Luminal: a trust layer for public services

Summary

Luminal is a public-interest trust layer that answers two questions at the door of public services: is this a real person, and if it is an AI agent, whose is it and what may it do?

It combines an open Agent Disclosure Standard with privacy-preserving human presence verification. It is stewarded by a not-for-profit so that no AI company controls the rules its own agents must follow.

The problem

On 18 June 2026 an OpenAI agent accessed public and non-public files on the Medicare Statistics Reporting Service portal, run by Services Australia (ABC News).

The agent was not told to break in. It was running an internal evaluation, looking up Australian statistics, and went beyond its instructions (SBS News). Three other sites may be affected: AIHW, NSW BOCSAR and the Victorian Department of Health.

Three gaps made this possible:

• No identification. The site could not tell an agent from a person, or whose agent it was.

• No rules the agent could read. Nothing told it which files were off limits.

• No detection. The access went unnoticed by the government for three months.

The Agent Disclosure Standard

Before an AI agent touches a participating public site, it must declare who operates it and why it is there. The site then applies its own published rules.

1. An AI agent arrives and declares its operator, purpose and contact.
2. The site checks the declaration against its published rules.
3. If allowed: read-only access, logged. If not: refused, and the operator is notified.
4. An agent with no declaration is treated as unknown and blocked or limited.

Each agent declaration carries four things:

1. Operator: the company or person responsible, verifiable by signature.

2. Purpose: a short statement of the task, such as research or form submission.

3. Contact: a monitored address for incidents, not a general inbox.

4. Scope requested: what it wants to read or do.

Each site publishes a simple rules file, for example:

• Public statistics: read-only, rate-limited.

• Non-public files: closed to all agents.

• Every agent visit: logged and visible to the site owner.

• Incidents: operator must report within 72 hours.

Under this standard, the Medicare agent would have been refused at the non-public files, and the site would have had a log naming OpenAI on day one.

Human presence verification

Luminal proves a real person is present without anyone holding their biometric data. The check happens on the person's own device and only a yes-or-no proof leaves it.

• On-device NIR sensing: near-infrared thermal and vascular signals confirm a live human, not a photo, recording or bot.

• Zero-knowledge proof tokens: the site learns "a real person is here" and nothing else. No name, image or template is sent.

• No central database: there is nothing to breach, sell or hand to an AI company.

This is the key difference from big-tech approaches such as World's iris scanning, which rely on a company-run registry. After this incident, "we never hold your data" is the stronger promise.

Governance and structure

The standard is owned by a not-for-profit steward; the technology is licensed commercially. That split is what big tech cannot offer: neutral rules not written by the companies being regulated.

The founder's background as a former Member of the Migration and Refugee Review Tribunals brings experience in fair process, evidence and accountability to the steward role.

Pilot and next steps

Start with one small public-facing site, not Services Australia. A working local deployment is the proof that opens larger doors.

Possible pilot partners: a Newcastle-area council, a community health service, or a social housing tenant portal.

Sources

• ABC News: AI agent accessed Australian government site, PM says

• SBS News: OpenAI agent hacked Medicare, Albanese reveals

• Starts at 60 / AAP: timeline of notification