The solution is single-user tax/benefit-account identifiers: someone gives you their authorized-user identifier, you go to the issuer of your private id (SSA, IRS, whoever) with it and get a single-use identifier for you to use for that user, and you give them that, not your main identifier.
Ideally, the identifier they give you would be not be the one that they use to government either, but one tired to it
Ideally, the identifier they give you would be not be the one that they use to government either, but one tired to it