Digital Public Infrastructure
for Municipal Innovation

Cities produce a significant amount of policy and programme guidance that never fully reaches the people it is meant to serve. Not because it is poorly designed, but because the gap between writing a policy and implementing it consistently is wide and largely invisible. Whether a rule is applied depends on who is working that day, how they read the relevant document, and whether they have access to the right information at the right time. The same policy can be applied differently across districts, departments, or teams with no mechanism for the city to know. By the time the inconsistency surfaces, through a resident complaint, an audit, or press coverage, the people the policy was written for have already missed out.

Policy and programme logic is made explicit: written out as structured, human-readable rules that both staff and systems can read, test, and verify. When a defined condition is met, the corresponding response is initiated and every action is timestamped and logged. This is not autonomous decision-making. Staff retain full oversight and the ability to intervene at any point, and decisions that require human judgement remain with humans. What changes is that the routine, rule-based layer of implementation no longer depends on the right person being available or interpreting the document correctly. Because the logic is explicit, it can be tested before a policy goes live, audited after the fact, and updated with confidence when policy changes. The implementation gap becomes visible and manageable for the first time.

Cities rely on hundreds of nonprofit and private providers to deliver critical services to residents, from after-school programmes and meal delivery to shelter and healthcare. Tying payment to measurable outcomes and milestones is a reasonable way to strengthen accountability for that spending. In practice, it creates a significant manual burden: city staff must collect evidence, reconcile milestones against documentation, prepare approval packages, chase incomplete submissions, and route payment across multiple stages for every contract. The result is that providers who have already delivered services wait months to be paid, while staff spend time on compliance administration instead of oversight. Smaller nonprofits, which often have no capital cushion to absorb delays, are disproportionately affected, sometimes taking out loans at unrecoverable cost just to keep operating while a payment works its way through the approval chain.

Contract milestones and payment conditions are encoded upfront as structured, verifiable checks. When a provider submits documentation, the system validates it against the contract criteria automatically and either routes payment for authorisation or flags the gap for human review. A milestone met triggers payment. A milestone missed triggers a review. Staff remain in control of oversight decisions, but the routine compliance work, the chasing, the reconciling, the packaging, happens without manual handling. Every submission, verification, and payment action is timestamped and logged, creating an audit trail that is available to the city, the provider, and where appropriate, the public.

Every interaction between a resident and their city requires proving something: residency, eligibility, enrolment status, age, address, or qualifications. Today, proving any one of these facts means over-sharing, handing over a full document that contains far more personal information than the interaction requires, and repeating the same process with every department, programme, and service. The city must also develop processes to collect, store, and check this data, along with the data protection obligations that come with it. This creates friction for residents and an expanding store of sensitive data that the city is responsible for protecting. As AI-generated synthetic identities and deepfake documents become easier to produce, the documents cities currently rely on for verification are also becoming easier to forge.

A city-issued digital credential that a resident holds and controls, which can prove specific facts, "lives in this jurisdiction," "is over 18," "is enrolled in programme X", without revealing any information beyond what that specific interaction requires. Sign up once through a standard city portal, verify identity through existing processes, and from that point forward every city service can confirm what it needs to know without the resident handing over a document and without the city collecting data it does not need. The underlying cryptography, zero-knowledge proofs, enables selective disclosure: the ability to prove a fact without exposing the data behind it. Data minimisation becomes a technical property of the system rather than a policy goal that depends on staff compliance.

City departments hold information about residents across health, housing, income, benefits, and education, but this data is siloed across agencies with different systems and legal frameworks. Those frameworks exist for good reason: they were designed to prevent the creation of centralised databases and protect resident privacy. The problem is that until now, the only way for one agency to act on what another agency knows was to transfer the underlying data, which triggered the full weight of data sharing legislation and could take months or years to negotiate for a single data element. Without a technical alternative, the privacy protections that were meant to protect residents have also made it harder for those residents to access the services they are entitled to.

Zero-knowledge cryptography allows one agency to verify a specific fact held by another, such as whether a resident's income falls below a programme threshold, without the underlying data ever leaving the originating system. No record is transferred. No centralised database is created. The receiving agency gets a confirmation of the fact it needs, nothing more. Because no data moves between organisations, the traditional data sharing agreement is not triggered, though appropriate governance and consent frameworks still apply. This is a technical solution to a problem that has previously only had legal and administrative workarounds.

Cities issue thousands of permits, licences, and certifications every year covering everything from food handler qualifications and trade licences to building permits and health inspection certificates. Verifying any of these outside the issuing department currently means a phone call, an email, or a manual database lookup, and the answer is only as reliable as the person on the other end. Fraudulent or expired credentials circulate because there is no way for a recipient to check status independently. When a licence is revoked, existing copies held by third parties remain in circulation with no mechanism to invalidate them.

Every permit, licence, or certification issued by a city becomes a verifiable digital credential that any authorised party can check instantly and independently, without contacting the issuing body. The key operational difference from a digital PDF or database record is revocation: when a licence expires, is suspended, or is revoked, all copies are invalidated simultaneously. A third party checking the credential gets a live status, not a snapshot from the day it was printed. The verification process confirms only the relevant fact, that the credential is currently valid, without exposing any personal data beyond what the recipient is entitled to see.

Keeping a public park or square functional involves a significant amount of coordination, inspection, reporting, and reactive work that residents never see and that city staff have no easy way to make visible. Work orders are logged in disconnected systems, informal maintenance contributions from residents or local organisations go unrecorded, and the condition of an asset at any given moment is difficult to establish without a site visit. When budget conversations happen, the labour that has been holding an asset together is largely invisible, which makes it easy to cut and hard to defend. When contractors underdeliver, there is often no clear record of what was and was not done.

A shared, verifiable record of what has been done to a public asset, by whom, and when. City staff, contractors, and community members who contribute maintenance work can log activity against a specific asset, creating a timestamped and auditable history that is visible to the city and, where appropriate, to the public. Condition reports, work orders, inspections, and informal contributions all flow into the same record. This gives city departments a defensible picture of what an asset actually costs to maintain, where gaps in contractor coverage are occurring, and what community activity already exists that the city is currently not capturing or coordinating.