Dubai put 300 public services in the agent queue, with people still at the controls

THE SIGNAL IN ONE SENTENCE

Government paperwork rarely arrives as one neat task. A resident may need to prove identity, find the right service, upload documents, correct a missing field, pay a fee, wait for several agencies to talk to one another and figure out what happened when the process stalls. The citizen sees one problem. The government sees a relay race with forms. Dubai is now asking whether an AI agent can run more of that relay. On October 5, Dubai Future Foundation announced the Agentic AI for Government Services Accelerator. The first phase brings together 33 Dubai Government entities and will assess more than 300 public-facing use cases. Selected ideas are supposed to move from service design into prototypes, pilots, monitoring and, if they pass, live operation. That scale makes the announcement more interesting than another chatbot at the front desk. An ordinary chatbot answers a question. An agentic service may interpret a request, gather information, coordinate steps, use tools, prepare a decision and keep working toward an outcome. In public administration, that can mean a shorter journey through several offices. It can also mean a machine touching several consequential systems before the resident understands what it has done. The accelerator's published design at least recognizes that distinction. Dubai Centre for Artificial Intelligence is organizing the program with Digital Dubai and the Dubai Electronic Security Center. Government service owners will work with AI companies through a four-stage process: discover a suitable service, design its journey and controls, build and validate a prototype, then pilot and monitor performance under independent assurance before scaling. The program runs year-round. Its stated target for each cohort is up to 10 reusable service blueprints and five to eight validated prototypes. It also promises readiness records, reusable playbooks, a government use-case knowledge base and selected public insights. Those are sensible outputs because the hardest part of government AI is rarely the demo. The hard part is the operating record. Who owns the service? Which data may the agent read? Which systems may it change? What happens when two records disagree? When must a civil servant approve the next step? How does a resident appeal? Which logs survive? Who investigates if the agent exposes private information, invents a requirement or quietly sends someone down the wrong path? Dubai's framework names service ownership, public value, data and integration, security and governance, human oversight and measurable impact as assessment areas. That is the right checklist. The public test is whether those headings become controls that a person can actually use. Start with the service journey. Some public tasks are good candidates for bounded assistance. An agent could explain eligibility in plain language, translate instructions, check whether a submission is complete, schedule an appointment or assemble information from approved sources. Those jobs can save time without giving software final authority over a person's rights or obligations. Other tasks carry much more weight. An agent that recommends whether a licence should be granted, flags a family for investigation, prioritizes housing assistance, assesses a penalty or decides whether an appeal is complete is no longer just removing clicks. It is shaping access to government. The same technology can sit in both lanes. The interface may even look identical. That is why a service needs a published authority map before anyone celebrates the shorter queue. The map should separate four kinds of action. First, the agent can explain. It can retrieve official policy, show the source and translate it without changing a record. Second, the agent can prepare. It can prefill a form, identify missing evidence or draft a request, but a person confirms the submission. Third, the agent can execute a reversible step. It can book an appointment or route a case, provided the resident can see the action and undo it. Fourth, the agent can influence a consequential decision. That lane needs named human authority, documented evidence, an appeal route and a record that can be reviewed after the fact. Lumping all four together as automation would be wonderfully convenient and thoroughly unhelpful. Security needs similar specificity. The Dubai Electronic Security Center says cybersecurity must be present from planning through operation and monitoring. The accelerator page says each opportunity will be assessed for readiness, governance, security and integration. Those commitments matter, especially when an agent may cross several government systems. But an agent can follow a malicious instruction hidden in a document, retrieve more data than the task requires, expose information through its output or call the correct tool at the wrong time. Conventional access control is necessary. It is not sufficient. Each service should give the agent the smallest temporary permission required for one job. Reading an address record should not grant permission to change it. Drafting a payment should not permit payment. Looking up an appointment should not allow cancellation. Access to one resident's case should expire when the task ends. Tool calls should also be visible in the audit trail. A useful record includes the request, approved data sources, model and version, instructions, tool calls, human approvals, outputs, errors, final action and later correction. Without that sequence, an investigation becomes guesswork dressed as confidence. Then there is measurement. The accelerator promises measurable impact. The easy metrics will be tempting: completion time, fewer screens, lower handling cost and percentage of requests resolved without staff involvement. Those numbers can hide the people who have the hardest cases. A service may look faster because the agent quietly abandons unusual requests. A completion rate may rise while residents with disabilities, limited digital access, uncommon family arrangements or records in multiple languages receive worse outcomes. A system may reduce calls by making the appeal route harder to find. Public-service measurement needs a second column. Track correction rates, appeal outcomes, unexplained abandonment, accessibility failures, false fraud flags, privacy incidents, performance by language and the number of cases a human had to rescue. Publish enough of that record for residents and independent researchers to judge whether the service is merely efficient or actually fair. Human oversight must be designed with the same honesty. A human who receives a polished recommendation after the agent has gathered evidence, scored the case and selected the next action may technically remain in the loop while having little practical ability to challenge it. A rubber stamp is not control. The reviewer needs time, authority, source evidence and an interface that makes disagreement normal. The resident needs a visible way to ask for a person before a consequential action becomes final. Staff need protection from performance targets that punish them for slowing down an automated process when the case does not fit. The program's reusable blueprints could become its most important product if they preserve these controls. A good blueprint would specify the task boundary, permitted data, approved tools, required human decisions, monitoring metrics, retention period, incident route, appeal process and shutdown condition. Another agency could reuse the pattern without pretending that every service carries the same risk. The shared knowledge base could be equally valuable if it records failures as carefully as successes. Government innovation programs love a showcase. The less glamorous entry is often more useful: this service could not be automated safely because records were inconsistent, responsibility was split, the appeal process was unclear or the expected benefit did not justify the risk. That is not a failed experiment. It is a saved public mistake. Dubai has given the project a meaningful pipeline: hundreds of candidates, named government partners, a staged build process, independent assurance language and concrete cohort outputs. What it has not yet published is the first selected service, its risk tier, an evaluation result, an incident process or the public reporting format. That is the caution, not a verdict. The announcement establishes a serious test bed. It does not prove that any particular agentic service is safe, effective or fair. The plain signal is that government agents should earn authority one reversible step at a time. Let them explain before they decide. Let them prepare before they execute. Give them narrow permissions. Keep a readable record. Put a real person at the consequential gate. Make appeals obvious. Publish what the service gets wrong. If Dubai does that across 33 entities, the useful export will not be a city-sized demo. It will be a public operating manual for knowing when an agent may help, when it must stop and who remains responsible when the paperwork starts moving by itself.