Mind the Agents: Why Singapore’s Updated AI Framework Deserves a Place in the APAC Boardroom

When AI agents begin executing transactions, accessing enterprise systems and coordinating multi-step workflows, conventional AI governance is no longer enough. Policies, employee training and periodic audits still matter. But they were largely designed for systems that generate information for humans to review. Agentic AI introduces something fundamentally different: systems that can plan, decide and act.

That is why an important development from Singapore deserves more attention than it has received.

In January 2026, Singapore’s Infocomm Media Development Authority launched its Model AI Governance Framework for Agentic AI at the World Economic Forum. Then, on 20 May, IMDA released a significantly expanded version.

The update incorporates feedback from more than 60 organisations, including AWS, DBS, Google and Salesforce. It introduces additional guidance on multi-agent systems, third-party agents, automation bias and systemic complexity. It also includes more than ten case studies showing how organisations are applying the framework in real-world deployments.

For enterprises, the update may be more useful than the original announcement. It moves the conversation beyond high-level principles and closer to the operational realities of deploying agents inside complex organisations. For board members, business leaders and regional P&L owners, this is not simply another governance document to forward to legal or compliance. It is more of an operating playbook.

Moving Beyond Static Governance

During the first wave of generative AI adoption, governance was often treated primarily as a policy exercise. Organisations introduced acceptable-use guidelines, conducted employee training and warned teams against placing confidential information into public AI tools.

Those controls remain necessary. But they are no longer sufficient when AI systems can call APIs, access databases, communicate with other agents and execute actions across business systems. Agentic AI introduces a set of operational risks that static policies alone cannot manage.

Agent proliferation

Business units may create, purchase or deploy agents independently, with limited visibility across the wider organisation. Without a central inventory, it becomes difficult to know:

• which agents are active

• who owns them

• what systems they can access

• what authority they have

• which vendors or models they depend on

• how their actions are monitored

This is not merely a technology-management problem; it’s an accountability problem.

Multi-agent and systemic risk

An individual agent may perform acceptably when tested in isolation. The risk changes when multiple agents interact.

They may optimise competing objectives, pass incorrect information between systems, amplify one another’s errors or produce outcomes that were not visible during individual testing.

The updated framework explicitly adds systemic and multi-agent risks, recognising that agent behaviour can become harder to anticipate as agents cross technical and organisational boundaries.

Third-party dependency

Most enterprises will not build every agentic component themselves. They will assemble workflows using external models, agent platforms, APIs, plug-ins, data sources and specialist applications. This creates a more fragmented accountability chain.

Organisations may not have full visibility into how an external agent reasons, what information it retains, how it is updated or how it interacts with other systems. The updated framework therefore adds third-party solutions and overall system complexity as explicit risk factors.

Automation bias

Human oversight can also become weaker as agents appear more reliable. When a system has performed correctly hundreds of times, employees may begin approving its recommendations automatically.

A human may technically remain in the loop while exercising very little meaningful judgement. Singapore’s update recommends monitoring indicators such as override rates and response times to determine whether human oversight is functioning in practice.

The implication is clear. AI governance can no longer sit outside the operating system of the enterprise. It must be embedded into how agents are designed, authorised, monitored and stopped.

From Periodic Audits to Runtime Boundaries

The earlier era of AI governance focused heavily on assessment.

• Was the model tested?

• Was the use case approved?

• Was the risk documentation completed?

• Were employees trained?

Those questions still matter. But agentic systems also require organisations to govern what happens while the system is operating. That means defining the agent’s permitted action space, observing its behaviour continuously and intervening when it moves beyond acceptable limits.

Governance is no longer only about determining whether an AI system should be deployed. It is also about determining:

• what the agent can do

• what it cannot do

• what requires human approval

• how much authority it receives

• how its actions are recorded

• how quickly it can be isolated

• whether its decisions can be reversed

The framework organises these responsibilities around four dimensions:

1. Assess and bound the risks

2. Make humans meaningfully accountable

3. Implement technical controls and processes

4. Enable end-user responsibility

Here is how boards and business leaders can translate those dimensions into enterprise practice.

1. Define the Agent’s Action Space Upfront

Before deploying an agent, organisations should define the boundaries within which it is allowed to operate.

This includes:

• the systems it can access

• the information it can retrieve

• the tools it can use

• the transactions it can initiate

• the decisions it can make

• the actions it can execute without approval

The appropriate level of autonomy should reflect the potential impact of an error, the reversibility of the action and the feasibility of human oversight. Consider an agent managing digital campaign performance. It might be authorised to adjust daily bids within an agreed range. It should not necessarily be allowed to shift significant expenditure between markets, alter brand-safety controls or reallocate an annual media budget without approval.

Similarly, an IT agent may be permitted to reset passwords or route support tickets automatically, while changes to privileged access should require human intervention. The objective is not to remove autonomy.

It is to make autonomy proportional to risk. Every enterprise deploying agents should be able to answer five questions:

• What can this agent do?

• What can it never do?

• Which actions require approval?

• How much harm could it cause before intervention?

• Can its actions be reversed?

If these boundaries cannot be articulated clearly, the agent is not ready for enterprise deployment.

2. Replace Phantom Oversight with Meaningful Accountability

Adding an approval button does not automatically create human accountability. When employees are asked to approve thousands of recommendations, human oversight can become ceremonial.

Teams may click through requests without evaluating the assumptions, reasoning or potential consequences behind them. The framework calls for human intervention at significant checkpoints rather than as a superficial layer added to every task.

These checkpoints should be concentrated around actions that are:

• high-impact

• unusual

• difficult to reverse

• financially material

• legally sensitive

• outside the agent’s normal operating pattern

Organisations should also measure whether oversight is effective.

Useful indicators may include:

• human approval and rejection rates

• frequency of overrides

• reviewer response times

• repeated reasons for escalation

• errors detected by humans

• decisions approved but later reversed

A 100% approval rate should not automatically be interpreted as evidence of excellent agent performance. It may indicate approval fatigue, automation bias or a review process that lacks sufficient information. Accountability also requires clear ownership. The organisation must know who is responsible for the agent’s design, deployment, operation and business consequences. Responsibility cannot sit vaguely between the model provider, platform vendor, technology team, business owner and employee using the system.

3. Build Technical Controls Across the Agent Lifecycle

Governance-ready agentic systems require controls before, during and after deployment. Before launch, agents should be tested across expected scenarios, unusual conditions and adversarial situations.

Deployment should be gradual. Organisations can begin with restricted functionality, lower-risk users, controlled data access or limited transaction authority. Autonomy can then expand as evidence of reliability grows.

Once agents are live, enterprises need logging and monitoring that can reconstruct what happened.

That means recording:

• which agent initiated an action

• which identity and permissions it used

• what information it accessed

• which tools and services it called

• whether another agent was involved

• whether a human approved the action

• what outcome the action produced

Logging should not exist solely for post-incident investigation. It should also help organisations detect unusual behaviour while the system is operating. Enterprises need the ability to isolate an agent, withdraw its permissions, limit transactions or stop a workflow before an error spreads across connected systems.

These mechanisms may include:

• transaction thresholds

• rate limits

• restricted tool access

• approved service lists

• permission withdrawal

• rollback procedures

• agent isolation

• emergency shutdown controls

• circuit breakers between systems

The ability to stop one problematic agent without disabling an entire business process will become an important part of enterprise resilience.

4. Map Third-Party and Multi-Agent Dependencies

Traditional application architecture is already complex. Agentic systems add another layer because agents can select tools dynamically, communicate with other agents and operate across organisational boundaries.

This makes dependency mapping essential. Organisations should understand:

• which third-party agents are involved

• which models or platforms they rely on

• what data moves between them

• where decisions are made

• where information is stored

• which party can modify the system

• who is accountable when an action causes harm

Vendor due diligence will also need to evolve. Enterprise buyers should ask providers for evidence of:

• agent identity and access controls

• testing and assurance processes

• logging and traceability

• update and change-management procedures

• incident-response arrangements

• data-retention practices

• human escalation mechanisms

• dependencies on other agents or services

The principle is simple. An enterprise cannot govern an agentic workflow that it cannot map.

5. Preserve Human Capability and Tradecraft

One of the more important additions in the updated framework concerns the potential erosion of human skills. When agents take over entry-level or repetitive tasks, employees may gradually lose the foundational knowledge required to evaluate their work or take over when systems fail.

The framework describes this as a risk to tradecraft and business continuity. A marketer who no longer understands campaign economics cannot adequately supervise an agent optimising media spend. A financial analyst who loses modelling proficiency may struggle to identify a plausible but flawed projection. A recruiter who depends entirely on automated screening may become less capable of recognising bias, context or unusual potential.

Organisations should therefore train employees not only to use agents, but also to:

• challenge their recommendations

• recognise their limitations

• identify exceptions

• take over when necessary

• operate when the system is unavailable

The goal is not merely AI literacy. It is human-agent operating capability.

Employees should understand what an agent is designed to do, where it is likely to fail, what information it can access, how to override it and how to continue operating without it.

The strongest organisations will use agents to extend human capability without allowing human judgement to atrophy.

Why This Matters to the Board

The May update raises issues that squarely belong in the boardroom.

Agentic AI affects:

• financial authority

• operational resilience

• technology risk

• third-party exposure

• workforce capability

• customer trust

• executive accountability

These are not narrow AI-policy questions. They are enterprise-governance questions.

Boards and executive teams should begin with three questions.

Q1. Do we know which agents are operating across the organisation?

There should be a central registry covering both internally developed agents and third-party solutions. It should document ownership, purpose, autonomy, permissions, system dependencies and risk classification.

Q2. What is the maximum harm an agent could cause?

Leaders should understand the possible financial, operational, customer and reputational impact before human or automated controls intervene. The relevant question is not simply whether the agent is accurate.

It is how far an error can travel.

Q3. Is human oversight meaningful in practice?

Management should examine whether employees are genuinely evaluating agent decisions or approving them automatically. Oversight should be measured and tested, not assumed.

What Builders Should Prioritise

For product leaders, enterprise architects, technology teams and marketers building agentic workflows, governance should be incorporated from the beginning.

That means designing for:

• distinct identities and permissions for agents

• clearly defined autonomy levels

• controlled access to tools and data

• interpretable activity logs

• pre-deployment testing

• continuous monitoring

• exception handling

• human escalation

• safe rollback

• shutdown procedures

• visibility into third-party dependencies

High-performing agentic systems will not be defined by model capability alone.

Their enterprise value will depend on how reliably they operate, how effectively humans supervise them and how quickly the organisation can contain them when something goes wrong.

The APAC Opportunity

Singapore’s framework is voluntary guidance, not legislation. Its importance lies in something more practical. It gives organisations a structured way to translate responsible-AI principles into operational decisions about authority, autonomy, technical controls and workforce readiness.

That is particularly valuable in APAC, where many regional businesses are balancing rapid experimentation with complex regulatory environments, distributed operations and uneven levels of AI maturity.

The organisations that gain the most from agentic AI will not necessarily be those that give agents the greatest freedom. They will be those that understand precisely where that freedom begins, where it ends and how the organisation remains accountable.

Singapore’s updated framework may not have generated many headlines. But it asks the questions that enterprises will eventually have to answer.

Define the boundaries.

Preserve meaningful human accountability.

Build technical safeguards into the system.

Equip people to remain capable decision makers.

That is not governance slowing down innovation.

It is what makes responsible scale possible.

Here is the official IMDA page announcing the 20 May 2026 update:

Updated Model AI Governance Framework for Agentic AI

The updated full framework is available here

Download the updated Model AI Governance Framework for Agentic AI