Large-scale citizen services platform

A high-volume citizen services platform has to move public money to the people entitled to it, at peak demand, without paying out to those who are not. The default pattern — pay first, audit later — treats fraud as something to detect after the fact. At population scale, after the fact is too late: the money is gone and the audit is a report on a loss.

The reason the default persists is that it is easier to build. Verifying first means the gate has to be fast enough to sit in front of every claim during the weeks when the whole population applies at once, and correct enough that a wrongly refused citizen has somewhere to go. Auditing later moves both of those costs off the engineering team and onto the people the scheme exists for.

The design inverts the usual order. Verification happens before disbursement, not after it, so eligibility is a gate rather than a post-mortem. And every approval is written to an append-only record — a decision, once made, cannot be quietly altered, which is what makes the system answerable to the public bodies that depend on it.

• Verification before disbursement — eligibility checked before money moves, not reconciled afterwards.
• An append-only record of every approval, so the decision trail cannot be rewritten.
• A high-volume architecture sized for peak-season demand rather than the average day.

Were it to proceed, it would run on the same pipeline as our delivered work: agents generate the predictable volume, senior engineers own the architecture and the code that decides who gets paid. On a public-money system, the verification and audit paths are exactly the parts that sit behind a human sign-off gate.