AI can write code.
GovRail makes AI work for government.
Design and build compliant, secure software on standards your state can trust and control.
Government agencies want to move faster.
Design, build, and govern on one set of rails.
A design system your agents can build from.
Agents don't guess. They build from your system. Every generated screen uses your approved components, patterns and standards, keeping AI-generated software consistent.
Built for how government actually works.
Shaped by the constraints only public programs have: Section 508, plain language, multilingual residents, eligibility rules, and legacy systems that cannot go away.
Patterns refined with residents and caseworkers across real benefit programs, so applications get finished, on any device, the first time.
Fewer incomplete applications, fewer errors reaching caseworkers, less rework. Design decisions are judged by program results, not screenshots.
Prototypes are already production parts. Accessibility, copy, and intent travel with the code, and a screen that drifts from the design cannot merge.
Create a plan.
A team of agents builds, reviews, and tests every change before a human sees it.
Not one copilot writing one file. An architect scopes, a subject matter expert brings program knowledge, a coder builds, and an independent reviewer checks the work.
Every change ships with the tests that prove it.
Tests come from the acceptance criteria, before the code exists.
Functional, regression, accessibility, and security checks run before a human opens the pull request.
An agent reproduces each failure and names the cause: test, app, infrastructure, or flake.
Defects become tickets. Test bugs get a fix. Nothing gets lost.
Automated QA compounds. Every feature adds to a self-maintaining regression suite, so the system gets harder to break over time.
Evidence is produced while the work happens.
Each change is checked against the laws, policies, and frameworks the state owns. Failed controls stop the change. Approved exceptions keep their rationale. Every merge leaves signed evidence of what changed, why, and who approved it.
Operate and own what you build.
Operate on the same rails. Monitoring, remediation, new features, and policy updates run through the same gates with the same evidence.
The software runs without GovRail. Host it in your environment or with us; either way, nothing depends on us to keep working.
More teams building. One set of rails. Software you keep.
More agencies building inside statewide rails. Design is respected on every screen: no drift, no unapproved exceptions.
Evidence is a byproduct of every change. Faster ATO and SMC certification.
Each build is cheaper and faster than the last.
Requirements, decisions, and reasons travel with the software.
You keep the software, the standards, and the evidence.
We build with your team, then hand it over.
Our engineers work with your architecture, security, and engineering teams to define standards, controls, and requirements.
We build the first services with your team, proving the approach and creating reusable components.
Your engineers own development. We stay embedded to support the platform, update standards, and help as needs change.
See it build. Live.
Bring a real requirement. We'll design it, build it to your stack, test it, and show you the evidence.
Frequently asked questions
How the platform works, who owns what, and where humans stay in control.
Platform & Positioning4 questions
What is GovRail?
GovRail is an Agentic Software Development Platform for Government. It gives government engineering teams the standards, controls, reusable services, and institutional context they need to confidently build, operate, and improve software with AI.
GovRail is purpose-built around the requirements government software has to meet: security, compliance, accessibility, architecture, reliability, quality, evidence, and human accountability.
How is GovRail different from giving our engineers Claude, Cursor, Copilot, or another coding agent?
General-purpose coding agents know how to write software. They do not automatically know your state’s architecture, security requirements, accessibility rules, design system, approved services, AI policies, exceptions, or the reasoning behind decisions your organization made years ago.
GovRail adds that government-specific context and turns your requirements into enforceable rails around the development process.
The model helps write the software. GovRail helps make sure the software is built the way your government requires.
Does GovRail replace our engineers?
No. GovRail is designed to amplify capable engineers, not replace engineering judgment.
Your engineers remain responsible for the software, and humans stay in control of approvals and exceptions. GovRail makes it possible for an engineer to work effectively without personally being an expert in every state policy, framework, design standard, legacy system, or prior architectural decision.
Who is GovRail built for?
GovRail is built for government technology organizations that want to use AI to increase software delivery capacity without losing control.
Typical stakeholders include:
- CIOs, Deputy CIOs, and Chief AI Officers
- CTOs and engineering leaders
- Enterprise architecture and security teams
- Product leaders
- Software engineers and technical delivery teams
Central IT can define the standards and controls. Engineering teams across government can build inside them.
Standards & Central Control5 questions
How do we make GovRail reflect our standards instead of yours?
The government owns the standards.
GovRail starts with a government-grade baseline, and our team works with yours to encode your:
- architecture standards
- security controls
- accessibility requirements
- development standards
- design system
- approved technology patterns
- testing requirements
- AI-use policies
- internal policies and laws
- reusable services and infrastructure
Those standards remain readable, reviewable, and version-controlled rather than disappearing inside a black box.
What comes in the government-grade baseline?
GovRail is purpose-built for government, so the starting point can include patterns and controls for:
- security
- accessibility
- AI governance
- software quality
- high availability
- testing and QA
- audit evidence
- infrastructure
- localization and multilingual support
- architecture and development standards
- reusable government service patterns
- human approval and exception handling
The state then adds or adapts its own requirements on top of that baseline.
Can central IT establish standards that every agency has to follow?
Yes.
GovRail can support a centralized control model where central IT defines statewide standards and any team building software must operate within those rails.
Agency-specific requirements can be layered on top when necessary without losing the common statewide baseline.
This lets central IT maintain control without requiring every application team to independently rediscover every policy, framework, and standard.
What happens when an agency legitimately needs to deviate from a standard?
GovRail supports controlled exceptions.
An authorized human can approve a deviation, and the exception is documented with:
- the reason for the exception
- the affected control or standard
- who approved it
- when it was approved
- the software change it applies to
The decision remains attached to the software so a future engineer, auditor, or agent can understand not just that an exception happened, but why.
What happens when a state policy or security requirement changes?
The control layer changes with it.
GovRail can update the encoded standard so future changes are evaluated against the new requirement. The same governance model can also be used to identify software affected by the changed standard so teams can understand impact and plan remediation.
The goal is not a one-time compliance exercise. It is continuous governance as both policy and software evolve.
Security, Governance & Evidence7 questions
What stops the AI from shipping something dangerous?
GovRail does not rely on the model to judge whether its own work is acceptable.
Enforcement is deterministic. Changes move through defined workflows and gates with automated checks for issues such as:
- secrets
- sensitive-data patterns
- tenant isolation
- security controls
- test coverage
- accessibility
- architecture requirements
- policy requirements
- required human approvals
Higher-risk changes can require additional human review.
If a required gate fails, the workflow stops rather than quietly lowering the standard.
How does governance work after the software launches?
Launching is only the beginning.
GovRail is designed to support the full software lifecycle. As the application changes, dependencies change, vulnerabilities are discovered, designs evolve, or policies are updated, the software continues to move through the same governed system.
Teams can use GovRail to:
- monitor
- test
- remediate
- introduce changes
- update designs
- assess impact
- re-run controls
- scale infrastructure
- maintain evidence
Governance stays connected to the software over time.
Is GovRail a point-in-time compliance tool?
No.
GovRail is built around continuous governance.
Instead of proving once that a system met a requirement at a particular moment, GovRail keeps the standards and the software connected as both change.
At any point in time, the state should be able to understand:
- what changed
- why it changed
- which controls applied
- what passed or failed
- what exceptions were granted
- who approved the result
What compliance and security frameworks does GovRail support?
GovRail is designed to encode the controls, frameworks, laws, contracts, and policies that apply to a government environment.
It can support published frameworks as well as state-specific requirements and internal policies.
The important distinction is that GovRail does not claim a single software change makes an organization “FedRAMP compliant” or “HIPAA compliant.” Instead, it maps applicable controls into the development workflow and produces evidence showing what was checked for each change.
The current system can produce portable evidence using open standards including OSCAL, CycloneDX, and SARIF.
What kind of audit trail does GovRail maintain?
GovRail preserves the full path behind a change, including:
- what was requested
- how the request was interpreted
- design and architecture decisions
- code changes
- automated tests
- controls that ran
- failures and remediations
- exceptions
- human approvals
- deployment evidence
The goal is not simply to record activity. It is to preserve why the software became what it is.
How is that different from normal audit logging?
Traditional audit logs tell you what happened.
GovRail is designed to preserve enough context to understand why it happened.
That history becomes institutional memory. Future engineers and agents can read the prior reasoning, exceptions, implementation patterns, and decisions that shaped the system.
If the original engineer leaves the state, the context does not leave with them.
Over time, every build gives the next build more context to work from.
Are humans still in control?
Yes.
GovRail provides context, automation, enforcement, and evidence, but accountable humans remain responsible for approvals and exceptions.
The system never vouches for itself.
Development & Delivery6 questions
Does GovRail work with our existing technology stack?
GovRail is designed to adapt to the technology and architectural standards a state chooses rather than force every customer into one application stack.
Your:
- coding standards
- architecture rules
- testing requirements
- approved tooling
- security requirements
- service patterns
can become part of the environment the agents work within.
Our shop is .NET, Java, Python, or something else. Can we still use it?
Yes, provided the environment and workflow are configured for that stack.
The GovRail harness is designed to be customized to the state's technology choices and architectural standards. The value is not a prescribed programming language; it is the governed development system around the engineering work.
How does GovRail fit into Azure DevOps, Jira, ServiceNow, AWS, and our existing toolchain?
GovRail is designed to integrate with the state’s existing technology environment rather than replace it.
It is cloud-provider agnostic and can use standard integration mechanisms, including MCP where appropriate.
Today, GitHub is the supported source-control integration in the current implementation. Additional source-control integrations should be treated as roadmap items until they are production-supported.
Can GovRail help us reuse capabilities across agencies?
Yes.
A major goal of GovRail is to help governments build shared capabilities once and reuse them instead of repeatedly buying or rebuilding the same functions.
Examples can include:
- identity
- notifications
- document handling
- OCR
- common infrastructure
- accessibility patterns
- case-management components
- approved UI patterns
- security services
Where teams share compatible technical standards, these can become a statewide library of approved building blocks.
How does GovRail make software easier to maintain?
GovRail preserves the context behind the software and keeps the software inside a repeatable development and governance process.
That makes it easier to:
- understand why decisions were made
- assess the impact of a change
- automate regression and quality testing
- reuse approved patterns
- maintain evidence
- update policies and standards
- remediate issues
- onboard new engineers
- continue work after the original team changes
The goal is speed without losing order.
What happens after launch? Can GovRail help us maintain what we build?
Yes.
GovRail is intended for ongoing operation and improvement, not just initial generation.
Teams can use the same system to:
- introduce new functionality
- test changes
- understand downstream impact
- remediate vulnerabilities
- update designs
- respond to policy changes
- scale infrastructure
- maintain the audit trail
- continue improving the application
Data, Models & Infrastructure5 questions
Where does our source code go when a developer uses GovRail?
Your source code remains in your source-control environment.
GovRail does not require a Twenty-hosted source-code data plane in the development path. The state maintains control of its codebase and development environment.
Where does our data go?
The intended architecture keeps state code and application data in the state-controlled environment rather than routing them through a proprietary GovRail hosting layer.
Any data sent to an AI model is governed by the state’s own relationship with that model provider and the credentials and policies the state chooses.
Which AI models can we use?
GovRail is designed to work across model providers rather than lock the state into one model vendor.
The state provides the credentials for the model provider it chooses and pays that provider directly.
For software development, we recommend models with strong coding and reasoning capabilities.
Who pays for AI model usage?
The state pays its chosen model provider directly under its own contract.
That keeps model usage and token costs visible to the state rather than bundling or marking them up through GovRail.
Do we have to host the software with Twenty?
No.
The state can operate the resulting applications in its own environment. Twenty can also support hosting if the state prefers that model.
GovRail is used to build, govern, understand, and maintain the software. The resulting software does not require GovRail in order to continue running.
Ownership, Support & Long-Term Operation9 questions
What exactly are we buying?
GovRail combines:
- the software platform
- a government-grade baseline of standards and reusable patterns
- implementation work to encode the state’s requirements
- integration with the state’s development environment
- Forward Deployed Engineers who work alongside state teams
- ongoing improvements to the platform and rails
It is not simply a software license dropped on the doorstep.
What do Forward Deployed Engineers do?
Forward Deployed Engineers work alongside the state’s technical teams to help:
- encode standards and controls
- adapt GovRail to the state’s environment
- establish reusable services and patterns
- support early builds
- train engineering teams
- deploy GovRail improvements
- refine the development workflow over time
- help solve new delivery and governance problems as they emerge
They can remain embedded throughout the contract rather than disappearing after implementation.
How long do your Forward Deployed Engineers stay?
As long as the engagement requires.
They can be treated as an ongoing part of the relationship for the life of the contract, continuously helping the state adapt the platform, train teams, deploy improvements, and evolve its internal software capability.
Who on our staff can actually use GovRail?
GovRail is primarily designed for technical staff.
An engineer does not need to personally be an expert in every state policy, framework, accessibility rule, design standard, legacy system, or prior decision because GovRail makes that context available inside the development process.
The platform amplifies engineers; it does not turn non-technical staff into unsupervised production developers.
What training is required?
The implementation includes training and hands-on support from the GovRail team and Forward Deployed Engineers.
The exact training model should be tailored to the state’s engineering environment, existing tools, and operating model.
What visibility does central IT get into what teams are building?
GovRail records the workflows, controls, decisions, approvals, exceptions, and evidence behind software changes.
This gives central IT a common governance layer across teams.
Broader executive dashboards and portfolio-level visibility can be added as the platform evolves, but the core system already creates the structured information needed to support that visibility.
What do we own if the contract ends?
The state owns the applications it built, its source code, data, infrastructure, and resulting systems.
The current implementation also keeps the state’s standards and generated evidence in readable, portable formats.
Nothing the state built stops functioning simply because the GovRail contract ends.
The important distinction is that the ongoing GovRail enforcement layer would no longer be present. The state would need another process or tool to continue enforcing those standards and controls going forward.
Are we locked into Twenty or GovRail?
No.
The applications produced through GovRail are not proprietary outputs that can only run inside GovRail.
The state can continue operating and developing its software outside the platform.
GovRail’s value is the government-specific context, continuous enforcement, evidence, reusable tooling, institutional memory, and engineering support surrounding the software, not technical captivity.
Can you show that this works in real government software?
GovRail grew out of the tools, patterns, and operating practices used to build and operate real government software.
The platform was not designed in isolation and then pointed at government later. It packages capabilities developed from years of building government systems into a platform government engineering teams can use themselves.