Making dense systems legible to an ordinary citizen

Civic systems share a hard property: trust is the product. Whether you’re helping a citizen understand a law or letting them participate in a decision, a single unverifiable claim or a single opaque tally undoes the whole thing.

What we walked into

Two flavours of the same problem. On one side, legal corpora are vast, dense, and high-stakes — a confidently wrong answer about someone’s rights is worse than no answer. On the other, civic participation has to be both private and verifiable — people must be able to trust the count without trusting the operator. Both are multilingual, multi-tenant, and full of personal data that mustn’t leak.

What we did

1. Citizen

   question or action

3. DPI identity

   Aadhaar / DigiLocker

5. Grounded engine

   cite the section, or refuse

7. Audit trail

   verifiable record

9. Response

   in their language

For legal intelligence, we used citation-enforced retrieval: every answer points to the exact provision it rests on, and the system refuses rather than guesses. For participation, we leaned on verifiable records — outcomes anyone can audit without having to trust us. Identity comes from digital public infrastructure (Aadhaar, DigiLocker, Account Aggregator) rather than a bespoke silo, and everything is multi-tenant and multilingual from the start.

What made it work

• Citation-enforced answers — grounded in authoritative text, or no answer at all.
• Verifiable by design — outcomes and tallies anyone can independently check.
• DPI-native identity — trusted rails citizens already use, not a new honeypot.
• Multi-tenant, multilingual — one platform, many jurisdictions and languages.
• Sovereign — citizen data stays on infrastructure the public body controls.

Why we built it this way

When trust is the product, the architecture has to manufacture trust: citations make claims checkable, audit trails make outcomes verifiable, and refusing to guess is a feature. DPI identity avoids building yet another sensitive credential store. Multilingual, multi-tenant design is what lets the same system serve a whole country instead of one pilot. And sovereignty is the precondition — civic data is exactly the data that must never leave.