NYC's MyCity chatbot told landlords they could refuse Section 8 vouchers, told stores they could go cashless, and told employers they could pocket their workers' tips. Every one of those answers was illegal, and every one carried the city's seal on a .gov domain (The Markup, 2024). The reflex fix across GovTech has been to add retrieval, on the theory that a bot grounded in the actual municipal code will stop misstating the law. It does not. A Stanford study of the leading legal-AI tools measured Lexis+ AI hallucinating 17 percent of the time and Westlaw's AI-Assisted Research 33 percent, with the statute correctly retrieved and the generation still misreading or overriding it (Magesh et al., Stanford / JELS, 2025). Retrieval improves the draft. It cannot prove the answer is safe to release, and for a government that proof is the whole job.
We built CivicCite, a demo of a Statutory Decision Gate, to make that proof mechanical. A citizen answer is released only when it carries a statute that exists, is in force, is entailed by the cited text, and is conflict-free. Otherwise the system abstains, routes the question to the right department, and files a record of the decision. You can run it at https://veriprajna.com/demos/government-municipal-ai. The demo is the artifact, but the argument underneath it is the point, so start with why the industry aimed its fix at the wrong layer.
The wrong layer got the investment
Retrieval fixes what the model reads. It does nothing about what the model then does with it. The dangerous government answer is usually not an invented statute; it is a real statute cited and the wrong conclusion drawn, or a provision that was repealed two years ago read as if it were still law. A better base model writes those answers more fluently. It does not make them safe to publish under a city's name, and it cannot hand a regulator a reason the answer shipped. The pressure to get this right is not hypothetical: 78 chatbot bills moved across 27 states in 2026, and the EU AI Act's Annex III high-risk obligations become enforceable on 2 August 2026, carrying penalties up to 15 million euros or 3 percent of turnover. Government legal advice sits in the proprietary-function zone, so there is no sovereign-immunity shield to fall back on.
A government answer should ship only when it carries a verified, in-force citation. Otherwise the system should stay silent and escalate, with a filable record of the decision every time.
That is a governance property, not a model property, which is why we put it in deterministic code sitting outside the agent framework. The language model in CivicCite only advises. It splits a question into sub-questions and drafts a candidate answer constrained to the retrieved citations. Everything that decides whether a citizen sees that answer is plain Python that runs the same checks the same way on every query. The agents advise; the gate decides.
What "stay silent" actually looks like
The most revealing case is not the one the system answers. It is the one it refuses. Take a food-truck operator asking whether they can leave a truck parked at a metered space all day under the general-vendor parking rule. A plain retrieval chatbot pulls the nearest-looking provision and answers with confidence, no statutory basis, no currency check, shipped as-is. CivicCite runs the same query and stops. The only provision in the corpus that addresses general-vendor metered parking has been repealed, so the deterministic in-force check fails, no provision currently in force entails an answer, and the gate withholds rather than reaching for something close enough. It routes the question to NYC 311 general intake with the partial findings attached, so the citizen gets a real next step instead of a confident guess.
The food-truck metered-parking query, withheld. The only governing provision was repealed, so the deterministic checks fail in order: cite-exists no, in-force no, entailed neutral, no-conflict yes. Disposition is withhold and escalate, routed to NYC 311 general intake with the partial findings, rather than a bluffed answer.
This is what makes the mechanism honest rather than clever. The currency and conflict checks never call the model at all. Currency reads a provision's effective and repeal dates straight off the municipal-code graph and passes only when the provision has no repeal date and took effect on or before the query's as-of date, here 17 June 2026. Conflict reads the graph's conflict edges. Because the check is code reading data, a repealed or not-yet-effective provision can never back a released answer, no matter how confidently the model wrote the sentence. An LLM cannot vote itself past the gate, because the gate is not an LLM.
The same gate releases when the law does support the answer. On the exact Section 8 voucher question that got MyCity in trouble, the correct provision, NYC Admin. Code Section 8-107(5), both exists and, read plainly, entails the right answer: a landlord may not refuse a tenant because they would pay with a housing voucher, since that is unlawful source-of-income discrimination. All four checks pass, and the gate releases one sub-answer and holds zero, marked verified and in force.
The same query the standard bot ships unverified, run through the gate. CivicCite releases the citation-backed answer only after all four checks pass, traced to NYC Admin. Code Section 8-107(5), verified and in force. One released, zero held.
The deliverable is a record, not a score
One property here outlasts every model upgrade. Even a flawless model still cannot prove to a regulator that a released answer traced to live, in-force law, because the model keeps no durable record of why it said what it said. CivicCite writes a Statutory Decision Record for every interaction, released or refused. The record carries the query, the disposition, each sub-answer's citation, and the four checks with their boolean results, so a Law Department can hand a reviewer the exact reason any given answer shipped or was held.
The Statutory Decision Record filed for the voucher query. Disposition RELEASED, citation NYC Admin. Code Section 8-107(5), and the four checks recorded as citation_exists, in_force, entailed and no_conflict, each true. The standards block names NIST AI RMF and FedRAMP / StateRAMP continuous-monitoring logging as the frameworks the record is built to align with, not certifications it claims.
Model accuracy is a moving target that every base-model release resets. Provenance, an audit trail, and a deterministic release gate are stable properties that do not age out when the next model ships.
That is the durable-moat argument, and it is why we think this layer is worth building rather than waiting for a better model. The governance layer sits above the chatbot platform, and it is the piece the platform vendors do not ship. A stronger model makes the draft better. It does not make the release provable.
What the golden set actually shows
An argument like this is easy to assert, so the demo puts a number on it. On a fixed, labeled 12-query golden set, run through the real pipeline, the headline the demo targets is not a hallucination rate. It is the number a regulator can act on: answers released without a verified, in-force statutory basis, target zero of twelve, alongside 100 percent audit-record coverage and full agreement between the gate's dispositions and the labeled ground truth.
The 12-query golden set run through the live pipeline. Zero of twelve answers released without a verified, in-force statutory basis against a target of zero, 100 percent audit-record coverage, and 100 percent disposition agreement with the labeled ground truth.
We are careful about what that number is. It describes this fixed, labeled 12-query set and the deterministic checks that run on it, not an open-world promise that the system is never wrong. On the same set, a plain retrieval baseline with no gate, which is the MyCity architecture, would have shipped the documented illegal answers. We show that only as context, never as a percentage of model errors caught. The point the golden set proves is narrow and durable: on a defined set, no answer shipped without a verified, in-force basis, and every interaction produced a record.
Where this is, and the question we keep asking
This is a demo, and we are precise about the seams. The municipal-code corpus is a synthetic-but-faithful graph, with operative text paraphrased from real referenced provisions rather than served from a live legal source, and it is not legal advice. Municipal-code ingestion and the 311 escalation are simulated: the routing is computed and shown, but the connector into a real Salesforce Gov Cloud or ServiceNow queue is an interface, not a live integration, and Hartwell 311 in the interface is a synthetic prop, not a real deployment. What the demo proves is the shape of the mechanism, not a production rollout. The full run is at https://veriprajna.com/demos/government-municipal-ai.
So the question we keep putting to city CIOs and their Law Departments: when your assistant answers a citizen, what actually stops an unverified answer from shipping, and could you hand a regulator the record for the one it released this morning? We would genuinely like to hear how your team draws that line. The pressure is industry-wide, and the workable answers will be too.