Singapore's Model AI Governance Framework for Agentic AI is a government framework written specifically for AI agents, and its expectations on agent identity, permissions and human approval are more concrete than most organisations' current practice. The Infocomm Media Development Authority (IMDA) launched version 1.0 on 22 January 2026 at the World Economic Forum in Davos, and published version 1.5 on 20 May 2026 (updated 5 June 2026) after feedback from more than 60 organisations. The framework is guidance rather than legislation, but it sets out what a regulator considers good practice for deploying agents. This guide summarises its four dimensions, translates the recommended practices into controls, and maps them to other frameworks. It is for governance, risk and security teams deploying agents in or for Singapore, and for anyone looking for a practical agent governance baseline. Content was checked against the version 1.5 document on 27 October 2026.
Key takeaways
- Four dimensions structure the framework. Assess and bound the risks upfront; make humans meaningfully accountable; implement technical controls and processes; and enable end-user responsibility.
- Agents need their own identities. Version 1.5 asks for unique, verifiable agent identities tied to an accountable owner and issued and tracked centrally to prevent agent sprawl.
- Permissions are bounded by the human. Authority should be least privilege, time or session bound and non-transferable, never more than the authorising human holds, with delegations recorded.
- Prefer structural controls to prompts. The framework favours deterministic, rule-based limits and system-level approval enforcement over prompt-layer guardrails, and says to deny by default when approval infrastructure fails.
- It is non-binding but influential. It builds on the 2020 Model AI Governance Framework, calls itself a living document and is not a statute, so use it as a benchmark rather than a checklist of legal duties.
What it is and who it applies to
The framework is published by IMDA. Mrs Josephine Teo, Minister for Digital Development and Information, launched it at Davos in January 2026. It builds on Singapore's Model AI Governance Framework (2020, second edition) by setting out emerging best practice for agentic systems, and describes itself as a living document to be updated as the field develops. Annex B invites feedback and case studies, which IMDA may incorporate in future versions.
It is addressed to organisations deploying agentic AI, whether they build agents in-house or use third-party solutions. Agentic AI is described as systems of one or more agents that plan, decide and take actions over multiple steps toward a goal set by a user; the focus is agents built on generative AI models. The framework itself does not create legal obligations, and commentators describe it as non-binding. The "obligations" in this guide's title are therefore expectations: organisations in Singapore still have binding duties under laws such as the Personal Data Protection Act (see the Singapore PDPA Guide) and, for critical information infrastructure, the Cybersecurity Act (see the Singapore Cybersecurity Act Guide).
| Item | Detail (version 1.5) |
|---|---|
| Publisher | Infocomm Media Development Authority (IMDA), Singapore |
| Versions | 1.0 launched 22 January 2026; 1.5 published 20 May 2026, updated 5 June 2026 |
| Status | Voluntary guidance; living document; builds on the Model AI Governance Framework (2020, 2nd edition) |
| Audience | Organisations deploying agents, built in-house or bought |
| Structure | Introduction to agentic AI and its risks; four dimensions; Annex A further resources; Annex B call for feedback and case studies |
| Main additions in 1.5 | Controls, logging and monitoring as core agent components; systemic and multi-agent risks; new risk factors for system complexity and third-party solutions; platform providers separated from system providers; automation bias measures; control selection and change management; loss of tradecraft; IMDA's OpenClaw case study and new industry cases |
Structure and key requirements
The introduction lists eight core components of an agent: model, instructions, memory, planning and reasoning, tools, protocols, controls, and logging and monitoring. It names five types of risk (erroneous actions, unauthorised actions, biased or unfair actions, data breaches and disruption to connected systems) and, new in 1.5, systemic and multi-agent risks: decisions too fast for oversight, cascading errors, agent sprawl, collaborative failures such as miscoordination or collusion, and emergent behaviour.
| Dimension | Section | Recommended practices | Controls that evidence it |
|---|---|---|---|
| 1. Assess and bound the risks upfront | 2.1.1 use-case suitability; 2.1.2 limits by design | Assess likelihood and impact (tolerance for error, sensitive data, external systems, scope and reversibility of actions, autonomy, complexity, third-party provision); limit tool and system access, autonomy and area of impact; prefer deterministic limits; unique agent identities; least privilege permissions; judge residual risk | Agent risk assessment per use case; agent inventory; scoped credentials; sandboxed environments |
| 2. Make humans meaningfully accountable | 2.2.1 responsibility allocation; 2.2.2 human approval | Define internal roles and value chain roles (model developers, platform providers, system providers, deployers, end users); contractual clarity including logs of tool calls and access history; checkpoints for high-stakes, irreversible, outlier and user-defined actions; enforce approval at system level; deny by default if approval systems fail; counter automation bias | RACI per agent; contracts; approval workflows; override and response time metrics |
| 3. Implement technical controls and processes | 2.3.1 design and development; 2.3.2 pre-deployment testing; 2.3.3 continuous testing and monitoring | Structural, rule-based controls first, model-based safeguards for harder risks, runtime controls such as rate limits and input validation; controls for planning, tools, protocols (for example allowlisting MCP servers) and multi-agent interactions; test whole workflows repeatedly in realistic environments; gradual rollout; monitoring, alerts, failsafes, immutable logs; change management | Policy engine, MCP allowlist, eval suites, observability, change records |
| 4. Enable end-user responsibility | 2.4 | Tell users what the agent can do, what data it accesses and whom to contact; educate on failure modes and data policies; protect foundational skills and tradecraft | Disclosures, user guidance, training records |
Identity and NHI requirements
Section 2.1.2 contains the most specific identity guidance of any government agent framework we have reviewed. Translated into controls:
- Unique, verifiable identity: each agent should have its own identity, described in the framework as cryptographically verifiable, rather than sharing a service account or borrowing a user's session. Use workload identity, certificates or per-agent OAuth clients. See the Agentic AI Identity Guide.
- Accountable owner: the identity should be tied to a supervising agent, human user or department, and recorded according to the capacity in which the agent acts (for itself or on behalf of someone).
- Central issuance and tracking: all agent identities should be issued and tracked centrally to prevent sprawl. In practice this is an agent inventory linked to your identity platform; see the Shadow AI Discovery Guide for finding the ones that bypass it.
- Least privilege, time bound, non-transferable: give agents only the tools and data the task needs, bind authority to a time window or session, and do not let it be passed on. Provide explicit escalation paths for elevated permissions.
- Bounded by the human: an agent should never hold more permissions than the human who authorises it. This rules out the common pattern of giving an assistant a broad service account that exceeds its user's rights.
- Recorded delegation: keep a record of who delegated what to which agent, so actions can be traced back to an accountable person.
| Framework expectation | Practical control | Evidence to keep |
|---|---|---|
| Unique, verifiable agent identity | Per-agent workload identity or OAuth client; no shared keys | Identity register listing agent, credential type, issuer |
| Tied to accountable owner | Mandatory owner attribute at registration; orphan detection | Ownership report; quarterly attestation |
| Issued and tracked centrally | Single registration path through identity platform | Inventory reconciliation against discovered agents |
| Time or session bound | Short lived tokens, just-in-time elevation | Token lifetime configuration; elevation logs |
| Not more than the authorising human | Delegated tokens (on-behalf-of, token exchange) instead of broad service accounts | Scope comparison reports; access reviews |
| Delegations recorded | Delegation chain in token claims and audit logs | Audit trail linking actions to users |
For the governance processes behind these controls, see the Identity Governance for AI Agents Guide.
Implementation steps
- Inventory and classify: list every agent in use or in development, including third-party agents and those built on low-code platforms, and record the eight components for each (model, instructions, memory, planning, tools, protocols, controls, logging).
- Run use-case suitability assessments: score each agent against the framework's likelihood and impact factors. Where the framework suggests a deterministic workflow would serve better, consider not using an agent at all.
- Bound by design: restrict tools and systems, set autonomy limits through standard operating procedures, and confine high impact agents to self-contained environments. Issue unique identities and least privilege, time bound credentials.
- Allocate responsibility: name decision makers, product owners, cyber security and users internally, and set out obligations with model developers, platform providers and system providers in contracts, including access to tool call logs and access history.
- Design approval checkpoints: define which actions need human approval (high-stakes, irreversible, outlier, user-defined), enforce them in the system rather than the prompt, keep requests short with risk information, and configure deny by default if the approval service is unavailable. See the AI Agent Action Approvals and Spending Limits Guide.
- Test before deployment: test task execution, policy compliance, tool calling and robustness across whole workflows and multi-agent interactions, repeatedly and with varied data, using automated judges alongside human review.
- Roll out gradually and monitor: start with a limited user group, monitor the user-agent, agent-tool and reasoning layers, set threshold alerts (for example unauthorised access attempts or too many repeated tool calls), and define termination and fallback procedures for serious malfunction. The AI Agent Kill Switch and Containment Guide covers the mechanics.
- Manage change: define review triggers (technical, environmental, performance, regulatory) and scale review effort to the risk of the change, from light review for prompt edits to full governance review for model changes.
- Inform and train users: disclose AI use up front for external users; for internal users, add training on oversight and keep core skills alive in case agents fail.
Decision guidance: a small organisation using one vendor agent can meet the spirit of the framework with a written risk assessment, contract terms on logging, a short approval policy and user disclosures. A large deployer with many in-house agents needs a central agent registry, an identity platform issuing agent credentials, a policy engine for approvals and a monitoring pipeline.
Evidence and assessment
There is no certification or formal assessment scheme attached to the framework. To show alignment to customers, auditors or regulators, keep evidence per dimension:
- Dimension 1: use-case risk assessments, residual risk decisions, agent inventory, identity register, permission scopes.
- Dimension 2: responsibility matrix, contracts with value chain parties, approval policies, approval logs, oversight quality metrics.
- Dimension 3: control design records, pre-deployment test results, monitoring dashboards, alert records, immutable logs, change records.
- Dimension 4: user disclosures, factsheets, training material and completion records.
Metrics: the framework itself suggests measuring oversight through override rate and response time and checking for outlier reviewers. Add:
- Percentage of agents with a unique identity and a named accountable owner (target 100%).
- Percentage of agents whose permissions are within those of their authorising human.
- Share of high-stakes actions passing through system-enforced approval.
- Approval override rate and median reviewer response time, by reviewer.
- Threshold alerts per agent per month and time to intervene on high priority alerts.
- Agents with pre-deployment test results less than one release old.
Mapping to other frameworks
| Singapore framework dimension | NIST AI RMF 1.0 | ISO/IEC 42001:2023 | NIST CSF 2.0 and SP 800-53 Rev. 5 | OWASP Agentic Top 10 |
|---|---|---|---|---|
| 1. Assess and bound risks; agent identity and permissions | MAP, MANAGE | AI risk assessment and treatment | PR.AA-01, PR.AA-05; AC-6 Least Privilege; IA-9 | ASI03 Identity and Privilege Abuse; ASI02 Tool Misuse |
| 2. Meaningful human accountability | GOVERN | Leadership, roles and responsibilities | GV.RR-02 | ASI09 Human-Agent Trust Exploitation |
| 3. Technical controls, testing, monitoring | MEASURE, MANAGE | Operation, performance evaluation | DE.CM-09, ID.IM-02; SA-11, AU-6 | ASI01 Agent Goal Hijack; ASI08 Cascading Failures; ASI10 Rogue Agents |
| 4. End-user responsibility | GOVERN, MAP | Information for interested parties | PR.AT-01 | ASI09 |
These are our mappings, not IMDA's. If you are also pursuing the EU AI Act or an agent certification, see the Agentic AI Compliance Guide and the AIUC-1 Agent Certification Guide; AIUC-1's mandatory tool authorisation, logging and approval controls give useful evidence for dimension 3.
Common pitfalls
- Treating it as a legal checklist: the framework is guidance and has no certification. Map it to your binding obligations separately, and do not claim "compliance" with it.
- Shared service accounts for agents: the most common gap against section 2.1.2. Shared credentials make identities neither unique nor traceable to an owner.
- Agents with more access than their users: assistants running on broad integration accounts break the "bounded by the authorising human" expectation.
- Approval enforced in the prompt: instructing the model to "ask before deleting" is a prompt-layer guardrail; the framework asks for system-level enforcement and deny by default on failure.
- Rubber-stamp oversight: reviewers approving everything quickly is automation bias. Track override rates and response times as the framework suggests.
- Working from version 1.0: version 1.5 added multi-agent risks, monitoring as a core component and change management. Check you are using the current document.
Practitioner checklist
- Confirm you are working from the current IMDA version (1.5 when checked) and track updates.
- Inventory all agents and record their eight core components.
- Complete a use-case suitability and residual risk assessment for each agent.
- Issue unique, verifiable identities with named owners through one central process.
- Scope permissions to the task, bind them to a session or time window and cap them at the authorising human's rights.
- Define approval checkpoints, enforce them at system level and deny by default if approval fails.
- Test whole workflows before deployment and monitor in production with threshold alerts and failsafes.
- Set change review triggers and disclose agent use and limits to users.
Standards and references
- IMDA: Model AI Governance Framework for Agentic AI (version 1.5)
- IMDA: New Model AI Governance Framework for Agentic AI (press release)
- Covington Inside Global Tech: Singapore Updates Model AI Governance Framework for Agentic AI
- NIST: AI Risk Management Framework
- NIST: Cybersecurity Framework 2.0
- NIST: SP 800-53 Rev. 5
- OWASP GenAI Security Project: Top 10 for Agentic Applications
Related NHI Mgmt Group resources: Agentic AI Compliance Guide · Agent Governance and Risk Guide · Agentic AI Risk Assessment Template · Singapore PDPA Guide. This guide summarises the IMDA Model AI Governance Framework for Agentic AI and is not legal advice.