilot before mandating.

The research programme: making assurance cheaper, simpler, and more capable

If the first half of this essay is right, the productivity of assurance is the variable that matters most, and it is a research target. What follows is a survey of the avenues that would move it, organised by the part of the problem each one attacks. Much of this is not new science. It is mature machinery from other fields — election auditing, laboratory proficiency testing, tax administration, software verification, survey statistics — that has never been pointed at AI-generated evidence.

Measure the unknown numbers first

The argument above runs on quantities nobody has measured. The cross-model error correlation ρ on policy-analytic tasks is the single most valuable unknown number in the field: every published correlation result comes from benchmarks like MMLU-Hard, whose item structure looks nothing like consultation coding or identification appraisal. Measuring it properly needs a fully crossed design (items × model families × prompt replicates) analysed with variance components, so that shared item difficulty is separated from genuinely shared model error. The same study should measure the conditional quantity that governs how much machine pre-screening can safely displace human hours: the probability that a machine verifier passes a claim given that the generator got it wrong. Bertalanič and Fortuna report that scaling-law parameters fitted on pilots of five agents extrapolate to thirty, which would mean a department could establish which regime it is in — hard ceiling, sublinear, or coverage — for a few thousand pounds, before committing to any architecture. That claim also needs testing on policy tasks rather than benchmarks.

The same goes for the shape of the work itself. Nobody knows what fraction of the claims in a real UK impact assessment or consultation summary is mechanically checkable, what fraction is re-computable, and what fraction is irreducibly judgement — by count, and separately by weight on the product's conclusion, which is the number that matters. Nobody publishes the assurance share of analytical cost, because generation arrives as an invoice while assurance arrives as staff time that was already being paid for; without a cost taxonomy and a time-use instrument, the 82–88 per cent figure remains a single data point from a single deployment. And nobody publishes a constant-work price index: the cost of a fixed basket of policy-analytic tasks at fixed acceptance thresholds, re-priced quarterly. The wedge between that index and the per-token series is the number a four-year business case needs. These are measurement exercises, not theory. They are cheap, and everything else in this programme calibrates against them.

Sharpen the statistics of audit

The rule of three is the crudest tool available, and better ones already exist. Election auditing has spent two decades building risk-limiting audits: sequential tests that certify an outcome with a guaranteed maximum probability of wrongly certifying, hand-checking as few items as the evidence permits and escalating automatically when the evidence resists. The betting-martingale forms of these tests stop early when quality is high, which is the modal case for census-class extraction, and typically reach the same certification with 40 to 60 per cent fewer checks than a fixed-size design. Porting that machinery to evidence products, with defects audited instead of miscounted ballots, is statistical engineering rather than a research gamble.

Three further upgrades compound it. Stratified allocation exploits the verifiability stack: citations cost seconds to check and estimated statistics cost hours, so optimal allocation of a fixed expert budget differs from flat sampling by a large and computable factor. Prediction-powered inference attacks the estimand rather than the items. It combines machine labels on the whole corpus with human labels on a small random subsample to produce confidence intervals for the published figure — "62 per cent of respondents opposed" — that remain valid whatever the machine's biases, with interval width set by human–machine disagreement instead of raw machine accuracy (Angelopoulos and colleagues, Science, 2023). Conformal risk control does per-item triage with distribution-free guarantees: score every claim, calibrate a threshold, auto-accept above it, route the tail to humans, with the false-claim rate in the auto-accepted set certified in advance (Angelopoulos and colleagues, 2024). The caveat on the last is that everything depends on score quality, and the correlated-error results cut against optimism here: machine scorers may be least informative on the items the generator got confidently wrong.

Two corrections keep all of this sound. Every published sample-size formula in this space assumes the human checker catches every defect they inspect. Real reviewers do not, and if auditor sensitivity is s, zero findings in n checks certifies only an error rate below 3/(n·s). The correction machinery exists (imperfect-test corrections in epidemiology, capture–recapture across independent reviewers in software inspection), and nobody has estimated s for evidence assurance. The second correction is temporal. A certified rate is a statement about a frozen configuration; model versions, prompts, and submission populations all drift, so certification needs the sequential change-detection layer that industrial quality control has had for seventy years, tuned so that a doubling of the error rate is caught within a stated number of audited items at a stated false-alarm rate.

Build mechanical oracles, and type every claim by its refuter

The verifiability stack becomes infrastructure the moment claims carry their checking obligations explicitly. A claim schema in which every assertion states its type and its oracle — a source hash and byte span for a quotation; data, code, and tolerance for a computed statistic; a graph and query for a causal claim; an explicit NONE for framing and values — changes the economics of assurance structurally. Within machine-checkable strata the oracle runs exhaustively at near-zero marginal cost, and the entire human budget concentrates on the strata where no oracle exists. The residue becomes visible instead of hidden.

Each oracle class is worth taking apart. Citation checking is three checks, not one: the identifier resolves; the retrieved bytes hash to what was frozen at corpus freeze, which catches silent revision of legislation, statistical releases, and web pages; and the quoted span is actually contained in the source. Recent measurements of deep-research agents make the ordering quantitative. Link validity runs 94 to 100 per cent while claim support runs 39 to 77 per cent, so the check everyone builds first, whether the URL resolves, is the one with almost no discriminating power, and the gap between "the source exists" and "the source supports the claim" is where the checking effort belongs. Deterministic replay splits the same way, into full replay, which needs the data and the code, and oracle-free internal recomputation, which needs only the document: re-deriving a percentage from its own numerator and denominator, checking that shares sum, that stocks reconcile with flows, that a reported statistic is arithmetically attainable. The statcheck programme found that roughly half of published psychology papers contain at least one internal reporting inconsistency, using nothing but the papers' own text. Internal recomputation is the one oracle in this inventory that works on adversarial inbound evidence, because it requires nothing from the author.

Further up the stack, some causal and rule-mechanics claims admit genuine decision procedures. Nonparametric identification from a causal graph is decidable, with algorithms that return either an estimand or a certificate of non-identifiability. That machinery is already operated by the Policy Identification Observatory at stage 5 of its case protocol, the identification gate. Linear-model non-identification has exact null-space witnesses. Claims about what a rule system does — effective marginal rates, cliff edges, who loses more than £X — can be checked exhaustively against executable encodings of the tax-benefit system with an SMT solver, which returns either a proof over the declared domain or a concrete counterexample household. Exhaustive checking has no sampling error, so the rule of three simply does not apply to that stratum. The deepest version of this is proof-carrying analysis: the producer ships a witness, and the consumer runs a small checker in exact arithmetic: a few hundred to a couple of thousand lines with no model inside, and the only thing that needs trusting. That structure is the one approach in this programme that is immune to the correlated-error problem, because it removes the second model opinion from the loop entirely. Its limit is coverage: witness formats exist for a handful of claim classes, and most statistical estimation will never have one.

Make sampling sound: commitment before audit

There is a soundness gap beneath all sampled assurance, and it is cryptographic rather than statistical. The rule of three certifies the population the sample was drawn from. If the operator can re-generate, silently repair, reorder, or selectively present items after learning which ones the auditor will inspect, three hundred clean checks certify nothing; a curated-corpus attack can pass a 1 per cent audit while the true error rate sits an order of magnitude higher. The repair is standard in adjacent fields and absent in this one. The operator publishes a signed Merkle commitment over the frozen corpus and all outputs before the sample is drawn; sample indices come from a public randomness beacon the operator cannot steer; every audited item is served with an inclusion proof against the pre-committed root. One 32-byte hash per item. The same primitives extend outward. Signed usage receipts from inference providers turn operator claims about volume and model identity ("200 agents, 15 hours") from testimony into checkable evidence, and append-only transparency logs in the style of Certificate Transparency turn equivocation and backdating from deniable into detectable. The analogy also breaks in one instructive place: certificates have a motivated victim who monitors the log, and evidence products mostly do not, so the monitoring function has to be designed and funded rather than assumed.

Two deployment facts matter for government. Privacy law is the binding constraint on append-only designs, and it is solvable: log keyed commitments instead of content, so that erasure under data-protection law is executed by destroying a key while the log's integrity survives. That is the difference between a proposal that dies at the impact-assessment stage and one that does not. And trusted-execution attestation is strong in an unglamorous place: attesting the orchestrator (corpus freezing, sample derivation, deterministic scoring) is deployable now on commodity cloud and covers the steps the commitment protocol needs, while attested frontier inference remains vendor-dependent. Replay bundles tie the layer together as the unit of publication: content-addressed corpus, pinned environment, signed receipts, per-claim anchors, and a declared conformance class. Agent pipelines are not bit-reproducible, so the classes must distinguish "the checks reproduce every verdict" from "the bytes match"; the former is the property assurance actually needs.

Defend the inbound channel by provenance, not detection

For the channels government receives evidence through, one design decision matters more than the rest: detection of machine-generated text is a losing game, and the programme should be built provenance-positive instead. The negative result is now theoretical as well as empirical, since detector performance is bounded by the shrinking statistical distance between human and model text. Its failure mode is also the worst available, because false positives concentrate on non-native English writers and unusual styles. In UK public law that is not a tuning parameter. Consultation responses must be conscientiously considered; excluding a genuine response because a classifier misfired is a justiciable defect in the process, and a screening regime whose errors track protected characteristics engages the equality duty. A consultation-defence design that quietly discards flagged submissions is building a legal liability rather than a safeguard.

The provenance-positive alternative assembles pieces that mostly exist. Attested submission channels with rate limits. An optional verified-identity tier alongside an open one, so that authentication buys signal without excluding anyone. A signed declaration of AI involvement, useless against adversaries but valuable analytically, because it creates an honest stratum and makes the dishonest one a measurable residual. Mandatory campaign disclosure by organisers, for which the Elections Act 2022 digital-imprints regime is a working domestic precedent. Watermark checking where generators cooperate (production-scale text watermarking is deployed, though opt-in by construction). Beneath all of it sits robust aggregation, which may quietly dominate the rest: a consultation is not a vote, so clustering submissions by distinct argument and capping the weight of any one cluster defends the analytical product against volume attacks without adjudicating the authorship of a single response. Whether argument-level aggregation beats any legally tolerable detector is an open empirical question, answerable with a planted-contamination benchmark scored on distortion of the final theme table rather than on classification accuracy. The published object should change accordingly. Alongside its conclusions, a consultation analysis should report the fabricated-submission fraction at which each headline conclusion would flip, so that contamination robustness becomes a stated property rather than an assumption.

Design the institution against Goodhart

Once the assurance stamp is scarce and valuable, the failure mode is rubber-stamping, and the countermeasures are known because older assurance industries learned them expensively. Tax administration found that risk-targeted audits alone are gameable and cannot estimate the population error rate, which is why HMRC runs a random enquiry programme alongside targeted enforcement. An evidence-assurance regime needs the same randomised floor, both for deterrence and because it is the only source of an unbiased estimate of the residual error in stamped products — an "evidence error gap" a Public Accounts Committee could track. Laboratory medicine routes blind proficiency samples through accredited laboratories continuously, because assurers must themselves be assured; planted-defect items in the live assurance queue measure the gap between announced-audit and blind detection rates, which is the rubber-stamping rate observed directly. Financial audit, for its part, shows what a binary stamp does to incentives, which argues for replacing pass/fail with a published operating characteristic: a machine-readable receipt stating what was checked, by which oracle, at what certified bound, and what was never covered at all.

The market lever is procurement, which moves in months where legislation moves in years. Three clauses insertable into existing contract vehicles would do most of the work: a replay clause delivering frozen corpus hashes, model identifiers, and a deterministic replay command; an assurance receipt as a named deliverable; and third-party audit access, explicitly including blind proficiency items. A market cannot form around a good that cannot be independently inspected, so the replay clause is the precondition for extending the third-party assurance market from systems to evidence products. Against the ossification worry, the same empirical habit applies as everywhere else in this programme. Schema decay is measurable: apply vintage standards to current products and count what no longer fits, with reporting standards in other fields supplying decades of revision history as the outside view. Sunset clauses can then be set from a measured decay rate instead of taste.

Sixteen projects, ranked by probability of delivery

The avenues above decompose into specific projects, and the decomposition was done under discipline: each project below is sized for a small team, carries a pre-registrable resolution criterion that can fail, and was scored independently three times (by a calibration-focused forecaster profile, a sceptical methodologist profile, and a research-strategy profile focused on supersession), with the median taken. The projects are stated so that any funder or laboratory in any jurisdiction could carry them forward: the methods are general, and where a criterion needs a concrete corpus or institution, a workable example is named.

The scoring assumes something the essay has been arguing all along: that the agents are already good enough to do the mechanical share of the research. Corpus assembly, annotation at scale, statute encoding, proof search, simulation, implementation: in every project below, agents execute that work now, directed by a small human team, and the horizons and costs reflect it. Most of the portfolio fits inside a year and under £100k a project. What does not compress is the human critical path: expert judgement where humans are the instrument, institutional hosting, contracted adversaries, and calendar time itself. The same doctrine cuts the other way on value. A result that lands in months arrives in roughly the world it measured; anything slower must survive model turnover, so payoff is scored for the world in which the result lands. Measurements of current-model behaviour decay within a model generation. Theorems, protocols, standards, checkers, and reference corpora do not. The ranking that follows therefore favours exactly what a research funder should currently favour: durable instruments that agents can build immediately.

P is the probability that the project delivers its stated resolution criterion within its horizon, given a small human team directing capable agents. It is not a measure of importance. Payoff, scored separately, is how much the result would advance assurance infrastructure conditional on delivery, in the world where it lands. Costs are indicative, at 2026 rates, and assume agents do the building.

Every project medals, because this is a portfolio rather than a cull: Gold medal gold for the near-certainties, Silver medal silver for the better-than-even tier, Bronze medal bronze for the coin flips, and Teal medal teal — the house colour — for the hard tail, where much of the value sits.

#	Project	P	Payoff	Horizon	Indicative cost
1	Curated-corpus attack on sampled assurance, plus the commitment countermeasure	0.88	0.68	4 mo	~£35k
2	Replay feasibility audit of published government AI-assisted analysis	0.80	0.55	3 mo	~£30k
3	Metamorphic relation library and mutation benchmark for government analytical pipelines	0.68	0.70	5 mo	~£45k
4	Risk-limiting audits for evidence products	0.60	0.68	6 mo	~£90k
5	Prediction-powered consultation statistics	0.60	0.72	4 mo	~£45k
6	The assurance coverage census of real policy claims	0.57	0.82	7 mo	~£70k
7	Exhaustive rule-mechanics verification of published tax-benefit claims	0.55	0.65	7 mo	~£70k
8	Contamination forensics and fragility bounds for published consultations	0.52	0.45	9 mo	~£85k
9	Identification-gate certificates with independent checkers	0.50	0.62	8 mo	~£60k
10	PolicyCAPA: measuring cross-model error correlation on policy tasks	0.42	0.55	7 mo	~£150k
11	Certified auto-accept: conformal triage and its cost curve	0.42	0.55	6 mo	~£70k
12	No-cooperation checker for inbound evidence, scored on theme-table distortion	0.40	0.58	8 mo	~£95k
13	Citation receipts with inclusion proofs for versioned public sources	0.33	0.78	7 mo	~£90k
14	Coverage estimation and stopping rules for census workloads	0.26	0.55	7 mo	~£70k
15	Replay conformance classes for agentic pipelines, with a divergence dataset	0.25	0.60	8 mo	~£60k
16	Blind proficiency testing of evidence assurers	0.16	0.82	15 mo	~£190k

Scatter plot of the sixteen projects: probability of delivery on the horizontal axis, payoff conditional on delivery on the vertical. Every point is drawn as a medal in its tier colour: gold for the two near-certainties at the right, silver for the better-than-even tier in the middle including the coverage census at the highest payoff, bronze for the coin-flip cluster, and teal for the hard tail at the left. Project 16 sits far left at probability 0.16 but payoff 0.82, annotated as needing a government host. A dashed amber line marks the coin-flip probability of one half. — Sixteen projects, two orderings, four tiers of medal. Position rewards deliverability under agent execution; the payoff axis is supersession-discounted, which is why durable instruments outrank perishable measurements.

The near-certainties (P ≥ 0.8)

1. The curated-corpus attack (P = 0.88). Formalise sampled auditing as a game in which the operator may repair, reorder, or selectively present items after learning the sample; prove how far a 3/p audit can be fooled; demonstrate it end-to-end on a 50,000-item planted-error corpus, with roughly 300 clean checks certifying an error rate ten times better than the truth; then defeat the same strategy with a pre-published Merkle commitment and beacon-drawn sample indices. Agents do the formalisation, the corpus, the attack, and the countermeasure; the only calendar-bound step is practitioner interviews establishing whether real analytical practice already commits implicitly. Four months. It is also the most durable project on the list: a theorem about an adversary model and a commitment protocol contain no measurement of any model, and the result decides whether every other sampled-assurance project here is sound.

2. The replay feasibility audit (P = 0.80). Take published government analytical outputs that state AI assistance (national algorithmic-transparency registers and the US federal AI use-case inventories provide sampling frames) and attempt third-party replay of their quantitative claims from public materials alone, scoring each on a graded ladder from "sources identifiable" to "numbers reproduced". Because agents absorb the replay labour, the criterion rises from twenty outputs in one jurisdiction to fifty across two, which makes the rung distribution (the actual product) properly readable and cross-nationally comparable. The human critical path is legal review of the drafted replay and audit-access clauses. Three months, desk-based, no permissions needed.

The better-than-even tier (P 0.55–0.68)

3. The metamorphic relation library (P = 0.68). Agents write the invariants for the recurring shapes of government analysis, build the defect catalogue, inject blind, and run all four kill-rate regimes; humans source the defects from documented analytical incidents, which is the step that keeps the benchmark honest. Metamorphic relations for stock-flow accounting and deflation are mathematics and will not expire; only the agent-code-review comparison column decays.

4. Risk-limiting audits for evidence products (P = 0.60). The port of election-audit machinery: assorters, betting-supermartingale tests, escalation logic, and the operating-characteristic curves a department needs to choose a design. Agents implement everything; humans adjudicate ground truth on the benchmark corpora. The drift-detection sub-criterion has already been re-derived once, after review showed the original bar sat below an information-theoretic floor; that is the kind of correction pre-registration review exists to force. The remaining honest risk is the pre-registered efficiency margin: sequential designs must beat the rule of three by the stated 40 per cent, not merely match it.

5. Prediction-powered consultation statistics (P = 0.60). Valid confidence intervals for the published figures of consultation analysis, from machine labels on the whole corpus plus a small random human sample (item-level corpora are published by several regulators and, at vast scale, on the US regulations.gov docket system). The human-labelled subsample is small by design — the human-labelling bottleneck is the method's own subject. The estimator and package are durable; the measured effective-sample multiplier only improves as labellers do, so a published value stands as a lower bound.

6. The assurance coverage census (P = 0.57). Annotate every assertive sentence in roughly sixty real evidence products from at least two jurisdictions against a seven-class obligation taxonomy, elicit which claims are load-bearing, and measure per-class oracle catch rates. This is the project that prices everything else, and it carries the portfolio's joint-highest payoff (0.82): the catch rates are properties of policy prose and versioned substrates, not of any model, so they age on a decade clock. It clears the coin flip it used to sit under for a specific reason — agents can iterate the annotation protocol through dozens of pilot cycles before a single expensive human annotation is spent, which attacks the inter-annotator-agreement gate directly.

7. Rule-mechanics verification (P = 0.55). Give published claims about what a rule system does (effective marginal rates, cliff edges, who loses more than £X) formal statements over a declared household space, encode the rules against executable tax-benefit models (the OpenFisca and PolicyEngine families already cover several countries), and return machine verdicts: a proof over the stated domain or a concrete counterexample household. Scored as a long shot when statute encoding meant person-years of human formalisation labour; agents now produce the statute-pinned encoding and the solver harness, the claim floor rises from thirty to sixty, and the binding steps are lawyer review of the encoding, which is the trust boundary, and independent confirmation of at least one counterexample. Durable on a statutory clock, and the harness is reusable against every subsequent reform.

The coin flips (P 0.40–0.52)

Five projects sit near even odds, each held there by something acceleration does not touch. Contamination forensics (8, P = 0.52) gains data access by targeting the docket system that publishes nearly everything, and its fragility-bound half is permanent arithmetic; it carries the portfolio's lowest payoff (0.45) because the other half, detector-based prevalence estimates calibrated on 2026 generators, has the shortest half-life on the list. Identification-gate certificates (9, P = 0.50) is the portfolio's largest re-rating under the doctrine: witness formats, exact rational null-spaces, machine-checkable proofs, and the independent sub-2,000-line checker are precisely the formal labour agents absorb, roughly doubling odds that once sat below one-in-five when humans carried it — while the crux, whether real identification arguments are certifiable at all, is untouched. PolicyCAPA (10, P = 0.42) shows the doctrine's other edge. The crossed design and variance-component estimation are now essentially free, but the precision gate is bounded by the double-adjudicated expert gold subsample, which does not compress; and ρ measured on named model versions is the fastest-decaying quantity in the portfolio, which is why its payoff sits at 0.55 rather than the top of the column: the durable assets are the instrument, the harness, and the gold corpus, not the number. Certified auto-accept (11, P = 0.42) keeps its dead zone: an auto-accept fraction between 20 and 50 per cent at policy-grade tolerances remains the most likely landing point, and the coverage-risk curve moves with every capability release. The no-cooperation checker (12, P = 0.40) still hinges on the false-positive rate against genuine public submissions, and its contracted red team is one thing the building agents cannot substitute for: an adversary with a budget and an incentive is not the same agent wearing a different hat.

The hard tail (P < 0.40), where much of the value sits

Citation receipts (13, P = 0.33, payoff 0.78) becomes agent-weeks of engineering in two of its three parts, with verifier independence recast as model-family independence; it still likely fails its third gate, because the claim-support gap is dominated by semantic non-support that hashes and span checks cannot touch. The spec is a standards artefact all the same: a receipt that verifies in 2026 verifies in 2036. Coverage estimation for census workloads (14, P = 0.26) founders where it always did — themes are not species, and capture–recapture with heterogeneous capture probabilities under-estimates richness beyond the stated tolerance; agent speed does not repair an estimator's bias. Replay conformance classes (15, P = 0.25) meets a critical path acceleration cannot buy: the divergence dataset needs real model-version turnover across real months, and its 95 per cent agreement bar may exceed the human ceiling on judging "substantive conclusion unchanged". Blind proficiency testing (16, P = 0.16, payoff 0.82) remains where payoff and probability part company most sharply. Agents can have the entire instrument (mutation taxonomy, planted-defect generator, shadow queue, control charts) ready before recruitment even closes; everything after that is institutional: hosting, an ethics route with no sector precedent, consenting assurers, live queues with real stamps at stake. The implication lands on institutions, not researchers. This is the project a national assurance programme — the UK's, under its third-party assurance roadmap, or any counterpart elsewhere — should commission, because nobody else can.

Reading the portfolio

Read as a portfolio, the ranking now says something sharper than a sequence. Agent execution compresses almost everything: the whole sixteen-project portfolio costs about £1.26m, roughly what six of these projects would have cost with humans doing the mechanical work, and every project except the institutional one fits inside a year. The near-certainties deliver in about four months for £65k combined; adding the entire better-than-even tier brings the total to under £400k and seven months, and would replace most of this essay's central unmeasured quantities with numbers carrying intervals. What agent execution cannot buy is now the scarce resource in plain view: expert adjudication, institutional hosting, contracted adversaries, and calendar time itself. The supersession lens sorts value the same way. The projects that build theorems, protocols, standards, checkers, and reference corpora hold their worth through model turnover; the projects whose product is a measurement of today's models are already depreciating, and the ranking prices that in. A funder reading the list top-down sees durable instruments that agents can build this year. The bottom of the list is closer to a specification of what an assurance programme should itself commission.

The future this argues for

It would be easy to read everything above as a brake. It is closer to the opposite: an account of what has to exist before the accelerator can be pressed.

Properly harnessed, census-class agent work changes what public evidence is. "We considered all responses" stops being a courtesy phrase and becomes a checkable claim with a certified error bound attached. Analytical questions that were never asked because the reading was unaffordable — what do all the local plans, all the trust accounts, all the tribunal decisions actually say — become routine. Governments currently spend tens of thousands of analyst-days a year reading consultation responses alone; the same expertise, redeployed to the top of the verifiability stack, buys judgement instead of transcription. And an evidence product built for verification is a different public object from a report: every citation resolves against a frozen source, every number re-computes on command, and disagreement concentrates where it belongs, on assumptions and values rather than on arithmetic nobody can check.

The deeper point is that assurance productivity compounds. Every claim class that gains a mechanical oracle widens the set of work that can be safely delegated; every widening generates more verified output to learn from; the loop feeds itself. Agents will increasingly check agents — the correlated-error results say that is safe only when the check bottoms out in something mechanically independent, which is exactly what the oracles, receipts, and commitment schemes above provide. Whoever builds this infrastructure first does not just defend against a flood of synthetic evidence. They get to run the census class at full throttle while everyone else is still arguing about whether to trust the output. The sixteen projects above are how that future gets built on purpose rather than arrived at by accident.

Method and epistemic status

The quantitative claims in the first half — the bound arithmetic, the Consult figures, the price and horizon trajectories, the FCC numbers — come from the published sources linked in the text and collected under Further reading; every derived number was independently recomputed for this essay, and the multi-agent scaling claims are stated within the tested configurations of the studies cited, with flags where a study's reach is narrower than its slogan. The research programme and project list were built for this essay in three stages: four independent research passes over the avenue space (audit statistics, mechanical oracles, provenance and cryptography, institutional design), reorganised into the six avenue sections above; consolidation into sixteen projects with falsifiable resolution criteria; and independent scoring by three adversarial reviews under different priors — a calibration profile, a methodological-scepticism profile, and a research-strategy profile focused on supersession — with medians reported and the disagreements disclosed in the text. The scoring applies an explicit doctrine, stated in the portfolio section: agents execute the mechanical share of each project now, with horizons and costs revised on that assumption, and payoff is discounted for supersession, so that measurements of current-model behaviour are valued below the instruments, protocols, theorems, and standards that outlive model turnover. Before publication the essay itself was cross-examined: an adversarial review by a model from a different vendor, an internal-consistency check that recomputed every number, and a fidelity pass over the sources. The surviving objections shaped the wording of the bounds, the scoping of the Consult cost share, and the two-problems distinction in the defensive argument. The probabilities are calibrated judgements rather than measurements. The costs are indicative. The resolution criteria are drafts that pre-registration review should tighten; in one identified case (the drift sub-criterion of the risk-limiting-audit project) it already has, after review showed the stated bar to sit below an information-theoretic floor.

What would most change these conclusions: a measured ρ for policy-analytic tasks materially below 0.01, which would raise the ceiling on redundant-opinion architectures; evidence that assurance productivity is rising as fast as generation productivity, which would soften the Baumol dynamic; or a demonstration that argument-level aggregation fully neutralises contamination at scale, which would deflate the case for inbound provenance machinery. None of these is currently in evidence. The second is what the programme above is designed to bring about.