Singapore published the first governance framework for agentic AI on 22 January 2026. One of its requirements is specific and testable: each agent must hold a unique identity, tied to the person who supervises it. Most organisations give an agent an API key instead. This article explains why a key does not satisfy the requirement, what a supervised identity contains, and the anti-falsification rule that decides what an audit trail is worth.
Connect with us about agent governance · · Replies within 24 hours
Yes. Singapore's Infocomm Media Development Authority published the Model AI Governance Framework for Agentic AI on 22 January 2026, and updated it on 20 May 2026. It requires each agent to hold a unique identity that ties to its human supervisor.
The launch announcement gives the reasoning. An agent acts, and an action needs an actor you can name.
The requirement is not a UK obligation today. It is the first published statement of what supervision of software agents means, and other regulators are working on the same problem.
A key proves that a caller holds a secret. It does not say who the caller is, and it does not say who is answerable.
Three properties follow from that difference.
Four facts, each recorded at the time of the action rather than reconstructed later.
The World Wide Web Consortium has published standards that cover the first fact. Decentralized Identifiers give a subject a stable identifier, and the Verifiable Credentials Data Model lets one party make a checkable claim about another. Both are building blocks, and neither one supplies the supervision link.
The EU AI Act states an obligation for high-risk systems in Article 14. Such systems must allow effective oversight by natural persons.
Oversight needs three abilities. A person must see what the system did, understand it, and stop it. An estate that cannot name the actor behind an action fails the first ability, and the other two then follow.
The NIST AI Risk Management Framework treats accountability as a governance function rather than a technical control. Both documents describe an outcome, and neither states how to build it.
The Cloud Security Alliance examined that gap directly in a research note on AI agent governance, published in April 2026.
An audit trail answers a question after the event. Its value depends on one property: whether a party with access could alter it.
Consider two logs. The first is a table of rows, and a database administrator can update any row. The second records each event with a hash of the event before it, and each entry carries a signature. Altering one entry breaks every entry after it, so the change is detectable.
The first log tells you what somebody chose to leave in it. The second tells you what happened.
We build your system on engage.re, and the platform treats your agents as first-class actors.
One production estate on the platform has issued 57,267 narrow grants. Sense Future built engage.re, and it has run in production since December 2025.
Five questions, and each one has a factual answer. The third column states the answer to work towards.
| Question | A weak answer | A strong answer |
|---|---|---|
| How many agents hold their own identity? | They share a service account. | One identity per agent, and no agent shares one. |
| Who supervises each one? | A person maintains a list separately. | A named person, held as a link the system enforces. |
| What may each agent do? | A role, which describes a job rather than a task. | One grant per action, on one defined scope. |
| How fast can you stop one? | A ticket, then a deployment. | On the next call. |
| Could anybody alter the log? | Yes, and nothing would show it. | No, because an alteration breaks the chain. |
The third question deserves separate treatment, and we give it in what may an AI agent touch in your systems. The fifth question decides whether the answers to the others mean anything.
A council deploys agents to triage housing repair requests. The service holds a statutory duty, so a resident may challenge an outcome, and the council must then name the actor and the supervisor. Where twelve agents share one integration account, the council can describe its process and it cannot evidence a single decision.
A care home group deploys one agent to draft shift notes from care records. One agent, one supervisor, and the same obligation. A regulator asks who checked the drafts, and the answer must not depend on a person's memory.
The care home software and school software pages set out the sector detail. Our guides to safeguarding records under KCSIE and CQC digital records cover the human accountability that sits above the agent.
Yes. Singapore's Model AI Governance Framework for Agentic AI, published on 22 January 2026, requires each agent to hold a unique identity tied to its human supervisor. An agent acts, and an action needs an actor you can name. The framework is guidance rather than UK law, and it is the first published statement of the requirement.
A key proves that a caller holds a secret, and it does not say who the caller is or who is answerable. One key often serves several agents and a test harness, so the log records the key and the key names nobody. A key also carries no supervisor and survives a personnel change.
Four facts, recorded at the time of the action. Which agent acted. Who supervises that agent, held as a link to a named person. What the agent was allowed to do at that moment. What the agent did, including the records touched and the time.
Article 14 requires high-risk AI systems to allow effective oversight by natural persons. Oversight needs three abilities: a person must see what the system did, understand it, and stop it. An estate that cannot name the actor behind an action fails the first, and the other two then follow.
Anti-falsification. A log whose rows an administrator can update tells you what somebody chose to leave in it. A log that records each event with a hash of the event before it, and signs each entry, makes any alteration detectable. Volume of logging is not the property that matters.
We build your system on engage.re. One identity model covers your people, your applications and your agents. Every agent holds a supervised account with an enforced link to a named person, permissions are narrow and revocable on the next call, and every access is an event in a signed hash-chained log.
Connect with us about agent governance · · Replies within 24 hours