Why
Most AI agent demos stop at “it works”. Local government cannot stop there. A municipality that lets an agent touch a case file, a citizen record or a payment needs to know, afterwards and in court if necessary, which rules applied, who approved what, and that the trail was not edited. I wanted to find out what a platform looks like when evidence, not trust, is the product.
What it is
A self-hosted platform for developing, governing and running AI agents, built for gemeenten first and widened to provinces and water boards. Every agent action runs as a durable, inspectable run. All external access, to models, tools, other agents, events and people, passes through governed gateways. Policy is enforced outside the prompt, so a model cannot talk its way past it. High-stakes actions need explicit human approval before they happen; everything else is supervised on the loop, and the override rate is published as the measure of whether oversight is real. Evidence is hash-chained.
The core stays domain-neutral. Municipal logic only enters through signed, versioned capability packs, the first of which handles reports about public space.
How it was built
- More than forty recorded architecture decisions, each with its alternatives and consequences.
- A threat model that treats the platform’s own agents, and the AI agents that help build it, as adversary classes.
- A compliance library mapping the EU AI Act, including Article 14 human oversight, the GDPR, NIS2 and the Dutch government assessment frameworks to concrete controls.
- A supervised multi-agent development pipeline: AI coding agents work in lanes, every pull request is independently verified at its exact commit, and a continuously curated research base of a few thousand sources feeds the architecture digest every week.
- Thousands of commits in about three months, running as a prototype on a Kubernetes cluster in the EU.
Status
A demonstrator on a Kubernetes cluster, not a production service. No customer yet, no compliance claims. The point so far is the architecture and the evidence that it holds up.
What is proven, as of 20 October 2026: the governance spine runs (admission, policy, durable runs, approvals, evidence writing), and the evaluation code passes its own test suite in CI. What is not yet proven: the model runtime has never been armed on the cluster, so no model has been called through the platform, no model qualification has been issued, and there are no operational evaluation receipts. The first live run is blocked by a dependency the records name themselves: arming the runtime requires a qualification, and issuing a qualification requires running a live model subject. Resolving that is the next decision, and it is mine to take, because it means real provider egress and spend. I will update this page when it has happened, with the numbers.
What I learned
Governance is not a layer you add. If it is not in the runtime, in the identity model and in the evidence trail from the first commit, you will never retrofit it. And the hardest part of building with AI agents is not getting them to write code. It is deciding what they are never allowed to do, and proving that they did not.