Who can act for whom: authorisation in Australia's digital identity system

Mixed-methods research for the Digital Transformation Agency on how people and businesses authorise others to act for them, and the models that came out of it.

Presenting research findings to a workshop of public servants, with a participant's words on screen

The workshop I co-facilitated after presenting the research at Parliament House. The quote on screen is from Paula (not her real name), whose story is told below.

The question

When the Australian Government built Govpass, its digital identity system, it had to decide how one person could act on behalf of another: a bookkeeper for a business, an employee for a charity, a carer for a parent. Get this wrong and people are either locked out of services they are entitled to use, or exposed to fraud. The question was how authorisation actually works in people’s lives and businesses, and what government should design for.

This was new ground. The Australian Government had never built a digital identity solution for the whole of government, so there was no existing evidence on how authorisation should work in one.

Context

The work sat within the Digital Transformation Agency’s Digital Identity Program. It ran as two pieces of research. The first, which began in May 2018, looked at individuals acting on behalf of other individuals. The second, the Business Authorisation Discovery, looked at how businesses authorise representatives to deal with government, and reported in August 2018.

Digital identity only delivers value if government services take it up. Without agencies on board, it offers nothing in itself. So the needs of agencies mattered as much as those of customers, and each agency had its own drivers, just as customers did. Any solution had to weigh both, and the findings had to hold up for many agencies at once. We reviewed our approach with subject matter experts from the ATO, the Department of Industry, Innovation and Science, the Department of Education and Training, the Department of Social Services, and the Department of Human Services.

What we did

Open questions first, then confirmation at scale. Because the space was new, the interviews started with broad, open-ended questions, so we understood the territory before deciding what mattered. That approach is thorough but resource-intensive, so we then confirmed the findings with large surveys to check how widely they held. For the business research we interviewed 48 people (21 business owners and 24 authorised representatives, and 3 people who were both) across six states, in urban, regional, and remote locations, then surveyed 180 business owners and representatives. Across both studies, the research covered 110 interviews and over 300 survey participants.

I wrote the recruitment screener and the facilitation guide, so every session reached the right people and collected the same information. I then organised and ran the research sessions, collected the data, and did the statistical analysis of the survey results.

Frameworks for analysis. We analysed the findings using jobs to be done, behavioural economics, life event journey mapping, and the customer forces canvas, and mapped them to the stages of a business’s life.

What we found. Four findings stood out.

Businesses don’t think of themselves as “authorising” anyone. They get help to do the work, and who can do what follows from people’s roles and the hierarchy of the business.
People knowingly share log-in credentials, or deal with government with no formal authorisation at all, and see little risk in doing so. As one representative put it: “NDIS had no record of me as a representative because I was using my manager’s account.”
Government assumes one size fits all, which rarely matches the size, structure, or way of working of an actual business.
People were split on bringing personal and business dealings with government together. They would consider it only if privacy and security concerns were addressed.

Two stories. The research was anchored in real cases. Paula represents a not-for-profit providing youth services. A former employee fraudulently applied for a $100,000 government grant in its name, and she only found out from a letter in the post. “I find it weird that there is no formal authorisation to request funding from government agencies.” Mark runs a start-up. When his business partner was removed as a director for theft, Mark still had to get that partner, by then in Spain, to approve Mark’s own access to deal with government for the business.

Names have been changed to protect participants’ privacy.

Two models

Trust/Empower/Collaborate/Instruct. The business research showed that authorisation varies on two separate dimensions. Formality is how explicitly an authorisation has to be recorded and verified. Autonomy is how much latitude government gives a business in how it meets its obligations. Together they give four kinds of relationship, each needing a different approach from government.

The authorisation model: Trust, Empower, Collaborate, and Instruct, plotted against formality and autonomy

Trust (high autonomy, low formality): low-risk, community-based activity, such as volunteers applying for a small grant to look after a local park. Formal authorisation would only add overheads.
Empower (high autonomy, high formality): specialised work with higher risk, such as licensed childcare workers. They need room to work, but with clear authorisation.
Collaborate (low autonomy, low formality): situations where best practice is not yet known, and government and business need to work it out together.
Instruct (low autonomy, high formality): high-risk, tightly regulated activity, such as importing restricted foods, where government knows the outcome and sets the process.

The model also explained the two stories. Paula’s organisation was operating in Trust when it needed Empower, and the $100,000 fraud happened in that gap. Mark needed Instruct: clear, prescriptive support to get his business back on track.

Its real value was in exposing a trade-off that usually stays hidden. A department’s natural position is to be risk-averse: the risk it worries about is fraud, so more security on authorisation always looks better. But every extra check adds friction for the people using the service, and friction leads to disengagement, which means poorer outcomes for government and for society. Seen only from the department’s side, that cost is invisible. The model puts both sides on the table, and requires executives to take an explicit position on where each kind of interaction should sit.

The trade-off also runs the other way, and Paula’s story shows it. Her organisation was harmed not by too much security but by too little: the existing system had no formal way to authorise someone to apply for funding on its behalf, so nothing stopped a former employee from doing it fraudulently. Good design decisions protect the people using a service as much as they protect the agencies running it, and here the existing system gave citizens insufficient protection. The aim was never less formality, but the right level of formality for each situation.

Capacity/Capability/Motivation. The research on individuals found three distinct reasons people need someone to act for them: they cannot act for themselves (capacity), they lack the skills or access (capability), or they would rather someone else did it (motivation). Each carries a different risk of exploitation and justifies a different scope of authority. The business research found the same pattern: representatives supply expertise a business lacks, or time it does not have.

I presented the research to around 350 senior public servants at Parliament House, as part of a whole-of-government playback. I then co-facilitated a workshop where public servants worked through what the findings meant for their own agencies. The findings were also presented within the DTA and to subject matter experts from other agencies.

Two choices shaped how we presented the work. Everyone in the room naturally saw the problem from their own agency’s side, so we used the survey results to show how competing needs had been weighed and prioritised against limited resources. And we offered the model as a framework rather than a prescription. Each agency already knew its own services and customers better than we could, so the model let each one work out which approach suited its situation.

A full room of public servants at the workshop, with a slide on sunk cost bias on screen

The workshop after the Parliament House presentation, introducing behavioural economics principles such as sunk cost bias.

What changed

DTA senior management adopted the Trust/Empower/Collaborate/Instruct model to frame inter-agency engagement on digital identity trade-offs. The Govpass program won the federal government category of the 2020 iTnews Benchmark Awards.

What still needed fixing

The research also surfaced problems that sat outside what a digital identity system could fix on its own.

Organisations often had no central record of who was authorised to act on their behalf. That left them exposed: they could not easily see, let alone control, who was dealing with government in their name. Business owners were least satisfied with knowing what their authorised representatives were doing (29%).
Systems rarely made it easy to delegate authority, for example when staff went on holiday. Workarounds, such as sharing log-ins, filled the gap and became standard business practice.

Not only has Anthony demonstrated his ability to undertake extensive user research, he is able to translate findings and recommendations to senior executive leading to actionable results.

Jonathon Thorpe, Head of Digital Identity and Assistant Secretary, Digital Transformation Agency