TL;DR: Agent governance frameworks differ by what they control: Singapore’s Model AI Governance Framework for Agentic AI covers risk limits, human checkpoints, technical controls, and user responsibility, while OWASP’s Top 10 for Agentic Applications covers security risks. Basil C. Puglisi’s three agent models sort agents by where a named human stands, and most organizations need more than one.
What does an agent governance framework have to control?
An agent framework has to control action, because agents do more than answer questions. Singapore’s Ministry of Digital Development and Information described the shift when it launched the Model AI Governance Framework for Agentic AI at Davos on January 22, 2026. Agents can act on their environment, “such as updating a customer database or making a payment,” which introduces risks “for example unauthorised or erroneous actions.” The release also warns of “greater automation bias, or the tendency to over-trust an automated system that has performed reliably in the past.”
The Singapore framework organizes its guidance into four dimensions:
- “Assessing and bounding the risks upfront by selecting appropriate agentic use cases and placing limits on agents’ powers such as agents’ autonomy and access to tools and data”
- “Making humans meaningfully accountable for agents by defining significant checkpoints at which human approval is required”
- “Implementing technical controls and processes throughout the agent lifecycle, such as baseline testing and controlling access to whitelisted services”
- “Enabling end-user responsibility through transparency and education/training”
A second kind of framework addresses security. The OWASP GenAI Security Project describes its Top 10 for Agentic Applications for 2026 as a framework “that identifies the most critical security risks facing autonomous and agentic AI systems,” developed with “more than 100 industry experts, researchers, and practitioners.” A security list names what can go wrong with an agent’s tools and permissions. The list leaves open who answers when something does.
Singapore’s framework answers how to bound an agent’s risk, and OWASP’s list answers what can go wrong technically. That leaves a third question: where the human with authority actually stands in the agent’s workflow. Comparing frameworks by which of these questions each one answers is more useful than ranking them, because a governance model, a security list, and a checkpoint architecture do different jobs.
How do the three agent models compare?
Basil C. Puglisi, MPA, answers the third question with an agent layer that defines three agent models, now named HAIA Agents. His paper from the definition problem to running code sets them side by side:
| Agent Model 1 | Agent Model 2 | Agent Model 3 | |
|---|---|---|---|
| Designation | Responsible AI | Hybrid: the machine runs through to AI Governance | Manual Human AI Governance |
| Where the human stands | Signs the charter and any stop or resume; reviews no output | Signs the manifest, every answer decision, and every synthesis; a second governor countersigns high-risk work | Performs and decides every step |
| What stops a bad output | The instrument gates, hard stops, flags, and handoff to the human | The governor’s reject at the checkpoint | The human, directly |
| Fits | Low to moderate risk, routine lanes | High-risk decisions | Highest-consequence and novel work, framework development |
In Agent Model 1 no person reviews each output, so the paper labels it Responsible AI. Agent Model 2 lets the machine dispatch, collect, and record while a named governor accepts, modifies, or rejects each answer. Agent Model 3 has no software agent at all. On the page explaining what an AI agent is, choosing among the three “is itself a checkpoint decision, recorded with its risk rationale.”
The paper is direct about status and limits. For Agent Models 1 and 2, “Neither is deployed, and in the build record neither has yet called a live AI provider,” and “Neither has had a professional security review.” The paper labels both builds Alpha, which “does not mean deployment readiness.” It adds that “The gateway in Agent Model 2 establishes what was signed, not what was read,” which is the same gap The Minds That Bend the Machine explores: Chapter 16 reviews Stuart Russell and asks how anyone verifies that a signer understood what was approved.
What test separates a governed agent from an ungoverned one?
The test turns on authority rather than autonomy. In Basil’s analysis of why agentic AI was always going to fail, the Named-Human Test asks whether a named person holds binding authority to approve, modify, or halt the output, and answers for it through at least one of four channels: moral, professional, civil, or criminal. “If no, the system is Responsible AI (automation without a named human bound to the output) regardless of how autonomous it is.”
That test gives a way to read any agent framework. Singapore’s second dimension asks for “significant checkpoints at which human approval is required,” which points in the same direction. A security list such as OWASP’s strengthens the controls around the agent but leaves the authority question to the organization. A framework passes the test only when the organization can name the person, show that person’s authority to stop the agent, and produce the decision record.
Basil’s book Governing AI: When Capability Exceeds Control sets out the highest-stakes version in Chapter 7, “Autonomous Weapons and Meaningful Human Control,” whose section on implementation standards calls for documented human authorization, independent review, and audit trails that preserve operator dissent. In The Minds That Bend the Machine, Chapter 28, “The AI Industrialist,” carries the question to embodied systems, where an agent’s error becomes a physical event.
An organization that already runs agents can start with an outside read. Puglisi Consulting’s AI Deployment and Agent Review “compares what was promised with what was delivered and finds where the deployment broke from its own plan,” and it covers “the AI agents given access to company data and processes.” It is one option among many.
Questions Readers Ask
Which framework is best for governing AI agents?
No single framework covers everything. A governance model such as Singapore’s sets risk limits and checkpoints, a security list such as OWASP’s names technical risks, and a checkpoint architecture such as the three agent models places the named human. Organizations usually combine kinds rather than choosing one.
Is Singapore’s agentic AI framework a law?
The Ministry of Digital Development and Information describes the framework as guidance to organizations on how to deploy agents responsibly, built on Singapore’s Model AI Governance Framework, which the release dates to 2020. It recommends technical and non-technical measures and emphasizes that humans are ultimately accountable. Legal duties depend on each jurisdiction’s own law.
What is the difference between Agent Model 1 and Agent Model 2?
In Agent Model 1, a human signs a charter and the machine acts on every step after it, so its output is labeled Responsible AI. In Agent Model 2, the machine dispatches and records while a named governor accepts, modifies, or rejects each answer and synthesis, which makes each signed checkpoint AI Governance.
Can a fully autonomous agent count as governed?
Autonomy alone does not decide it. Under the Named-Human Test, an agent is governed when a named person holds binding authority over its outputs and answers for them. Where outputs move too fast for review, that person signs the policy authorizing the class of outputs, and accountability attaches to that signature.
Where should a company start with agent governance?
Start with an inventory of every agent and what it can touch, then set limits on autonomy and access. Next, choose the agent model for each use by risk and record that choice. Finally, name the person with authority to stop each agent and keep the decision record.
Sources
Ministry of Digital Development and Information. (2026, January 22). Singapore launches new Model AI Governance Framework for Agentic AI [Press release]. https://www.mddi.gov.sg/newsroom/singapore-launches-new-model-ai-governance-framework-for-agentic-ai–/
OWASP GenAI Security Project. (2025, December 9). OWASP Top 10 for Agentic Applications for 2026. https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/
Puglisi, B. C. (2025). Governing AI: When capability exceeds control (2nd ed.). https://basilpuglisi.com/governing-ai-when-capability-exceeds-control/
Puglisi, B. C. (2026, June 4). Why agentic AI was always going to fail. basilpuglisi.com. https://basilpuglisi.com/why-agentic-ai-was-always-going-to-fail/
Puglisi, B. C. (2026, October 13). HAIA agents: From the definition problem to running code. basilpuglisi.com. https://basilpuglisi.com/haia-agents-running-code/
Puglisi, B. C. (2026). The minds that bend the machine. https://basilpuglisi.com/minds-that-bend-the-machine/
Puglisi, B. C. (n.d.). What is an agent? Code, human, or both. basilpuglisi.com. https://basilpuglisi.com/agents/
Puglisi Consulting. (n.d.). Advisory reviews. https://puglisiconsulting.com/advisory-reviews/
#AIgenerated from #AIassisted content under HAIA Ecosystem
Free for personal, educational, and noncommercial research use with attribution. Commercial exploitation, paid productization, and enterprise commercialization require separate permission and licensing.
Suggested citation: Puglisi, B. C. (2026). Compare the most effective AI governance frameworks for managing agent-based systems. basilpuglisi.com.
Leave a Reply