Singapore wrote the rulebook for AI agents.

On 22 January 2026, at the World Economic Forum in Davos, Singapore launched the Model AI Governance Framework for Agentic AI, the first national framework in the world written specifically for AI agents. It is guidance, not law. The questions it asks are not going away.

The framework comes from the Infocomm Media Development Authority (IMDA), and it exists because agents are categorically different from the AI that came before them. A chatbot answers. An agent acts: it can update a customer database, move a file, make a payment. IMDA’s launch announcement is blunt about what that changes: agents may hold access to sensitive data and the ability to change their environment, which introduces risks of unauthorised or erroneous actions. And it names a subtler problem most security teams have not yet priced in:

The four dimensions

The framework organises everything it asks into four dimensions, and they are worth reading in IMDA’s own words:

• Assess and bound the risks upfront, by selecting appropriate agentic use cases and placing limits on agents’ powers, “such as agents’ autonomy and access to tools and data”.
• Make humans meaningfully accountable for agents, by “defining significant checkpoints at which human approval is required”.
• Implement technical controls and processes throughout the agent lifecycle, “such as baseline testing and controlling access to whitelisted services”.
• Enable end-user responsibility through transparency and education.

Underneath all four runs one principle the framework repeats without hedging: humans are ultimately accountable. The framework is voluntary. The accountability it describes is not.

Why this one travelled

Plenty of AI guidance documents appear every month. This one moved differently. On 20 May 2026, IMDA published an updated edition incorporating feedback from more than sixty organisations, including AWS, DBS, Google and Salesforce, and added more than ten case studies of real agentic deployments from contributors including GovTech Singapore, OCBC, PwC, Tencent and Workday. Singapore also leads the ASEAN Working Group on AI Governance, which makes this framework the natural reference point for an entire region’s regulators.

And frameworks like this have a familiar career path: they become procurement checklists and insurer questionnaires long before anything becomes law. “Do you maintain an inventory of your AI agents and their permissions?” is already a reasonable due-diligence question today. This document is where it will be copied from.

What good looks like: the case studies

The May update is valuable mostly because it shows real organisations operationalising the four dimensions, and the specifics are instructive.

Dayos, a Singapore-headquartered automation company, runs an IT ticketing agent under tiered autonomy: low-severity, fully reversible actions like password resets are fully automated and audited every two weeks; moderate actions are proposed by the agent but executed only with human approval; high-severity, hard-to-reverse actions such as permissions modifications the agent cannot take at all.

Tencent’s CodeBuddy coding agent ships with secure defaults that require human approval for editing files, running shell commands, making network requests or using external tools, explains complex commands in plain English so the approving human actually understands what they are approving, and still routes suspicious commands to a human even when that command type was pre-approved before.

GovTech Singapore rolled out agentic coding assistants in phases: internal employees only, no external tool connections, low-risk systems first, building central logging and monitoring before widening access.

Workday tells users upfront that they are dealing with an agent, discloses the agent’s identity and range of actions, and makes the agent’s reasoning visible to the person reviewing its output.

Strip the company names away and every one of these is the same discipline: know the agent, bound what it can reach, keep a human at the checkpoint, and log what it actually did. The framework’s four dimensions are, underneath, an identity and permissions problem.

The hard part: the agents you didn’t build

Here is what the case studies have in common: they are all builders, governing agents they created and deployed deliberately. That is the easier half of the problem.

Most organisations are also consumers of agents, often without having decided to be. Staff connect AI tools into Microsoft 365, and each one arrives as an OAuth consent, a service principal, a non-human identity with standing permissions into mail, files and data. Nobody designed a tiered autonomy model for it. Nobody defined a checkpoint. It was a user clicking Accept.

Apply the framework’s four dimensions to those agents and they become four questions. Which agents exist in our environment? What can each one reach, and is that more than it needs? Who approved each one, and who owns it now? And what did it actually do last week? For the agents that arrived by consent rather than by project plan, most tenants cannot answer a single one of these today, not because anyone was careless, but because nothing in the default stack keeps that register.

Answering the four questions in Microsoft 365

This is the layer Sabiki AIRM was built for. One scope note first: AIRM governs non-human identities (NHIs), the industry’s term for AI agents, service principals, OAuth apps and connectors. Your people, and their licences, are untouched. Against the framework’s dimensions:

• The register. Every non-human identity in the tenant, discovered agentless through the Graph API: which agents exist, when each appeared, and who created it.
• Bounding. What each identity can actually reach, with over-permissioned access surfaced as findings, so least privilege is something you can enforce rather than assert.
• The checkpoint. Ownership on record for every identity, and nothing changes in the tenant unless a person clicks. In a typical scan, 419 identities become 411 routine approvals and eight that genuinely need a human.
• The audit trail. Continuous monitoring, scan over scan: permission drift on agents you already approved, dormant identities that wake, and what each agentic identity actually did, with findings mapped to eleven governance frameworks for the evidence pack.

If you run tenants for a living

For MSPs in Singapore and across ASEAN, this framework is a gift. It is the national standard, written by the regulator’s own ecosystem, and it hands you the client conversation in one sentence: here are the four questions Singapore says every organisation running agents should be able to answer, and here is where your tenant stands against them today. Voluntary today. Expected tomorrow. The MSPs who can produce the register, the bounding, the checkpoint and the audit trail will be the ones trusted to run AI for their clients.

← Back to the blog