Comment on the Model AI Governance Framework for Agentic AI

Box Commons is a 501(c)(6) standards body organized in Wyoming, United States, focused on developing third-party credentialing standards for autonomous AI agent operations. Our credentialing model maps to the NIST AI Risk Management Framework and draws on the HITRUST approach to certifiable, technology-agnostic standards that translate between voluntary and mandatory governance regimes.

Through a related entity, we have submitted three prior comments to the U.S. National Institute of Standards and Technology in 2026: a response to the CAISI Request for Information on AI Agent Security (March 6), a concept paper to the NCCoE on AI Agent Identity and Authorization (March 14), and a public comment on NIST AI 800-2, Practices for Automated Benchmark Evaluations of Language Models (March 18). Each argued that behavioral safety constitutes a distinct domain requiring independent, third-party assessment.

We welcome the opportunity to comment on Singapore's Model AI Governance Framework for Agentic AI. This framework represents a landmark in global AI governance: the first comprehensive governance framework specifically designed for autonomous AI agents capable of multi-step planning, tool use, and independent action execution.

First-mover leadership. By publishing the Agentic AI MGF in January 2026, Singapore has established the reference architecture against which all subsequent agentic governance frameworks will be measured.

The four-dimension structure is well-conceived. The framework's organization around risk assessment, human accountability, technical controls, and end-user responsibility captures the full lifecycle of agentic deployment. The explicit acknowledgment that continuous human-in-the-loop oversight becomes "logistically impractical at scale" for autonomous agents is a candid and necessary observation.

The multi-agent taxonomy is exactly right. The framework's classification of multi-agent architectures into Sequential, Supervisor, and Swarm patterns provides the conceptual vocabulary needed for risk-proportionate governance.

Cross-agency coordination with the CSA. The complementary relationship between the IMDA MGF and the Cyber Security Agency's Addendum on Securing Agentic AI demonstrates institutional maturity.

Testing infrastructure leadership. Singapore's investment in AI Verify, Project Moonshot, and the Global AI Assurance Pilot represents the most advanced government-led AI testing infrastructure in the Asia-Pacific region.

We offer five recommendations focused on a structural gap: the absence of a formalized, third-party behavioral safety evaluation layer between IMDA's governance guidelines and the CSA's cybersecurity controls.

1. Recognize Behavioral Safety as a Distinct Governance Domain. The MGF currently treats behavioral decision-making and cybersecurity as aspects of a single challenge. An agent with perfectly legitimate access to a financial trading API can execute catastrophic, hallucination-driven trades without violating a single cybersecurity access control. These are behavioral failures on an independent axis. IMDA should formally recognize behavioral safety as a distinct governance domain.

2. Establish Third-Party Credentialing for High-Autonomy Deployments. The framework is entirely devoid of requirements for third-party certification. Self-assessment creates a structural conflict of interest. Singapore's own Global AI Assurance Pilot showed that specialized testing required 50–100+ hours and hundreds of thousands of test cases. IMDA should establish a tiered credentialing framework proportionate to autonomy level.

3. Interlock Agent Identity with Behavioral Verification. The CSA Addendum mandates Agent Cards and SBOMs but conditions identity credentials on cybersecurity verification alone. An Agent Identity Credential should be contingent upon holding a valid Behavioral Safety Credential.

4. Extend AI Verify to Continuous Agentic Evaluation. AI Verify and Project Moonshot were engineered for static model outputs, not continuous multi-step workflows. IMDA should develop a standardized agentic evaluation sandbox for prolonged, multi-turn interactions.

5. Standardize Controlled Termination Protocols. The framework recommends operational checkpoints but does not define a technical standard for cleanly terminating an autonomous agent workflow. A controlled termination protocol ensures an agent can be stopped without data corruption, irreversible transactions, or loss of auditability.

Singapore is uniquely positioned to lead on the interoperability challenge: how voluntary and mandatory regimes can converge on shared evaluation standards without requiring regulatory harmonization.

The NIST AI RMF requires rigorous testing. The EU AI Act mandates conformity assessments for high-risk AI systems. ISO/IEC 42001 establishes certifiable AI management systems. Each addresses a different facet, and none includes a standardized mechanism for verifiable behavioral safety assessment.

Third-party behavioral safety credentialing offers a practical bridge. A credential issued under standardized protocols could simultaneously satisfy NIST AI RMF MEASURE requirements, serve as EU AI Act conformity evidence, complement ISO/IEC 42001 certification, and fulfill CAIDP democratic governance standards.

By incorporating third-party behavioral credentialing into the MGF, Singapore would establish a de facto interoperability standard that other jurisdictions could adopt.

The Model AI Governance Framework for Agentic AI is an ambitious and operationally sophisticated document that correctly identifies the paradigm shift from generative to agentic AI. Singapore's willingness to publish this framework as a living document, inviting international input, reflects the collaborative governance model that the complexity of agentic AI demands.

The recommendations in this comment are offered in that collaborative spirit. We believe that behavioral safety credentialing is the structural complement the framework needs to translate its governance principles into verifiable, enforceable, and interoperable standards.