Councils and Copilot
I recently mentioned that I was working on an FOI project to find out what Copilot agents were being built by local government. It is still very early days, and only a handful of councils have responded so far, but I already have data covering around 400 agents, and it has already made me think.
Each response comes with three columns: Name, Description and Instructions, which mirrors the data on an overview page within Copilot. The third one is the most interesting to me, as it contains the actual prompts.
As I suspected, several agents are called “New Agent” or “Test”. Quite wonderfully, there is also a small population of agents with names, including Agent Smith (whose description begins with “Wears a suit”), Agent Charles, an Agent Pat, a Norman, a Giles and a Brian.
It was interesting to find that a Casework Bot that drafts replies to elected members is instructed that “Your responses should not encourage further communication from councillors”!
Three of the four longest prompts stop mid-sentence or mid-word at around 8,000 characters. This happens to be the limit for agent instructions in Microsoft 365, so I suspect that those agents might have been running on incomplete instructions ever since they were created.
What do they do?
Most of the agents do basic things like summarising meetings, tidying up email drafts or playing noughts and crosses. This is what I was expecting to find. So far, around twenty appear to produce something that looks like a decision about a person or a company, or to help with such decisions.
There is a Blue Badge Triage Assistant that is told it “supports criteria-based decision making, ensuring that most applications can be processed without escalation”, and instructed to guide staff “through structured triage to enable decision-making with minimal escalation”. It is instructed to always return one of four outcomes: Approve, Decline, Request Further Information, or “Escalate to Team Leader (Exception Only)”.
There is also a Referral Cruncher-Spreadsheet. It takes an export of homelessness cases, and is told to treat “each populated customer row as a separate case”, before applying a supported accommodation matching methodology to every row, and writing a recommendation back into a new worksheet. Provider and support tier, or “No Suitable Alliance Provider”, or “No Supported Accommodation Need Identified”.
Also for housing there is an agent whose entire description is “Used to determine what banding someone is based on the policy”. There is an Early Help Step-Down Triager that is asked to choose between four safeguarding outcomes including “Not Appropriate for Step-Down”. There is a Short Breaks Referral Screener that assesses whether disabled children are eligible for respite care. There is a Child’s Best Interest Advisor who is told “to automatically assess parental requests for children’s records and determine whether disclosure is appropriate”. There is an Audit Agent that grades children’s social care casework against ratings of “Exceeds good / Meets good / Does not yet meet good / Immediate action needed”.
It is not clear if any of these are being actively used, or how involved a human is in assessing the outputs. I did see some signs that thought had been given to the need for human involvement. Merton Council have an agent called EH Triage, whose author had clearly thought hard about this:
I make all decisions; you do not assess thresholds or recommend outcomes on any specific case… If my line of enquiry goes against this principle redirect me to relevant guidance and general UK safeguarding principles and remind me the decision is mine.
Plymouth Council’s DHP assistant also states “You are a decision-support tool, not a decision-maker” and forbids it from recommending an award or a refusal.
How much this influences the output is a different matter, and an agent that presents a plausible structured recommendation may influence the human taking the decision regardless.
Bias risk and information rights
I have found several agents whose prompts appear to steer the agent towards a particular outcome - I am going to look at this in more detail once the full dataset is in.
The food business Risk Scoring Agent is told to “Always choose the highest-risk applicable category unless clear evidence supports a lower score”. The supported accommodation agent is told to “Recommend the minimum appropriate support tier”. These would likely encourage the agents to lean in one direction.
So far there have been two agents that touch FOI, EIR or subject access, so naturally I had to look at those. They are both instructed to “Identify which exemptions apply to the requested information”, not whether any apply at all. The task, as framed, seems to lean towards withholding information, and neither prompt seems to account for the possibility that the correct output is to disclose everything. I doubt anybody intended that, and to confirm my suspicions, I did some experimenting of my own.
Once you know the prompt, you can run it yourself.
I took 41 genuine FOI requests made to 6 different councils, and the data that had been released in response. I then fed this to GPT 5.6 luna - I don’t know what model the council are using, so thought I’d pick an OpenAI one.
I ran the requests four times each, with four different prompts:
- A — Plymouth Council’s FoI Assistant, verbatim
- B — Plymouth Council’s FoI / EIR Assessor, verbatim
- C — my control “You are an information rights officer at a UK local authority. Respond to this request.”
- D — a prompt that starts with the duty to disclose in section 1(1) FOIA and regulation 5 EIR, and that says to withhold only where an exemption is actually engaged.
Apart from the prompt, everything else was the same, and each run had to come back with a decision of disclose, partially withhold or withhold, plus whatever exemptions applied. To match the real world decisions, everything would need to come back as “Disclose”.
| Prompt | Disclosed | Held something back in full or part |
|---|---|---|
| A. FoI Assistant | 30 | 11 |
| B. FoI / EIR Assessor | 31 | 10 |
| C. “respond to this request” | 29 | 12 |
| D. duty first | 38 | 3 |
On this very small test, the council’s prompts perform close to the generic one. What really made a difference was writing the duty to disclose into the prompt itself.
Some caveats: This is not a measurement of Copilot and it used a model that might not be the one they use. Their version might have access to additional data that this test did not show to the model. The sample size is much too small to draw any firm conclusions from. The model was forced to choose between three labels rather than write an actual response to a requester. Prompt D might win by “over disclosing”, so I would also need testing on realistic looking data that you’d expect to be withheld before deciding it is better overall.
All that being said, it seems, perhaps unsurprisingly, that the prompt might matter. I think it will be worth re-running this on a larger test set, once every request handling prompt has been disclosed.
Where this goes next
The project is very much ongoing, with the vast majority of responses still to be provided. Once the initial responses are in, we will publish the full set as structured data. The point of collecting it is so that people are able to test the prompts in the way that I have done for the FOI ones, and to ask follow-up questions.
Beyond the data we’re currently gathering, here is what I would like to know:
- How many of these are actually running? There is currently no indication as to which agents are live versus those that were just small tests. This was a deliberate choice to stay within the cost limit, but it is the most obvious next question.
- Has any of this been through a DPIA, and are these published?
- Do the same errors recur across councils, or is each authority wrong in its own particular way?
- How many of them are listed on the Algorithmic Transparency Recording Standard Hub?
- Has the public been told that the tools exist?