UAE PASS and Identity-Aware Agentic Services

On 23 April 2026, the UAE announced a new government framework to move 50% of government sectors, services, and operations toward Agentic AI within two years. The important shift is not the language of AI alone. It is the move from digitized services toward systems that can monitor, analyze, recommend, execute approved steps, and improve service operations in real time.

Agentic public services need identity-aware boundaries so a system can know who is asking, what authority they have, and what the agent is allowed to do.

Why this matters now

The announcement ties the mandate to sectors, services, and operations. It also links performance to adoption ability, implementation speed, understanding of the new technology reality, mastery of AI tools, and creation of new government work mechanisms. That makes this an operating-model question, not a campaign or software-procurement question.

For government entities, semi-government teams, and suppliers, the practical challenge is to turn a national AI direction into services that are identity-aware, policy-compliant, bilingual, measurable, and supportable after launch. A strong response starts with service redesign, data trust, human takeover, and evidence quality before it expands the platform footprint.

Design decisions to settle early

• Which actions require verified identity.
• How consent and delegation are recorded.
• Where agent permissions are enforced in the journey.

These decisions prevent agentic AI from becoming uncontrolled automation. Every service journey needs a defined boundary: what the system can do alone, what requires review, which records it can trust, and what evidence must remain available after each action.

Where the risk usually appears

• Treating login as the whole identity model.
• Letting agents cross permission boundaries during tool use.
• Weak audit evidence for delegated actions.

The biggest risk is treating the agenda as a tool race. Tools matter, but public services succeed when decision paths, data status, user authority, staff responsibility, and post-launch measurement are explicit.

What to measure

• Authenticated completion rate.
• Permission denial accuracy.
• Consent capture quality.
• Delegated action auditability.

Good measurement should not count models or conversations alone. It should connect speed with trust, automation with service quality, and adoption with the entity's ability to operate and improve the system. That means combining service metrics, governance metrics, user experience signals, and exception data.

The first 90 days

• Map identity states across the service.
• Define agent permissions by role and journey step.
• Design audit logs for every identity-sensitive action.

The healthy start is narrow but real. The first scope should expose record quality, permission boundaries, supportability, and human takeover behavior. Once that first service works under realistic pressure, scaling becomes easier to defend to leadership, procurement, operations, and risk owners.

Bottom line

Agentic AI in government is not a standalone technology topic. It is a service, data, governance, and workforce redesign program built around a new execution capability. The entities that begin with services, controls, and measurement will be better positioned to turn the two-year mandate into measurable public value.

Public References

• Dubai Media Office: https://mediaoffice.ae/en/news/2026/april/23-04/mohammed-bin-rashid-chairs-uae-cabinet-meeting
• National Media Authority: https://www.nmo.gov.ae/en/news/under-directives-of-uae-president-and-in-world