America.gov wants one AI door for federal services without one giant record

THE SIGNAL IN ONE SENTENCE

America.gov is an ambitious answer to a painfully ordinary problem. A person who needs a passport, a benefit, a status update or a federal form should not need to understand the wiring diagram of the United States government before breakfast. On September 29, President Donald Trump signed an executive order directing the General Services Administration, the National Design Studio and the Office of Management and Budget to make America.gov the single online entry point for a defined group of high-volume federal services. The front door is supposed to be conversational. A person can ask for help in plain language, sign in, receive answers and, when the law and the plumbing permit it, complete a transaction without being bounced through a stack of agency websites. The White House says the current service can answer questions and that passport renewal and Medicare enrollment are intended to arrive later in 2026. GSA says the search layer draws from more than 29,000 government websites. Those are administration claims about a new service, not evidence that it already completes every promised transaction accurately. The more important part of the order is the architecture it tries to preserve behind the friendly chat box. Each agency keeps custody and control of its records, systems, legal responsibilities and decisions. The order says a common entry point must not create one centralized federal system of records about the public. It calls for data minimization, secure authentication, auditable authorization and lawful disclosure. It also says existing routes must remain available, including in-person service, telephone, mail and agency-specific websites. That combination is the whole test. One door can reduce bureaucratic navigation without becoming one database, one mandatory identity checkpoint or one chatbot that pretends to be the final authority. The distinction matters because conversation is not adjudication. A conversational layer can translate a person's request, retrieve official information, explain a process, collect a draft and hand the work to the right agency. It should not silently rewrite eligibility rules, infer facts that a person did not provide, or turn a generated sentence into a legal decision. The originating agency still owns the record and the statutory responsibility. If a benefits agency denies a claim, the person needs the actual notice, reason, source record and appeal path. A smooth answer in a chat window is not a substitute. The order defines covered services as public-facing federal services that serve more than 100,000 users in a 12-month period and can be accessed or applied for online. It excludes Internal Revenue Service tax filing and services provided by the Department of War and intelligence elements. OMB can add or exclude services by memorandum. Within 90 days, OMB must issue implementation guidance. Agencies must identify their covered services, expose existing public APIs, dashboards and digital forms through the platform, integrate Login.gov, and supply GSA and OMB with historical and current usage and performance data. The order is subject to existing law and available appropriations. In other words, September 29 created direction, not a finished national service layer. The 90-day deliverable is guidance, not universal integration. No public accuracy benchmark, accessibility evaluation, error budget, appeal test, privacy impact assessment, model card, incident rate or complete implementation budget appears in the order. The phrase super intelligence appears in the policy, but the document does not identify the deployed models, describe their evaluation or explain how a generated answer will be separated from an official agency determination. That gap is where practical governance belongs. Start with provenance. Every answer about a deadline, eligibility rule, required document or agency action should identify the authoritative source and when it was checked. If two official pages conflict, the service should show the conflict and route the question to a responsible office instead of blending the pages into a confident compromise. Next comes state. A person should always know whether the system is merely explaining, preparing a draft, submitting information, or reporting a decision already made by an agency. Those modes should look different, require different authentication and leave different receipts. The service also needs a narrow data path. Asking a general question should not automatically open a person's account. Drafting an application should not expose records from an unrelated agency. Login.gov can establish identity, but identity is not blanket permission. The authorization layer must say which agency data is requested, for which task, for how long and under what legal authority. A person should be able to cancel before submission and see what was actually sent. The separate-records promise is technically sensible and institutionally hard. A common front end can call many systems without copying every record into one warehouse. It can use purpose-bound tokens, agency APIs, short-lived session data and transaction receipts. Yet logs, chat histories, analytics, model traces and support records can become a shadow database even when the authoritative files remain distributed. Data minimization has to cover those secondary records too. A conversation about disability benefits, immigration status, debt, health coverage or a family crisis may reveal more than the final form requires. Retaining the whole conversation because storage is cheap would defeat the spirit of the boundary. Alternate service routes are not nostalgic decoration. They are part of reliability and civil rights. Some people lack stable broadband, a compatible device, a Login.gov account, an accessible interface, English fluency, a safe private room or confidence that a chatbot understood them. Others have a case too unusual for a scripted path. Keeping telephone, mail, counter service and agency sites available prevents one software failure from becoming a denial of service. Those routes also provide comparison data. If abandonment, correction or appeal rates rise in the conversational path, the older routes can reveal whether the new interface is helping or merely hiding friction. Accessibility must be tested with disabled people before transactions become consequential. Plain language is helpful, but it does not automatically produce keyboard access, screen-reader clarity, captioned assistance, cognitive accessibility, low-bandwidth performance or usable error recovery. Language access also requires more than fluent translation. The translated explanation must preserve the legal meaning of the source and clearly flag when an official form or notice controls. Performance measurement should therefore move past page views and cheerful completion animations. Agencies should publish answer accuracy by service and language, source-citation coverage, time to completion, abandonment, correction requests, failed identity checks, human handoffs, appeals, reversals, accessibility defects, privacy incidents and uptime. They should break results out by route so a faster average does not conceal a group that is getting lost. Usage data sent to GSA and OMB should be aggregated and minimized wherever possible. Oversight does not require a permanent transcript of every person's most vulnerable day. A responsible rollout would begin with navigation and explanation, where mistakes can be corrected before they alter a person's rights or money. It would add draft preparation next, keeping a human-readable preview and authoritative source links. Submission would come only after the agency confirms field validation, consent, receipts, duplicate handling and recovery from partial failure. High-consequence decisions should remain visibly owned by the responsible agency, with named appeal routes and human review. Red-team exercises should include outdated policy pages, malicious text on a linked site, conflicting agency guidance, ambiguous names, multiple people sharing a device, interrupted sessions, revoked access and attempts to pull records from the wrong agency. The public does not need a chatbot that sounds like the entire government. It needs a guide that knows which room owns the answer, shows its receipt and can hand the case to a person when the map stops matching the territory. The plain signal is that America.gov could make federal service navigation dramatically less absurd. Its strongest promise is not one interface. It is one interface with many accountable systems behind it, limited permissions between them, and real alternatives beside it. If the government keeps those boundaries visible, the front door may become useful. If convenience quietly erases them, the door becomes a very polite bottleneck.