IMDA Model AI Governance Framework for Agentic AI

The document exists. The ledger fetched it at its publisher and quotes it.

Record ID

AAL-2026-0024

Kind

Guidance

Jurisdiction

Singapore

Last verified

15 September 2026

Added

15 September 2026

• The framework opens by saying there is no consensus on what defines an AI agent, but that agents usually possess some degree of independent planning, decision making and action taking over multiple steps to achieve a user defined goal.
• It states that humans must remain accountable and properly manage the risks of agentic AI.
• It lists controls and logging among the core components of an agent, naming access controls, guardrails and human approvals, and logging that records agent actions, decisions and interactions.
• It describes itself as a living document written for organisations deploying agentic AI, whether built in house or sourced from a third party.
• The version checked is version 1.5, published 20 May 2026 and updated 5 June 2026.

Limits, Human approval, Logging and audit, Accountability, Identity. Stated means the document you can open below says it; silent means the ledger read the document and it does not.

LimitsStated

Organisations are told to bound an agent's scope of impact by design, limiting access to tools and external systems at the planning stage.IMDA, Model AI Governance Framework for Agentic AI, primary source, 20 May 2026.

Human approvalStated

Significant checkpoints in the agentic workflow should require human approval, in particular for high stakes or irreversible actions.IMDA, Model AI Governance Framework for Agentic AI, primary source, 20 May 2026.

Logging and auditStated

Logging and monitoring is named as a core component of an agent, recording actions, decisions and interactions to enable accountability.IMDA, Model AI Governance Framework for Agentic AI, primary source, 20 May 2026.

AccountabilityStated

The framework warns that agent autonomy complicates responsibility assignments tied to static workflows and that multiple actors diffuse accountability, so responsibilities must be defined explicitly.IMDA, Model AI Governance Framework for Agentic AI, primary source, 20 May 2026.

IdentityStated

Identity management and access controls for agents are named as measures that make an agent's actions traceable and controllable.IMDA, Model AI Governance Framework for Agentic AI, primary source, 20 May 2026.

1. 4 dimensions

   Dimensions in the framework

   IMDA, Model AI Governance Framework for Agentic AI, primary source, as of 20 May 2026.

This is the most usable checklist a deploying team can pick up today, and it is free. Work through its four dimensions in order: decide which use cases an agent may take, bound its permissions before writing code, name the humans who are answerable, and tell your end users what the agent can reach.

1. IMDA, Model AI Governance Framework for Agentic AIPrimary · 20 May 2026
2. IMDA press releasePrimary · 22 January 2026

• VerifiedGuidanceAAL-2026-0025

  ICO tech futures report on agentic AI

  United Kingdom · verified 15 September 2026

  The ICO states that as developing agentic AI increases the potential for automation, organisations remain responsible for data protection compliance of the agentic AI they develop, deploy or integrate in their systems and processes.

• Open questionOpen questionAAL-2026-0031

  Who is liable when a delegated agent exceeds its mandate

  Global · verified 15 September 2026

  The EU AI Act allocates duties to providers and deployers, and does not address an agent acting beyond its instructions.

• Open questionOpen questionAAL-2026-0033

  How does a sub agent's authority attenuate

  Global · verified 15 September 2026

  RFC 8693 lets a token record that one party is acting for another, but does not require the exchanged token to be narrower.