UK Local Authority AI-Assisted Social Care Eligibility Engine

IMMUTABLE STATIC ANALYSIS: UK Local Authority AI-Assisted Social Care Eligibility Engine

This section details the immutable static analysis framework governing the AI-Assisted Social Care Eligibility Engine. The analysis is performed at build-time, prior to any runtime inference, to guarantee that the system’s logic, data handling, and compliance posture are mathematically provable and free from dynamic corruption. The engine is designed as a deterministic, rule-constrained system where AI outputs are treated as probabilistic suggestions, not authoritative decisions. The static analysis ensures that all code paths, data flows, and model interactions adhere to the UK’s Care Act 2014, the Data Protection Act 2018, and the emerging 2026 AI Assurance Framework for Public Services.

1. Formal Verification of Eligibility Logic via Symbolic Execution

The core eligibility engine is implemented as a finite state machine (FSM) with 47 discrete states, each corresponding to a specific clause in the Care Act 2014 (e.g., State S12: “Significant Impact on Wellbeing”). The static analysis employs symbolic execution to exhaustively enumerate all possible transitions between these states, given a set of input variables (e.g., age, disability type, carer availability). This is not a test; it is a proof. The symbolic executor, built on the CBMC (C Bounded Model Checker) framework, generates path constraints for every possible combination of inputs, verifying that no transition leads to a logically contradictory state (e.g., a user being simultaneously eligible and ineligible for the same care package).

Architecture Diagram (Markdown):

graph TD
    A[Input Variables: Age, Disability, Financial Status] --> B[Symbolic Executor (CBMC)]
    B --> C{State Machine: 47 States}
    C --> D[Path Constraint Solver (Z3)]
    D --> E[Proof: No Contradictory States]
    D --> F[Proof: All Paths Terminate]
    D --> G[Proof: No Dead Code in Eligibility Rules]
    E --> H[Immutable Binary: Eligibility Engine]
    F --> H
    G --> H

Pros:

• Mathematical Certainty: Eliminates runtime logic errors, such as infinite loops or undefined state transitions, which are common in rule-based systems.
• Regulatory Compliance: The symbolic proof can be submitted to the Care Quality Commission (CQC) as evidence that the engine’s logic is sound and complete.
• Deterministic Output: Given the same inputs, the engine will always produce the same eligibility outcome, ensuring fairness across all local authorities.

Cons:

• High Computational Cost: Symbolic execution of 47 states with 12 input variables generates over 10^15 path constraints, requiring a dedicated build cluster (approx. 48 hours per full verification).
• Model Fragility: Any change to the Care Act (e.g., a 2026 amendment to the “Wellbeing Principle”) requires a full re-verification, delaying deployment.

Code Pattern (Pseudo-Rust for Immutability):

// Immutable state machine with formal verification
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
enum EligibilityState {
    Initial,
    NeedsAssessment,
    FinancialAssessment,
    Eligible,
    Ineligible,
    Appeal,
}

// Symbolic execution ensures no invalid transitions
fn transition(state: EligibilityState, input: &Input) -> EligibilityState {
    match (state, input) {
        (EligibilityState::Initial, Input { age: a, .. }) if *a < 18 => EligibilityState::Ineligible,
        (EligibilityState::NeedsAssessment, Input { disability: d, .. }) if *d == DisabilityType::Severe => EligibilityState::Eligible,
        _ => state, // All other paths are proven unreachable
    }
}

2. Static Data Provenance and Lineage Analysis

The engine ingests data from three sources: the Local Authority Social Care Database (LASCD), the NHS Spine, and the Department for Work and Pensions (DWP) benefits system. Static analysis enforces a strict data provenance model where every variable is tagged with a source identifier (e.g., source: LASCD_Table_42_Field_3). The analysis uses a custom LLVM pass to verify that no data from a non-authorised source (e.g., a user’s social media profile) can influence the eligibility decision. This is critical under the UK’s 2026 AI Assurance Framework, which mandates that all AI inputs must be auditable and traceable to a government-approved data source.

Architecture Diagram (Markdown):

graph LR
    A[LASCD] --> B[Data Provenance Tagging]
    C[NHS Spine] --> B
    D[DWP] --> B
    B --> E[Static Analyzer: LLVM Pass]
    E --> F{Source Check}
    F -->|Authorised| G[Eligibility Engine]
    F -->|Unauthorised| H[Build Failure]
    G --> I[Immutable Audit Log]

Pros:

• Audit Readiness: Every data point used in an eligibility decision can be traced back to its original source, satisfying the “Right to Explanation” under GDPR.
• Security: Prevents data injection attacks where a malicious actor might try to influence the engine by providing falsified data from an unverified source.

Cons:

• Integration Overhead: Requires all data sources to implement a standardised tagging protocol (e.g., W3C PROV-O), which may not be supported by legacy systems.
• False Positives: The static analyzer may flag legitimate data flows (e.g., a derived field combining LASCD and NHS data) as unauthorised, requiring manual whitelisting.

Compliance Framework Mapping:

• Care Act 2014, Section 9: “The assessment must be based on the person’s needs, not the services available.” The static provenance analysis ensures that the engine only uses needs-based data (e.g., disability severity), not service availability data (e.g., budget constraints), which could bias the outcome.
• Data Protection Act 2018, Schedule 1: “Processing of special category data must have a lawful basis.” The analysis verifies that all health and social care data is processed under the “substantial public interest” condition.

3. AI Model Output Bounding and Constraint Propagation

The AI component (a fine-tuned BERT model for natural language processing of care assessments) is treated as a non-deterministic oracle. Static analysis enforces a “bounding box” on the model’s output, ensuring that any AI-generated suggestion (e.g., “This user likely qualifies for domiciliary care”) is constrained within the deterministic eligibility rules. The analysis uses abstract interpretation to compute the maximum and minimum possible influence of the AI output on the final decision. If the AI output could push the decision outside the bounds defined by the Care Act, the build fails.

Architecture Diagram (Markdown):

graph TD
    A[AI Model: BERT] --> B[Output: Probability Distribution]
    B --> C[Abstract Interpreter]
    D[Deterministic Rules] --> C
    C --> E{AI Output Within Bounds?}
    E -->|Yes| F[Final Decision: AI + Rules]
    E -->|No| G[Build Failure: AI Override Detected]

Pros:

• Safety Guarantee: The AI can never override the Care Act, even if the model is adversarially attacked or suffers from distribution drift.
• Explainability: The bounding box provides a clear, human-readable explanation for why a particular AI suggestion was accepted or rejected (e.g., “AI suggested eligibility, but the financial assessment rule R47 overrides this”).

Cons:

• Reduced AI Utility: The bounding box may be too restrictive, causing the AI to be effectively ignored in many cases (e.g., if the rules are already highly specific).
• Model Update Latency: Every time the deterministic rules change, the bounding box must be recalculated, delaying AI model updates.

Code Pattern (Constraint Propagation in Python with Z3):

from z3 import *

# Define symbolic variables for AI output and rule constraints
ai_output = Real('ai_output')
rule_bound = Real('rule_bound')

# Constraint: AI output must be within +/- 10% of the rule-based decision
solver = Solver()
solver.add(ai_output >= rule_bound * 0.9)
solver.add(ai_output <= rule_bound * 1.1)

# Check if the constraint is satisfiable for all possible inputs
if solver.check() == unsat:
    raise BuildError("AI output exceeds rule bounds for some inputs")

4. Immutable Deployment and Cryptographic Attestation

The final stage of static analysis is the creation of an immutable deployment artifact. The entire eligibility engine, including the symbolic proof, data provenance tags, and AI bounding box, is compiled into a single binary. This binary is cryptographically signed using a hardware security module (HSM) compliant with the UK’s National Cyber Security Centre (NCSC) guidelines. The static analysis verifies that the binary’s hash matches the hash of the source code and all dependencies, preventing any tampering during the CI/CD pipeline. The binary is then deployed to a confidential computing environment (e.g., Intel SGX enclave) where it can only be executed, never modified.

Architecture Diagram (Markdown):

graph LR
    A[Source Code] --> B[Static Analysis Pass]
    B --> C[Immutable Binary]
    C --> D[HSM Signing]
    D --> E[Hash Verification]
    E --> F[Confidential Computing Enclave]
    F --> G[Execution Only]

Pros:

• Tamper-Proof: Any modification to the binary, even a single bit, will cause the hash verification to fail, preventing deployment.
• Zero-Trust Deployment: The binary can be deployed to any cloud or on-premise environment without trusting the infrastructure, as the enclave guarantees execution integrity.

Cons:

• Operational Complexity: Requires a hardware security module and confidential computing infrastructure, which may not be available in all local authorities.
• Update Friction: Even a minor bug fix requires a full re-verification and re-signing process, which can take days.

FAQ:

1. Q: How does the static analysis handle changes to the Care Act 2014? A: Any legislative change triggers a full re-verification of the symbolic execution model. The analysis will automatically detect which states and transitions are affected and flag them for human review. The build will fail until the new rules are proven consistent.

2. Q: Can the AI model be updated without re-running the static analysis? A: No. The AI model is part of the immutable binary. Any model update requires a new bounding box calculation and a full re-verification. This is by design to prevent silent changes in eligibility outcomes.

3. Q: What happens if the static analysis finds a contradiction in the eligibility rules? A: The build fails immediately, and the contradiction is reported to the legal and policy teams. The engine cannot be deployed until the rules are resolved, ensuring that no contradictory decisions are ever made.

4. Q: How does the system handle data from legacy systems that don’t support provenance tagging? A: The static analysis will reject any data source that cannot provide a verifiable provenance tag. Local authorities must either upgrade their legacy systems or use a certified middleware adapter that adds the required tags.

5. Q: Is the static analysis itself auditable? A: Yes. The entire static analysis pipeline, including the symbolic executor, abstract interpreter, and hash verification, is open-source and subject to independent audit. The audit logs