Understanding authorisation for digital identity

Australia’s digital identity program will give you a secure way to prove your identity online, letting you access more government services when and where you want.

Understanding authorisation - with an illustration of a man pushing an older woman in a wheelchair

The first stage of the program will allow you to access services for individuals. In the future, your digital identity will enable you to access services on behalf of a business or even on behalf of someone who authorises you.

Authorisation, in the context of government, is when a person is given permission to do something on behalf of another person or a business. This includes accessing government services. 

There are formal ways to give this permission, but often it happens more casually. For example, when someone applies for a government grant on behalf of their local community group, this permission might occur through a conversation at a monthly meeting. 

We’ve been working with agencies, people and businesses to better understand how authorisation happens in real life and what challenges people are facing when authorising others for government services. In the service design and delivery process, this stage is called discovery

There are a few different types of authorisation. So far, we’ve been focusing our research on:

  • individuals acting on behalf of other individuals
  • individuals acting on behalf of businesses

Individuals acting on behalf of other individuals

There are many situations in which someone might access government services on behalf of someone else. 

We uncovered three main reasons -- lack of capacity, lack of capability and lack of motivation or interest:

  1. A person with a physical or mental disability might lack the capacity to interact with government on their own. In these cases they may have a high level of reliance on the person acting on their behalf.

    For example, Christian works part-time but spends most of his time caring for his mother who suffers from dementia. Christian needs to be able to access government assistance on behalf of his mother so she can get the help she needs after her doctor found her to be physically and mentally incapable of completing these tasks.

  2. A person with a low level of digital literacy or someone who does not speak English as a first language might lack the capability to use government services.

    For example, Jess is from a Vietnamese-speaking background and migrated to Australia with her parents 25 years ago. She started assisting her parents by accessing services on their behalf when they moved, as English has always been a barrier for them here.

  3. A person might have no motivation or interest, instead relying on others to help out.

    For example, Mary is an entrepreneur, and mother of two with her husband, Phil, who works full-time as a tradesman. Mary is a very organised person, who handles all the tax and finances within her household.

Individuals acting on behalf of businesses

During discovery we got feedback from over 200 business owners and employees across Australia and learned that authorisation arrangements can range from casual to formal.  

In most cases, each person who deals with government online on behalf of a business must have their own AUSkey. This is used to sign in to make tax payments or complete business reporting, amongst other tasks.

Sometimes business owners knowingly share one AUSkey with their accountant or employees so they can complete tasks for them because they believe this is the easiest way to get work completed.

While people may not see any harm in doing this, it can pose serious security risks that makes it hard to protect the reputation and interests of their business. 

What we’ve learned

All in all, people find it complicated. Available ways of interacting with government do not always match the nature of business or personal relationships. 

This leads to people not getting the help they need, or using their own workarounds to get tasks done, which can put people and businesses at risk.

Insights such as these help us understand people’s needs for convenience and security as we start integrating authorisations into the digital identity program. 

It’s important for us to understand the complex situations in which people undertake  authorisation, so we can develop an approach to digital identity that takes these unique needs into account.