Agentic AI governance in ASEAN: autonomy needs boundaries, checkpoints and proof.

Agent governance became an ASEAN board issue in 2026

Singapore’s Infocomm Media Development Authority launched its Model AI Governance Framework for Agentic AI in January 2026 and updated it with case studies and additional practices in May.

The framework is designed for organisations developing agents or buying third-party agentic systems. Its central message is practical: greater autonomy requires explicit limits, meaningful human accountability, lifecycle controls and informed users.

Bound the agent’s power before deployment

Define the job, the active knowledge scope, the tools the agent may call and the systems it may affect. Use separate permissions for reading, creating, publishing and executing.

A Presentation Agent may be allowed to research approved files and create a draft deck, while sending the deck externally remains a human decision. Autonomy should be granted task by task, not through a broad service account.

• Select use cases whose autonomy can be clearly bounded.
• Whitelist knowledge, tools, destinations and action types.
• Set spend, time and iteration limits.
• Fail closed when identity, policy or approval cannot be resolved.

Make human accountability meaningful

A person cannot be accountable for an action they never had a real chance to review. Approval screens should show the proposed action, material sources, detected risk, destination and expected consequence.

High-consequence actions should pause before execution and record the named reviewer’s decision. Retrospective notification is monitoring, not human-in-the-loop control.

◇

The human checkpoint belongs before the consequence, with enough evidence to make a real decision.

Test and monitor the whole agent lifecycle

Baseline testing should cover normal tasks, denied access, manipulated instructions, failed tools and attempts to exceed the agent’s authority. Live monitoring should connect each action to its identity, knowledge scope, model and approval state.

When an incident occurs, investigators need one timeline from request to outcome. Fragmented logs from models, tools and workflow engines are not enough if they cannot reconstruct causality.