Designing an AI-First Agentic Digital Economy for Sri Lanka

on

AI, Human Agency and the Digital Economy · Part 3 of 41

Illustration of one building-permit request travelling from a person at an empty plot, through a service counter and several agencies working in parallel, to a committee decision and a finished building. Each step is marked as a conventional rule, an AI task or a human approval.


Suppose you want to put up a small building in Colombo — a workshop behind the house, a floor for a growing business. Before anything is poured you need a development permit. The Colombo Municipal Council publishes what that takes: clearances from up to five of its own divisions and, depending on site and building, from as many as thirteen outside agencies — the Ceylon Electricity Board, the Department of Archaeology — plus the Board of Investment for BOI projects. Each is triggered by a different property of the same building: above sixty feet, civil aviation; within three hundred metres of the coast, coast conservation.

Then the clocks. The survey plan must be within ten years, the ownership certificate is valid six months, the council's published target for the decision is sixty days — a certificate that can run out before the decision it feeds arrives.

And one line in a table: "01 to 05 can be attended parallely." The procedure knows which five steps are independent. The document that tells applicants what to bring does not say so. The time for the water clearance is "Not known": that step belongs to the National Water Supply & Drainage Board, not to the council that owns the outcome.

The procedure I am describing is the Colombo Municipal Council's own published one, signed by the Acting Director (City Planning) in March 2013 and still on the council's website, with a 2019 document listing what the applicant must supply. I am using it for what it reliably shows — which institutions are involved, which steps depend on which, and which can run in parallel. I am not treating the fees as current, and the day-counts are the council's published targets, not measured performance. The journey below is illustrative.

So the problem is not a slow department. It is that each institution holds one true fact about the same piece of land, with its own form, window and clock — and the only integration layer deployed is the applicant's feet.

What would have to exist for that coordination to happen without you carrying it? I have drawn an answer: the AI-First Agentic Digital Economy Reference Architecture. It is my proposal. Nothing in it has been validated, adopted or standardised by anyone.

What already exists, and what I am adding

I am not writing on a blank page. Sri Lanka's Digital Economy Blueprint, published on the ICTA website (undated; the PDF was created on 2 December 2025), already states architectural principles that are "platform-first, open-source… and Artificial Intelligence (AI)/ Cloud/ Mobile first." AI-first is already official Sri Lankan architectural language, not my coinage. The Blueprint runs as a stack — infrastructure, then digital public infrastructure, then platform connections to sectoral applications, then users — underpinned by four enablers: inclusion; policy, legislation and institutions; trust and governance; capacity building. My own four cross-cutting bands echo those enablers almost one for one: a good sign, not a discovery. The proposal connects to what is already being built.

What I add is narrower. I searched the Blueprint's full text: agentic, agent and digital twin appear zero times — a statement about that document and no other. The white space is delegated machine action: software acting for a person or an institution, under authority someone granted, with consequences someone must answer for. Agent identity. The scope and expiry of what was delegated. Shared meaning for events between institutions. Recovery when it fails. None of those duties has a home yet.

The architecture, in the order a request travels

Read it from people down: their needs decide what the rest is worth. Then how they express intent — a counter, a form, a call, a conversation in Sinhala or Tamil. Then the new part, where a request is broken into steps, delegated and executed within limits. Then the systems holding authoritative records, with industry platforms beside them rather than beneath them. Under all of it, the shared foundations I call agentic AI public infrastructure — identity, payments, credentials, consent, data exchange — and the fabric that carries meaning and events between institutions.

The claim matters more than the names: an architecture for delegated machine action must connect human intent, trusted services, shared capabilities and accountable operations. Break one of those four links and what you have is a demo.

The permit journey, marked honestly

Trace it, marking each step for what it is.

Conventional rules, not AI. Those windows and thresholds — ten years, six months, sixty feet, three hundred metres — are arithmetic, not judgement. They belong in the AI + data + event interoperability fabric as versioned, machine-readable rules owned by the authority that made them. Rules automation, statistical prediction, generative text and agentic execution are four technologies with four failure modes; a model should never decide a threshold, and collapsing the four is how projects fail.

Authentication. The council asks for a photocopy of the owner's national identity card. An NIC number identifies a person; it does not prove that person is present, willing or consenting. It is an identifier, not a secret or a key.

Delegated authorization. The council already delegates to humans: someone else may apply on the owner's behalf with an authorisation letter from the owner and copies of both identity cards — who may act is on paper; until when is not. Software delegation needs the same, made explicit: what may be done, to what limit, until when, how it is revoked. Autonomy is autonomy only within granted authority and tested limits — not a human approving every harmless lookup, but nothing consequential happening outside what was granted.

Eligibility. Whether this building, on this site, triggers the fire clearance or the environmental one. The most useful AI task here: telling an applicant which clearances their site triggers, which documents are missing, and which will expire before the sixty-day clock ends. None of it decides anything, which is why I would build it first.

Institutional approval. "The Planning Committee may approve the building plan and grant the development permit with or without conditions." Statutory discretion, exercised by a committee — no architecture I can draw should touch it, and a model that writes a persuasive paragraph about why permission should be granted has not produced permission.

A model's generated reasoning is not an audit trail. To contest an outcome, a citizen needs the sources used, the rule version applied, the actions taken, the approvals given and the resulting system state. Retrieval from approved documents improves grounding but does not guarantee correct interpretation, and a second model agreeing is a review signal, not proof: models share errors. Under the Personal Data Protection Act No. 9 of 2022, as amended by the Personal Data Protection (Amendment) Act No. 22 of 2025, a person may already demand review of a decision made solely by automated processing where the impact is irreversible and continuous — a right that is in operation, while the Act as a whole is not: Part IV's commencement now rests with the Minister by Order in the Gazette.

Why capability, inclusion, governance and resilience cannot come last

In the 2024 national survey, digital literacy in Sri Lanka was 65.0% and computer literacy 35.9% among people aged 5 to 69 — and computer literacy fell 3.1 points from 2023. In the estate sector digital literacy is 44.6%, against 75.6% in urban areas. A service that assumes a confident smartphone user is not a national service, and the channel where a person answers the phone — the state already runs one, 1919 — is infrastructure, not charity.

Shared foundations concentrate risk as well as cost. If one platform carries the certificate system, the revenue licence and the police clearance, recovery is a design requirement, not an operations concern to add later. And sovereignty, in my usage, means the control you require, the capability to exercise it, governance over your data, and a credible exit — not that every workload runs on local hardware.

Where I would start

My judgement, not doctrine, and no dates.

Immediate foundations. Connectivity and hosting, which largely exist: a government network and a government cloud are already running. Payments, which demonstrably work. Stable service APIs, already official policy. The governance and privacy institutions, which are established.

Bounded pilots. One journey, one channel, one permit. A single delegation record with explicit scope and limits. Identity and credentials followed rather than duplicated: the national digital identity programme reports physical progress of 20% as at 30 September 2025, with production "scheduled to go live within one year". Consent-based exchange is programmed, not live — ICTA's Digital Government page lists a national data sharing platform and a spatial data infrastructure under "future initiatives" (checked 20 September 2026).

Longer-term propositions. The national intelligence and digital twin engine is the furthest out: an ambitious proposal requiring validation. Peer-reviewed work on urban twins finds that complexity "strongly limits prospects for optimisation and prediction". A twin supports analysis — at best, in that paper's phrase, "a form of seeing at scale." It does not acquire an official's legal authority, and it does not model every human circumstance that matters. I take it up separately, in a later essay on national intelligence without a national surveillance machine.

Open agent transactions — agents discovering each other, negotiating, paying — are the second, and the standards are not ready: the IETF's working-group draft on agent identity is at version 00 with intended RFC status "None", the Model Context Protocol removed its own session model in its current revision, and A2A, the agent-to-agent protocol, warns that an agent card "SHOULD NOT include sensitive credentials". Discovery is not authorisation. So stable service APIs remain the foundation; agent interfaces are adapters, chosen when verified and designed to be replaced. I take that up separately too.

The objection I take most seriously

Implementation capacity is scarce, the shared layers underneath are still being built, and adding more layers risks producing infrastructure nobody uses.

That is correct on the evidence — not Sri Lankan evidence: the World Bank's March 2025 paper on digital public infrastructure names institutional inertia, legacy systems embedded in workflows, stopgap solutions and low trust in digital services among the reasons such programmes stall.

My answer is not a disclaimer. It is a pattern this country has already run twice.

The Common Electronic Fund Transfer Switch, live since 2015, took its share of interbank retail transactions from 8% in 2018 to 67% in 2024 — 203 million transactions worth Rs 17 trillion — by serving unmet needs "rather than focusing on replacing existing payment instruments and systems", in what a Central Bank of Sri Lanka payments note published in February 2025 calls an "organic transition". Nothing was switched off. Nine years on, with cash still widely used, the country's best shared platform is still earning its demand.

GovPay is the sharper lesson. It launched under that name in February 2025, having run since 2023 as a pilot on the existing LankaPay platform, and is, a Central Bank of Sri Lanka payments note published in February 2025 says, "intended mainly for institutions that are yet to digitalise their databases and systems": "despite the absence of a database for real-time updates, the payer's transfer is recorded in real-time and reconciled manually at the end of the day", with instant reconciliation waiting once institutions are ready. That note records sixteen institutions at go-live; ICTA reported more than two hundred organisations and over Rs 1 billion in payments as at November 2025.

A manual end-of-day step is not a design failure. It is the concession that let institutions join before they were ready. That is the incremental path: connect what exists, keep interfaces stable, evaluate before you extend, keep records portable, and make every component replaceable — including the ones you are proudest of.

The one page I would actually hand over

Citizen outcomeCapability requiredAccountable body
"Which clearances does my site need?"Thresholds and windows as versioned, machine-readable rulesThe authority owning the rule, not the platform operator
"Don't make me re-prove what the state holds"Consent-bound exchange, decider to record custodianRecord custodian; exchange operator; privacy regulator
"Someone I authorised can act for me, within limits"Delegated authority with scope, limit, expiry, revocationNobody owns this in Sri Lanka today. The honest gap
"If a decision goes against me, show me why"Sources, rule versions, actions, approvals, state; a review routeDeciding authority; regulator; audit
"It works on a weak connection, in my language"Degraded-mode design; Sinhala and Tamil evaluated apartService owner; assisted channel as the floor

Every assignment in that last column is my proposal, not an allocation anyone has agreed. Adapt it to the outcome you own. To go deeper: AI for the Public Sector, the public-sector track I teach.

AI-first in how we build; human-first in what we optimise for. Well — one question for anyone holding a budget. When the model behind your service changes next year — and it will — what else has to change with it? If the answer is "most of it", the problem was never the model.

This is the third essay in a series of forty-one on AI, human agency and the digital economy.

At a glance

  • Samisa Abeysinghe, Founder & CEO of Idasara Digital, proposes the AI-First Agentic Digital Economy Reference Architecture for Sri Lanka — his own design, not validated, adopted or standardised by any government body.
  • The architecture's claim is that connecting delegated AI action requires four linked things: human intent, trusted services, shared capabilities and accountable operations — break one link and, in his words, "what you have is a demo."
  • It builds on Sri Lanka's Digital Economy Blueprint, published on the ICTA website, which already states "Artificial Intelligence (AI)/ Cloud/ Mobile first" as an architectural principle; his own contribution is the white space the Blueprint's text never mentions — agent identity, delegated authority, and recovery when automated systems fail.
  • He illustrates the case with the Colombo Municipal Council's own published development-permit procedure, marking each step as a conventional rule, a human approval, or a plausible AI task — never as something already built.
  • He proposes starting with foundations that mostly already exist — the government network and cloud, working payment platforms, stable service APIs — before bounded pilots, and treats open agent-to-agent transactions and a national digital-twin engine as longer-term, unproven propositions requiring separate validation.

Questions people ask

What is the AI-First Agentic Digital Economy Reference Architecture? It is Samisa Abeysinghe's own proposed architecture for Sri Lanka, connecting citizen or business intent, trusted public services, shared digital infrastructure — identity, payments, credentials, consent — and accountable government operations. Nothing in it has been validated, adopted or standardised by any government body.

How is it different from Sri Lanka's Digital Economy Blueprint? Sri Lanka's Digital Economy Blueprint, published on the ICTA website, already states that architecture should be "AI/Cloud/Mobile first." Samisa Abeysinghe's proposal adds what the Blueprint's own text never mentions: agent identity, delegated machine action, and recovery when automated systems fail.

What should Sri Lanka build first, according to Samisa Abeysinghe? Abeysinghe recommends starting with foundations that largely already exist — the government network and cloud, working payment platforms and stable service APIs — then running one bounded pilot, such as a single permit journey with an explicit, revocable delegation record, before any open agent-to-agent transactions.

Is the AI-First Agentic Digital Economy Reference Architecture adopted by the Sri Lankan government? No. Samisa Abeysinghe states plainly that it is his own proposal: "Nothing in it has been validated, adopted or standardised by anyone." No ministry, agency or Sri Lankan digital-economy programme has adopted it as policy or built it as a system.

Does the architecture treat a Sri Lankan citizen's NIC number as a security credential? No. In Samisa Abeysinghe's architecture, an NIC number is an identifier only. As he writes: "An NIC number identifies a person; it does not prove that person is present, willing or consenting. It is an identifier, not a secret or a key."


Sources

Comments

Post a Comment