Public-Sector Agents: Procurement, FOIA, And The Government Buyer's Trust Checklist

TL;DR

Government procurement is the most constraining buyer environment in the world. The Federal Acquisition Regulation runs to thousands of pages, state and local equivalents add their own layers, and the entire system is constructed to ensure that public funds purchase auditable products from accountable vendors. AI agents do not naturally fit this system. They are not a product in any traditional sense, their behavior is non-deterministic, their developers cannot warrant specific outputs, and their decisions are typically opaque to the kind of inquiry that congressional oversight committees and state auditors run. The fix is not to keep agents out of government — the operational and citizen-service value is too large to refuse. The fix is to deploy agents under pacts that encode statutory and procurement obligations as machine-checkable constraints, to publish trust-oracle records that government buyers can verify before procurement, and to maintain audit trails that survive Freedom of Information Act inquiries with the cryptographic integrity that government auditors actually want. This post lays out the procurement framework, the FOIA mechanics, the pact clauses that satisfy both, and the trust checklist a government buyer should run before hiring an agent.

Introduction: The Unemployment Insurance Story That Should Have Been Predictable

A mid-sized state unemployment insurance agency — call them State X, though that is not the real name — deployed an LLM-driven case-screening agent in early 2025. The agent's job was to read incoming unemployment claims, compare claimant statements against employer-provided information, identify potential fraud or eligibility issues, and route flagged cases to human adjudicators. The use case was attractive: pandemic-era claim volumes had stretched the agency's adjudication staff to breaking, the backlog had reached eight months at peak, and any technology that could reduce backlog while preserving accuracy was operationally critical.

The pilot ran for six months on roughly 240,000 claims. The throughput numbers were promising; backlog dropped from eight months to three. The accuracy numbers, measured by adjudicator agreement with the agent's flag-or-route decision, were over 91 percent. The agency's leadership recommended production rollout, and the agent was integrated into the production workflow in mid-2025.

What the pilot evaluation had not measured was the racial-disparity profile of the agent's flagging decisions. A subsequent investigation by the state attorney general's office, triggered by a complaint pattern from civil-legal-aid organizations, found that Black and Latino claimants were 2.3 times more likely to be flagged for fraud review than white claimants with materially similar claim characteristics. The flagging was not based on race directly — race was not in the input data the agent received — but the agent had learned to weight indirect proxies (zip code, employer characteristics, claim narrative phrasing) in ways that systematically disadvantaged claimants from minority communities.

The investigation produced four costly outcomes. First, a federal civil rights inquiry under Title VI of the Civil Rights Act, which prohibits federally-funded programs from disparate impact on protected classes. Second, a class-action lawsuit on behalf of wrongly-flagged claimants, with damages estimated in the tens of millions. Third, a state legislative response that imposed a moratorium on AI-driven adjudication decisions across all state agencies pending a comprehensive review framework, which in practice prevented the agency from deploying any new AI capability for eighteen months. Fourth, the firing of the agency director and the chief information officer, both of whom had championed the project.

The state attorney general's investigation, which I have read in redacted form, was unsparing in its critique. The agency could not produce evidence of how the agent made decisions because the audit logs captured only the input claim and the output flag, not the agent's reasoning or the input features the agent weighted heavily. The agency could not produce evidence that the agent had been tested for disparate impact because the procurement contract had not required disparate-impact testing and the vendor had not performed it. The agency could not produce evidence of pre-deployment review because the agent had been categorized as a tool augmentation rather than a decision-making system requiring formal review. Every diligence question the investigators asked produced an unsatisfying answer, and the cumulative effect was a finding of administrative failure that ended careers and constrained the agency for years.

The agency's general counsel later told me, off the record: "We did not have a procurement framework that contemplated AI as a decision-making system. We did not have an audit framework that captured the right evidence. We did not have a vendor-diligence framework that asked the right questions. The agent itself was not the failure. The procurement and oversight infrastructure around the agent was the failure. We bought an AI system the way we would buy a software license, and we got an outcome that the software-license framework was not designed to prevent."

This is the operating reality of public-sector AI deployment in 2026. The procurement systems were built for static products. The oversight systems were built for human decision-making. The transparency requirements were built for paper records. None of these systems extends cleanly to AI agents, and the agencies that try to deploy agents within the existing infrastructure produce outcomes that political and judicial systems will not tolerate. The fix is to redesign agent procurement around pacts that encode statutory and procurement obligations as machine-checkable constraints, audit trails that satisfy FOIA-style inquiry with cryptographic integrity, and trust-oracle publication that lets buyers verify agent properties before procurement. That stack is what this post is about.

Section One: The Federal Acquisition Regulation Framework And Where Agents Break It

The Federal Acquisition Regulation (FAR) governs the federal government's $700 billion annual procurement spend. The FAR's central principles are competition, fair dealing, and accountability — every contract must be competitively awarded where practical, every vendor must meet defined responsibility standards, every contract must be auditable for performance against terms.

The FAR's vendor-responsibility framework, codified at FAR Part 9, requires contracting officers to determine that prospective contractors have adequate financial resources, satisfactory record of integrity, satisfactory record of performance, necessary technical capability, and satisfactory record of compliance with applicable law. This determination is performed at vendor level for traditional procurement (does this company have the resources and track record to fulfill the contract). When the contract is for an AI agent's services, the responsibility determination has to extend to the agent itself, and traditional procurement infrastructure does not have the tools to perform this determination.

The FAR's performance framework, codified at FAR Part 46 (quality assurance) and FAR Part 49 (termination), requires that the contracting agency monitor performance against contractual standards and that the agency have remedies available when performance falls short. Standard remedies — withholding payment, requiring rework, terminating for default — assume a vendor with continuous responsibility for the deliverable. When the deliverable is an AI agent operating autonomously, the question of who bears responsibility for performance shortfalls becomes muddled. The vendor delivered the agent; the agent's behavior in production is the agent's behavior, not the vendor's continuing action. Standard contract remedies have no clean application.

The FAR's recordkeeping framework, codified at FAR Part 4 and supplemented by agency-specific records management requirements, requires that contracting actions and performance evidence be retained for defined periods (typically 6 to 10 years for most contract types). When the deliverable is an AI agent producing thousands of decisions per day, the recordkeeping volume becomes substantial. More importantly, the records that traditional contract management produces (purchase orders, invoices, receipt-and-acceptance documents) are not the records that agent oversight requires (per-decision audit logs, behavior consistency metrics, drift indicators, pact-compliance reports). Agencies must build new records categories that the FAR's records-management framework can absorb.

The FAR's small-business and minority-business preference frameworks add another wrinkle. Procurement set-asides require that vendors meet specific size, ownership, and certification standards. AI agents are typically not vendor entities — they are tools deployed by vendors that may or may not meet preference standards. The agency procuring an agent must determine which vendor is the responsible party for set-aside purposes (the agent's developer, the cloud-infrastructure provider, the integrator, the operator), and the answer is not always obvious. This is an unresolved legal question in federal procurement and most state equivalents.

The practical consequence is that federal procurement of AI agents is currently operating under improvised guidance from individual contracting officers, with each agency developing its own approach. The General Services Administration has published draft guidance, the Office of Management and Budget has issued Memorandum M-24-10 on responsible AI use, and various agency-specific policies have emerged. None of these is a complete framework. All of them assume some version of vendor-responsibility carrying through to agent behavior, but none of them specifies the operational mechanism for verifying that the carry-through actually works.

The pact-and-oracle stack provides the operational mechanism. The agent's pact encodes the procurement-relevant obligations (performance standards, behavior constraints, audit-trail requirements, data-handling rules) as machine-checkable clauses. The trust oracle publishes the agent's certification status, composite score, and bond standing, which contracting officers can query as part of responsibility determination. The audit trail satisfies the recordkeeping framework with structured per-decision evidence. The bond provides a remedy mechanism for performance shortfalls that traditional contract remedies do not. The mechanism is not a regulatory replacement; it is the operational substrate that makes the regulatory framework workable for agent procurement.

Section Two: The FOIA Mechanics And What Auditors Actually Request

The Freedom of Information Act, codified at 5 U.S.C. Section 552, establishes a public right of access to federal agency records, with state equivalents providing similar access at the state and local level. The substantive bar is presumption of disclosure: agency records are presumed disclosable unless they fall under defined exemptions (national security, personal privacy, business confidentiality, deliberative process, etc.). The procedural mechanism is request-and-response: a requester submits a request, the agency searches its records, the agency produces responsive records subject to applicable exemptions, and disputes proceed through administrative appeal and federal court.

The FOIA system has been functional, if slow, for decades when the records sought are paper documents, emails, and structured database records. It strains under AI agent records for three reasons. First, the volume of agent-generated records can be massive (thousands of decisions per day, each potentially a record), and agencies struggle to produce timely responses to broad requests. Second, the records typically include both decision evidence (the application, the decision, the disposition) and reasoning evidence (the agent's tool calls, intermediate analyses, alternatives considered), and the question of which categories constitute responsive records is contested. Third, the records often touch deliberative-process exemption questions because the agent's intermediate analyses arguably constitute deliberative material that the exemption protects from disclosure.

The agencies that deploy agents without contemplating FOIA produce two failure modes. Either they produce too little (responding only with the input-output records, which generates appeals and judicial findings that the agency must produce more), or they produce too much (responding with the full agent reasoning trace including proprietary system prompts, which generates vendor litigation and trade-secret arguments). Neither outcome is good. Both outcomes invite legislative responses that constrain the agency's future agent operations.

The correct architecture treats FOIA as a design constraint from the first commit. The audit trail is structured into distinct records categories: (a) input records — the data the agent received, which are typically subject to disclosure with personal-privacy redactions; (b) decision records — the agent's outputs and the dispositions, which are typically subject to disclosure; (c) pact-compliance records — the clauses authorizing each decision, which are typically subject to disclosure as they evidence agency policy; (d) reasoning records — the agent's internal analysis, which may be subject to deliberative-process exemption depending on agency policy; (e) system records — the agent's prompt template and runtime configuration, which are typically subject to vendor-confidentiality protection.

Each category has a defined disclosure default and a defined redaction mechanism. When a FOIA request arrives, the agency's response process applies the appropriate disclosure default to each category and the appropriate redaction mechanism to the categories that require it. The structure means responses can be produced at agent volume because the categorization and redaction are systematic rather than per-record human review.

The cryptographic integrity of the audit trail is independently valuable in FOIA contexts. The requester or a court reviewing the agency's response can verify that the records produced are complete and have not been modified after the fact. The Merkle-root publication to the trust oracle creates a tamper-evident timestamp that defeats the most common FOIA evasion (modifying records before production). The agency benefits from this because it removes the inferential attacks that plaintiffs use to allege spoliation when records are inconsistent or incomplete.

The vendor-confidentiality question deserves special attention. AI agent vendors typically consider their prompt templates, runtime configurations, and training methodologies to be trade secrets. Government buyers cannot accept vendors' assertions that all of these are categorically exempt from FOIA — the courts have been increasingly skeptical of broad vendor-confidentiality claims when the records relate to government decision-making. The pragmatic resolution is that pacts and audit trails are agency records subject to FOIA, while underlying model weights and detailed training data may be vendor-protected. The pact itself, being a contractual document between agency and vendor, is essentially a procurement record and should be presumed disclosable. Vendors that refuse to deploy agents under FOIA-disclosable pacts should not be selected for government procurement, full stop.

Section Three: The Government Buyer's Diligence Framework

Government buyers performing diligence on an AI agent before procurement should run a defined sequence of checks, each anchored in a specific regulatory or operational requirement. The framework I have seen work in practice has eight elements.

First, vendor responsibility verification under FAR Part 9 (or state equivalent). The contracting officer verifies the vendor's financial resources, integrity record, performance record, and technical capability. For AI agent procurement, this extends to verification that the vendor has the engineering capability to maintain the agent's pact compliance, has demonstrated the ability to operate similar agents in similar environments, and has the financial resources to back the bond and maintain the pact through the contract period.

Second, agent-specific responsibility verification. The contracting officer queries the trust oracle for the agent's certification status, composite score, bond standing, and pact-compliance history. The composite score's twelve dimensions provide structured evidence across accuracy, reliability, safety, scope-honesty, and other properties relevant to government use. The bond standing demonstrates that the vendor has economic exposure to the agent's behavior. The pact-compliance history demonstrates that the agent has operated within stated constraints in prior deployments.

Third, statutory and regulatory mapping. The contracting officer (with legal counsel support) maps the agent's intended use against the statutes and regulations that govern the use. For an unemployment-insurance screening agent, this includes the unemployment insurance statute, the state administrative procedure act, federal civil rights laws, and federal Title VI requirements. The pact must encode the obligations from each, with explicit clauses for each statutory requirement.

Fourth, disparate-impact testing. The contracting officer requires the vendor to provide evidence of disparate-impact testing across protected characteristics relevant to the use. For an unemployment-insurance screening agent, this includes race, ethnicity, national origin, age, sex, disability, and veteran status. The testing methodology must be independent (not vendor self-attestation), the results must be quantitative, and the testing must be repeated periodically through the contract period. The pact includes clauses requiring the vendor to maintain the testing cadence and to remediate identified disparities.

Fifth, audit-trail verification. The contracting officer verifies that the audit-trail format satisfies the agency's records-management requirements, the cryptographic integrity properties satisfy the agency's evidence-integrity requirements, and the FOIA-disclosability defaults align with the agency's transparency policies. The vendor demonstrates the audit trail through a trial run on synthetic or representative data.

Sixth, performance-monitoring framework. The contracting officer requires the vendor to provide performance metrics on a defined cadence, with the metrics directly tied to pact-compliance and statutory-compliance obligations. The framework must support continuous monitoring rather than periodic point-in-time review, because agent behavior can drift in ways that periodic review will miss.

Seventh, termination and remediation rights. The contract specifies termination conditions (pact-compliance score below threshold, statutory-compliance violations, disparate-impact testing failures), remediation rights (vendor obligation to fix identified issues within defined timeframes), and bond-recovery mechanism (under what conditions the bond is slashed and how the slashed proceeds flow). These rights make the procurement framework's accountability principles operational rather than aspirational.

Eighth, public transparency. The contract specifies what categories of agent-related information the agency will publish proactively (procurement records, performance metrics aggregates, disparate-impact testing results), what categories the agency will produce on FOIA request (per-decision records, pact-compliance records), and what categories the vendor may protect under trade-secret provisions (model weights, training data details). The transparency framework is determined at contract inception, not at first FOIA request, which removes an entire category of dispute that has plagued early agent deployments.

This eight-element framework is more rigorous than the standard procurement diligence for software products. It is appropriate to the higher stakes and broader public interest in agent procurement. Agencies that develop this framework once can apply it across procurement, with the procurement-specific tailoring being a matter of slotting in the use-specific statutes and obligations. The first procurement using the framework is expensive in terms of process; subsequent procurements amortize the framework cost.

Section Four: The Pact Clauses Specific To Public-Sector Use

A pact for a public-sector agent differs from a private-sector pact in eight categories of clause. Statutory-compliance clauses encode the specific statutory obligations the agent operates under, by reference to the statutes themselves and with deterministic checks for the operational provisions that can be checked at action time. The clauses must be revisable through a defined process when statutes change, with the revision process being part of the contract.

Disparate-impact clauses encode the agent's obligations under civil rights laws and state non-discrimination statutes. The clauses include affirmative testing obligations (the vendor must perform testing on a defined cadence with a defined methodology), threshold obligations (the agent's behavior must not exceed defined disparate-impact thresholds for protected characteristics), and remediation obligations (when thresholds are exceeded, defined remediation actions must be taken within defined timeframes).

Transparency clauses define the agent's audit-trail format, the FOIA-disclosability defaults for each category of audit record, and the proactive-publication obligations the agency commits to. The clauses must be drafted with sophisticated FOIA understanding, including treatment of deliberative-process exemption, vendor-confidentiality protection, and personal-privacy redaction. Many early public-sector agent deployments have stumbled here because the procurement teams treated transparency as an afterthought rather than as a design constraint.

Due-process clauses define the agent's obligations when its decisions affect individuals' rights or benefits. Most public-sector agent decisions implicate due-process under the Fifth Amendment (federal) or Fourteenth Amendment (state action), particularly when the decisions affect protected interests like unemployment benefits, public housing, public-benefits eligibility, or licensure. The clauses include adverse-action notice requirements (when the agent's decision is adverse to an individual, the individual must receive notice of the decision, the basis for the decision, and the appeal rights), explainability requirements (the explanation must be sufficient to enable meaningful appeal), and human-review requirements (defined categories of decisions must include human-decision-maker involvement, regardless of the agent's recommendation).

Procurement-integrity clauses define the agent's obligations to avoid conflicts of interest, fair dealing, and improper influence. For an agent that participates in procurement decisions (evaluating proposals, scoring vendors, etc.), the clauses include conflict-disclosure obligations, fair-evaluation obligations, and audit-trail obligations supporting subsequent protest review.

Record-management clauses define the agent's obligations under federal and state records-management laws. These laws define what constitutes a public record, how long records must be retained, what destruction processes are permitted, and what transition obligations apply when systems are migrated or vendors change. Agent-generated records must fit cleanly into these frameworks, with the pact specifying retention periods, destruction processes, and transition handling.

Security clauses define the agent's obligations under federal security frameworks (FedRAMP for federal cloud-hosted systems, FISMA for federal information systems) and state equivalents. The clauses include continuous-monitoring obligations, incident-response obligations, and compliance-attestation obligations specific to the agent's behavior in addition to the underlying infrastructure.

Procurement-preference clauses define the agent's obligations under set-aside and preference frameworks (small business set-aside, woman-owned business preference, veteran-owned business preference, etc.). The agent's behavior must not discriminate against preferred vendor categories in ways that the procurement framework prohibits, and the audit trail must support the analysis that demonstrates compliance.

A well-drafted public-sector pact runs to several hundred clauses across these eight categories. This is more substantial than typical private-sector pacts because the public-sector regulatory perimeter is broader and the consequences of clause gaps are more severe. The investment in pact drafting is appropriate to the stakes.

Section Five: The Bond In The Public-Sector Context

Public-sector contracting traditionally uses performance bonds, payment bonds, and bid bonds (under the Miller Act for federal construction and various state equivalents). These instruments protect the government against contractor default in defined ways. They do not naturally extend to AI agent behavior because the failure modes are different.

The pact-bound bond for a public-sector agent serves a similar economic function with different operational properties. The bond is sized to cover the realistic damages from material pact violations over a defined period, with the sizing approach varying by use. For an unemployment-insurance screening agent, the bond might be sized to cover the litigation and remediation cost of a disparate-impact finding, plus the agency's reputational and operational cost of a compliance failure. For a procurement-evaluation agent, the bond might be sized to cover the cost of re-running protested procurement actions plus litigation costs.

The slashing condition for a public-sector agent bond is typically tied to formal findings rather than just to pact-violation events. A determination by the agency, by an inspector general, by a court, or by an oversight body that the agent's behavior produced statutorily-cognizable harm triggers the slashing process. The process includes notice to the vendor, an opportunity to respond, and a defined determination procedure before the bond is slashed. This is more procedurally rigorous than the private-sector bond architecture and reflects the due-process obligations that government action carries.

The slashing proceeds typically flow to the affected parties (in disparate-impact cases, to the harmed claimants or to a remediation fund), with a portion to the contracting agency for remediation costs. The flow is specified in the contract and the pact, with the determination of affected parties and remediation amounts governed by the same procedures the agency uses for traditional contractor-default situations.

The regulatory question of whether the bond is treated as a performance bond, a fidelity bond, or a new category specific to AI agents is unresolved. Federal contracting officers have begun treating the bond as a contractual remedy specific to the AI agent contract rather than as a regulated bond instrument, which simplifies the administrative process. State approaches vary. The eventual regulatory clarification may align bond treatment with traditional categories, but in the interim the contractual-remedy approach is workable.

The broader market consequence is that vendors with strong agent track records can post smaller bonds than vendors with no track record, creating a market incentive for vendors to maintain clean operational records. This aligns vendor incentives with government interests in a way that traditional procurement bonds do not, because traditional bonds are sized at fixed percentages of contract value rather than scaled to risk.

Section Six: The State And Local Variations That Complicate Things

The federal procurement framework is consistent across federal agencies (with agency-specific supplements). State and local procurement frameworks vary enormously. Some states have enacted comprehensive AI-procurement statutes (Colorado, California, and a handful of others have led here). Most states are working under traditional procurement frameworks supplemented by executive-branch guidance. Many local governments are working under whatever the state framework provides, often without the resources to develop local AI-specific guidance.

The variations matter for vendors selling agents into the public sector. A vendor must produce procurement documentation that satisfies the most rigorous state framework it operates in, then map that documentation to the requirements of less rigorous frameworks. The pact-and-oracle stack supports this because the pact and audit trail are designed to be the most rigorous version, with the trust oracle publication exposing the relevant subset of properties to each procurement environment.

Specific state variations to be aware of include: California's Senate Bill 53 (passed 2024) requires impact assessments for state AI procurement involving consequential decisions; Colorado's Senate Bill 24-205 imposes specific obligations on developers and deployers of high-risk AI systems including disparate-impact testing; New York City's Automated Employment Decision Tool law requires bias audits for AI used in employment decisions; Illinois's Artificial Intelligence Video Interview Act requires specific disclosures and consents for AI used in candidate screening. Each of these creates specific obligations that pacts must encode for agents operating under the relevant law.

The federalist pattern means that vendors will increasingly find themselves operating under the most-restrictive-applicable-framework rule, with the pact encoding the union of obligations across all jurisdictions where the agent operates. This is more onerous than operating under a single national framework would be. It is the operational reality of selling into a federalist procurement environment, and the agencies that lead with rigorous frameworks effectively define the floor that vendors must meet.

Section Seven: The Failure Modes That Procurement Officers Most Underestimate

Four failure modes recur in early public-sector agent deployments. The first is the surface-area-creep failure, where an agent procured for a narrow use is gradually expanded to additional uses without separate procurement and pact updates. The original procurement was based on a defined use; the expanded use may not satisfy the procurement framework, may not have appropriate disparate-impact testing, may not have appropriate due-process protections. The defense is governance: a defined process for use expansion that triggers procurement review, pact update, and re-evaluation before the expansion proceeds.

The second failure mode is the third-party-data failure, where the agent ingests data from external sources that the agency's procurement did not contemplate. The data may be incorrect, may be biased, may be obtained through means that violate the agency's data-handling obligations. The agent's behavior may be entirely pact-compliant on the data it receives, while the data itself is the source of the problem. The defense is data-governance integration: the pact includes clauses defining permitted data sources and data-quality requirements, and the agency's data-governance function reviews and approves data sources before they are integrated.

The third failure mode is the public-perception failure, where the agent's behavior is technically defensible but politically toxic. An immigration-enforcement agent that operates within statutory authority but produces outcomes that the public finds unacceptable creates political pressure that constrains the agency regardless of the agent's technical compliance. The defense is communications: the procurement and deployment process must include public-engagement steps that surface political concerns before deployment, and the pact must include clauses that address those concerns where they relate to the agent's operational behavior.

The fourth failure mode is the legislative-response failure, where a problematic agent deployment triggers legislative action that constrains the agency more broadly. The State X case illustrates this: a single problematic deployment produced an eighteen-month moratorium on AI deployment across all state agencies. The defense is two-layer: rigorous deployment processes that prevent the problematic deployment in the first place, and active engagement with legislative oversight bodies before deployment to align expectations and avoid surprises.

The meta-failure underneath all four is treating procurement as an event rather than as an ongoing relationship. An event-based procurement is structured around the contract award; the parties' obligations end when the contract terminates. An ongoing-relationship procurement is structured around continuous engagement, with both parties having obligations that extend through the agent's operational life and into transition. Public-sector agent procurement requires the ongoing-relationship framing because the agent's behavior is a continuous public concern, not a one-time delivery.

Reader Artifact: The Government Buyer's Agent Procurement Checklist

What follows is the pre-procurement and procurement-execution checklist for a government buyer evaluating an AI agent. The checklist is structured by the eight diligence elements described earlier, with specific verification questions and evidence requirements for each.

Element 1: Vendor Responsibility. Verify financial resources sufficient to maintain the agent through the contract period and to back the bond. Verify integrity record through the System for Award Management (SAM) and equivalent state systems. Verify performance record on similar agent deployments through reference checks and trust oracle queries. Verify technical capability through review of the vendor's engineering practices, agent-development methodologies, and operations team.

Element 2: Agent Responsibility. Query the trust oracle for the agent's certification tier. Review the composite score across the twelve standard dimensions. Verify the bond standing, including the bond size, the bond instrument, and the slashing-condition documentation. Review the pact-compliance history including any prior pact violations and their remediation.

Element 3: Statutory Mapping. Identify the statutes and regulations governing the agent's intended use. Verify that the pact includes clauses for each statutory obligation. For obligations that the pact cannot encode as deterministic checks, verify that the agent's evaluation framework includes the obligation as an evaluation criterion.

Element 4: Disparate-Impact Testing. Require the vendor to provide independent disparate-impact testing across protected characteristics relevant to the use. Review the testing methodology for rigor. Review the testing results for material findings. Require ongoing testing on a defined cadence as a contract obligation.

Element 5: Audit Trail. Review the audit-trail format against the agency's records-management requirements. Verify the cryptographic integrity properties. Review the FOIA-disclosability defaults. Run a trial of the audit trail on synthetic or representative data to verify operational properties.

Element 6: Performance Monitoring. Require the vendor to provide a continuous-monitoring framework with defined metrics tied to pact-compliance and statutory-compliance. Verify that the framework supports automated alerting for material deviations. Verify that the framework integrates with the agency's existing oversight infrastructure.

Element 7: Termination And Remediation. Specify termination conditions in the contract, with the conditions tied to objective criteria (composite-score thresholds, statutory-compliance findings, disparate-impact testing results). Specify remediation rights and timeframes. Specify the bond-slashing mechanism and the flow of slashed proceeds.

Element 8: Public Transparency. Specify proactive-publication categories in the contract. Specify FOIA-disclosability defaults for each audit-record category. Specify trade-secret protection scope (if any) for vendor-confidential information. Verify that the transparency framework satisfies the agency's transparency policies and applicable state and federal transparency law.

The checklist is buildable today and should be the standard diligence framework for any public-sector agent procurement of consequence. Agencies that adopt the checklist will produce procurement records that satisfy oversight inquiry, pact frameworks that satisfy statutory and regulatory obligations, and operational discipline that prevents the failure modes that have characterized early deployments.

Counter-Argument: "This Slows Procurement To A Crawl"

The strongest counter-argument I hear from public-sector procurement officials is that this framework slows procurement to a pace that is incompatible with operational urgency. State X needed the unemployment-screening agent to address an eight-month backlog. Imposing a six-month rigorous procurement process would have left the backlog at twelve months by the time the agent was deployed.

The counter-argument is correct that the rigorous framework takes longer than ad-hoc procurement. It is incorrect that rigorous procurement is incompatible with operational urgency. The State X deployment took six months from procurement to production. The investigation, lawsuit, moratorium, and remediation following the deployment failure has consumed three years and counting. The total time-to-functioning-agent for State X was longer with ad-hoc procurement than it would have been with rigorous procurement, because the ad-hoc procurement produced a deployment that had to be undone.

The deeper failure of the counter-argument is in framing speed and rigor as opposed when they are complementary. A rigorous procurement framework executed efficiently can take as little as 90 to 120 days for a well-prepared agency working with a well-prepared vendor. The ad-hoc procurement that bypasses the framework produces deployments that fail and require unwinding, which is much slower than executing the framework correctly. The choice between the two is not subtle when the full lifecycle costs are considered.

The correct framing is not "can we afford the time the framework takes." It is "can we afford the cost of the failures that the framework prevents." An agency that processes one or two agent procurements per year using the rigorous framework can deploy capable agents on 90-day cycles and avoid the catastrophic-failure cost. An agency that bypasses the framework will deploy faster initially but will spend years recovering from the resulting failures. The framework is not regulatory excess. It is the operational discipline that makes agent procurement actually work for government use.

What Armalo Does Here

Armalo provides the trust layer for agents operating in regulated public-sector environments. The pact framework lets agencies and vendors encode statutory, regulatory, and procurement-framework obligations as machine-checkable clauses across all eight required categories. The Trust Oracle (queryable at /api/v1/trust/) lets contracting officers verify the agent's certification status, composite score, and bond standing as part of vendor and agent responsibility determination, supporting the diligence framework with real-time evidence rather than vendor self-attestation. The composite score, computed across twelve dimensions by a multi-LLM jury that trims top and bottom 20 percent of judgments, provides structured evidence of agent properties relevant to government use including accuracy, reliability, safety, and scope-honesty. The on-chain bond, settled in USDC on Base L2, provides a remedy mechanism for performance shortfalls that traditional procurement bonds do not, with slashing tied to formal findings and procedural protections appropriate to government action. The audit trail, cryptographically chained and publishable to the oracle as Merkle roots, satisfies federal and state records-management requirements with the integrity properties that government auditors and FOIA respondents actually need. Armalo does not replace the agency's procurement system, oversight infrastructure, or operational systems. It provides the substrate those systems integrate with so that agent activity is verifiable, accountable, and FOIA-resilient in a way that meets the bar government use must meet.

FAQ

How do we handle classified or controlled-unclassified-information uses? The pact and audit-trail framework adapts to these environments with the trust-oracle publication being an internal trust oracle rather than the public oracle. The Department of Defense and the intelligence community have begun working on classified-environment trust oracles that operate behind the relevant security perimeters with the same operational properties as the public oracle. Vendors operating in these environments need authorization at the appropriate level for both the agent and the trust-oracle infrastructure.

What happens when our state's AI procurement law changes mid-contract? Most well-drafted contracts include change-in-law provisions that trigger renegotiation when applicable law changes materially. The pact-update mechanism described in this post is designed to accommodate change-in-law triggers, with the pact revision process running parallel to the contract renegotiation. Vendors should expect change-in-law provisions to be standard in public-sector AI contracts.

Can we use existing GSA schedules for AI agent procurement? Yes, with appropriate task-order specifications. The GSA has been adding AI-specific provisions to its IT schedules, and several specialty schedules now include AI agent categories. Task orders under these schedules should include the pact, bond, audit-trail, and oracle-publication requirements as task-order terms even when the underlying schedule does not explicitly require them.

Who owns the audit trail when the contract ends? The contract should specify this explicitly. The most common and operationally workable approach is that the agency owns the audit trail (it is a public record), with the vendor having defined access for limited purposes (defending against claims, supporting compliance audits) for a defined period after contract termination. Vendor retention of audit trails after termination requires explicit contractual basis.

How does this interact with the Federal Risk and Authorization Management Program (FedRAMP)? FedRAMP authorization is for the underlying infrastructure (cloud platforms, hosting environments). The pact-and-oracle stack operates above the infrastructure layer and does not require separate FedRAMP authorization for the trust-oracle integration. The agent itself, depending on its hosting model, may require FedRAMP authorization for its runtime infrastructure. The pact and audit-trail integration does not change the FedRAMP analysis but does add evidence supporting the FedRAMP continuous-monitoring obligations.

Bottom Line

Government procurement of AI agents is currently operating under improvised guidance that produces predictable failures. The State X case will not be the last; it is merely the most recent. The agencies that develop rigorous procurement frameworks anchored in pacts, bonds, oracles, and audit trails will deploy capable agents that satisfy oversight inquiry, statutory compliance, and FOIA-resilient transparency. The agencies that continue with ad-hoc procurement will produce more State X cases, more legislative responses, more constraints on future deployments. The procurement framework is buildable today. The cost of building it is dwarfed by the cost of the failures it prevents. Government use of AI agents will be one of the largest deployment surfaces of the next decade, with public-benefit administration, procurement, regulatory operations, and citizen-services automation all being natural fits. The agencies that build the procurement framework correctly will deliver public value. The agencies that don't will reproduce the costliest mistakes of early adoption.