How should organizations govern the risks of agentic AI?

Singapore's Infocomm Media Development Authority lays out its "Model AI Governance Framework (MGF) for Agentic AI" around "four areas for agentic AI": "1. Assess and bound the risks upfront 2. Make humans meaningfully accountable 3. Implement technical controls and processes 4. Enable end-user responsibility." The framework builds on IMDA's "previous model governance frameworks" but argues that general principles for trusted AI — "transparency, accountability and fairness" — "need to be translated in practice for agents," because agents "take actions, adapt to new information, and interact with other agents and systems to complete tasks on behalf of humans" rather than only generate content. IMDA states the framework is meant for organizations "deploying agentic AI, whether by developing AI agents in-house or using third-party agentic solutions."

IMDA grounds the four areas in two agent-specific dimensions it defines explicitly: "action-space (or authority, capabilities)" — "range of actions the agent can take... determined by the tools it is allowed to use and permissions on those tools" — and "autonomy (or decision-making)" — "degree to which an agent can decide how to act towards a goal... determined by its instructions and level of human involvement." The framework treats these as levers organizations tune directly rather than abstract properties: an agent can be bound by "detailed instructions and SOP" or left to use "its own judgment," and its action-space can be narrowed through "access controls," "guardrails," and "human approvals." The rationale for the accountability pillar specifically is that "agent actions emerge dynamically and adaptively from interactions instead of fixed logic," which "diffuses accountability" across "multiple stakeholders" in the agent lifecycle, compounded by "automation bias" as a risk that grows "as humans supervise increasingly capable agents."

This gives a more granular governance vocabulary than Does AI risk increase with the autonomy we give it?, which treats autonomy as a single ceiling to cap; IMDA instead lets organizations bound risk by scoping tools and permissions (action-space) independently of how much judgment the agent exercises within that scope (autonomy), while reaching a similar practical conclusion that unmanaged autonomy is the main risk driver. IMDA's autonomy dimension also complements Can we design AI autonomy separately from capability? by naming what determines the level — instructions plus human involvement — rather than only enumerating the levels. And the "technical controls" pillar (access controls, guardrails, human approvals, logging) echoes the stack view in How do agent security layers connect across the stack?, naming controls distributed across the agent lifecycle rather than treating security as one checkpoint. A companion note, When should AI agents require human approval before acting?, details the accountability pillar's specific checkpoint logic.

The excerpt is a framework's stated method, not an evaluation: it offers no evidence on adoption rates, how often organizations actually implement the four areas, or whether multi-agent interactions make the recommended controls harder to apply once agents call other agents as tools. IMDA presents these as considerations for organizations to weigh, not as findings about what currently happens inside deployed agentic systems, so the framework should be read as a proposed structure for governance conversations rather than a description of current practice.