Scheme Eligibility Checking Without Exclusion Error

A district social-welfare office ran a pilot last winter. The vendor called it auto-eligibility. Overnight the dashboard went green. Pendencies fell. Three weeks later a widow arrived with a death certificate, a passbook and a neighbour. The agent had marked her household as 'income unverified' because a scanned page had a fold across the rupee figure. Nobody had opened the exception queue. The pension did not move. The dashboard still looked excellent.

That is the only failure mode this article cares about. Inclusion errors — paying someone who should not have been paid — will find you in audit. Exclusion errors — not paying someone who should have been paid — find you in a hearing, a newspaper, or a funeral. An agent that is scored on 'cases closed' will prefer exclusion. You must score it on reconstructable, officer-owned decisions.

This is a field guide for state CIOs, scheme owners and NIC counterparts who want retrieval and draft assistance on welfare files. It is written on 17 August 2026 for Indian public institutions. It is not legal advice. Prcept AI builds on-prem and air-gapped agents, is DPIIT recognised, and does not train on customer data. None of that replaces a human gate.

Exclusion is the product risk, not latency

Scheme eligibility looks like a classification problem. It is not. It is an administrative act that changes a person's access to a notified benefit. The notification, the income definition, the residence rule, the exclusion list and the appellate path are the product. The model is a clerk. If you let the clerk close the file, you have delegated a statutory function to a statistical system without an instrument that says you may.

Write two rates on the wall of the war-room and refuse to hide either. The inclusion-error rate is how often an ineligible case is proposed as eligible. The exclusion-error rate is how often an eligible case is proposed as ineligible or is never surfaced. Vendors will bring precision and recall. Translate them. Recall on the eligible class is the civil number. If recall is low, you are manufacturing exclusion at scale.

• Never auto-deny. Auto-assemble and auto-flag are the ceiling until a competent officer acts.
• Never hide the exception queue. If the queue is a vendor screen nobody opens, it is not a control.
• Never score the vendor on 'auto-closure percentage'. Score them on time-to-officer-decision and on sampled exclusion.
• Never join Aadhaar into a warehouse because it is convenient. Authentication is not a primary key.

Section 7 is a limb, not a mood

The Digital Personal Data Protection Act, 2023 does not hand the State a blank cheque because the workload is welfare. Section 7 sets out legitimate uses for specified processing, including the provision of a subsidy, benefit, service, certificate, licence or permit as prescribed, and the performance of a function under law. Those limbs are real. They are also bounded. MeitY notified the Act and the 2025 Rules on 13 November 2025, with operational duties phased, most remaining duties from 13 May 2027. CAG, RTI and your own scheme rules did not wait for that date.

A welfare-eligibility agent that reads a notified State database, on a State Data Centre VLAN, for the purpose written in the scheme notification, with logs that never leave the perimeter, can often sit on a Section 7 story. An agent that fine-tunes a public model on applicants' income certificates so the vendor's next state 'learns faster' cannot. An agent that sends household scans to a public chatbot API cannot. Write the purpose. Write the fiduciary and the processor. Write what never leaves.

Do not fake consent as a backup. A person who needs a pension is not freely consenting to a new processing purpose when the alternative is hunger. If you have a Section 7 path, record it. If you do not, stop the workflow. Bundled 'I agree' checkboxes on a CSC kiosk are not a lawful-basis strategy.

Aadhaar is not your join key

Eligibility engines fail in the same place every year: someone proposes Aadhaar as the universal join. Pause. Authentication proves, at a moment, that a person matching a stored credential is present or holding an OTP. e-KYC, where permitted, returns a digitally signed demographic packet. Those are different products. They are not a licence to keep twelve-digit numbers in a data lake, paste them into prompts, or embed them in a vector store.

UIDAI's published authentication ecosystem is explicit about modes — demographic, OTP, biometric — and about e-KYC requiring OTP and/or biometric authentication. Circular No. 14 of 2025 directs requesting entities on Aadhaar Data Vault placement and forbids storing Aadhaar numbers or related data from authentication or e-KYC request inputs in ordinary systems. Biometrics captured for authentication are not a departmental souvenir. If your design needs a persistent person key, use the token or reference the scheme already notified, not a spreadsheet of Aadhaar numbers on a shared drive.

Eligibility design choices that look similar in a demo and are not similar on a file.

Design move	What it actually is	File that survives
Agent auto-rejects 'low confidence' cases	Exclusion at machine speed	Agent drafts; officer decides; exception queue is a counted KPI
We use Aadhaar to de-duplicate	Often an unlicensed join plus a stored number	UIDAI-permitted auth or e-KYC; vaulted references; no numbers in prompts
Section 7 covers everything	A mood, not a limb	Cited limb, purpose, fiduciary, processor, no-training clause
Public LLM 'just to classify the scan'	A transfer of personal data to an uncontrolled host	On-prem or SDC inference; scans never leave the VLAN
Dashboard of cases closed	An incentive to hide exclusion	Sampled false-negative rate and time-to-officer-decision

Two districts, same notification

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note.

We will never clear the backlog if an officer must click

Then staff the queue and shrink the extract, do not delete the click. Most backlogs are missing documents and unread exceptions, not a shortage of machine denials. Measure time-to-first-human-action. If that number falls, you are winning. If only auto-closure rises, you are hiding work in the citizen's house.

The model is more consistent than our clerks

Consistency on a wrong rule is industrial exclusion. Clerks can be trained and transferred. A model can apply a bad income definition to four lakh households before lunch. Consistency is an argument for written rules and sampled review, not for removing the officer.

Section 7 means we do not need a DPA

No. A legitimate use, where it exists, is a basis for specified processing. It is not a waiver of processor control, security, purpose limitation or a training ban. If a vendor model host can see the scans, you have a processor or a controller you have not named. Name them or remove them.

Aadhaar is already in the scheme, so the lake is fine

A notified use of Aadhaar for a scheme is not permission to copy numbers into an analytics warehouse, a prompt, or a vendor eval set. Read the current UIDAI directions. Vault what you must retain. Tokenise. Keep numbers out of embeddings.

A four-week playbook before the first production batch

1. Week 1: print the scheme notification. List every eligibility and exclusion clause as a numbered rule. Mark each rule deterministic (gazette fact) or judgement (officer discretion). The agent may touch only the first list.
2. Week 2: write the three sentences — basis, roles, perimeter. If Aadhaar appears, write authentication versus e-KYC and the vault story. If you cannot, delete Aadhaar from the design.
3. Week 3: run two hundred historical cases with known outcomes, offline, on a department-owned pack. Publish two numbers: proposed exclusion among known-eligible, and proposed inclusion among known-ineligible. Freeze the model if the first number is ugly.
4. Week 4: stand up the officer queue in the system of record, not in a chat window. Name the competent authority. Sample fifty proposed-ineligible cases. Write the standing order that the agent shall not send a denial SMS.

File note you can paste

Subject: Agent-assisted scheme eligibility — human gate and exclusion control.

This department will use an agent only to extract notified fields and to draft a speaking-order skeleton. No application shall be rejected, timed out, or closed as ineligible except by a competent officer in the scheme MIS. Exception queues will be counted weekly. The lawful basis for personal-data processing will be recorded against the relevant limb of Section 7 of the DPDP Act, 2023 where it applies, or another recorded basis; Section 7 will not be treated as a general exemption. Aadhaar, if used, will follow current UIDAI authentication or e-KYC directions and will not be stored in ordinary tables, prompts or embeddings. Vendor training on scheme records is forbidden.

This note is an internal aid. It is not legal advice.

What we will refuse to automate

Prcept AI will run this class of agent on your rack or in your air gap. We will not train on your applicants. We will not send discharge-quality household scans to a public API. We will not sell you auto-deny. If a competitor offers a higher closure rate by deleting the officer, compete us on the sampled exclusion number, not on the dashboard. The widow is the unit of account.

Put the standing order on the same volume as the purchase file. The next collector should be able to read, in one sitting, what the machine may extract, what it may never decide, and who owns the queue. That is the whole product.

How to sample exclusion without a data-science cell

You do not need a notebook environment to know whether the clerk is manufacturing false negatives. Take last month's known-eligible disbursements — people who were paid after a human process you still trust. Run those packets through the agent in a read-only batch. Count how many it would have flagged as ineligible or low-confidence. That share is your exclusion pressure. If it is ugly, you have a template or extractor problem, not a need for a sharper auto-deny.

Then invert the sample. Take fifty cases a competent officer already rejected, with reasons. If the agent would have drafted them as eligible, you have inclusion pressure. Publish both numbers in the monthly note. A vendor who wants only the inclusion number is asking you to hide the widow. A secretary who wants only the closure number is asking the same thing in a nicer suit.

Keep the sample packs on a department store, redacted if they must leave the room, never as a vendor marketing benchmark. If Prcept AI or anyone else asks to keep the pack after the test, the answer is no. The pack is personal data and a scheme artefact. It is not a sales leave-behind.

This article is informational field guidance for Indian public institutions, not legal, privacy, Aadhaar-compliance or procurement advice. Confirm against the live scheme notification, DPDP text and commencement, UIDAI directions, GFR or state finance rules, and counsel before you file it.