A practitioner's mapping, organised by control objective, control, evidence and owner.
Willy Tai · CA · CIA · governed AI for regulated operations
Existing model-risk frameworks were written for models that only predict. Agentic AI goes further and takes the action itself: it releases payments, refers customers, issues reports. That difference breaks most of the assumptions a second-line risk function relies on, and it is why "we validated the model" is no longer a sufficient answer.
A predictive model produces a score; a human decides what to do with it. The control surface is small and well understood: validate the model, monitor for drift, document the limitations. An agentic system collapses that gap. The thing that produces the answer is often the same thing that takes the action, and it does so thousands of times a day without a human in between. A Singapore-regulated firm can no longer stop at "is the model accurate." It now has to answer a harder question: what is this system allowed to do on its own, and how do we prove it stayed inside the line.
Singapore already has the principles for this. MAS's FEAT guidance, covering Fairness, Ethics, Accountability and Transparency, set the expectations for AI and data analytics in finance; the MAS-led Veritas consortium built an assessment methodology to make FEAT operational; and MAS's 2024 information paper on AI model risk management set out observed good practices across banks. What's missing for most teams is the layer underneath: the concrete controls that satisfy those principles for an agent that acts, and the evidence a second line can actually inspect. This is the framework I use to fill that gap.
I organise agentic-AI governance around five objectives. Each maps to FEAT, each has a control that is implemented in the system rather than written beside it, and each produces evidence an assessor can examine without taking my word for anything.
| Control objective | Control (in the system) | Evidence a second line inspects | Owner | FEAT |
|---|---|---|---|---|
| 1 · Deterministic computation Consequential figures are computed, not generated. |
The trust boundary: numbers that drive a decision are produced by code; the model only phrases. The model is barred from the calculation path. | Architecture showing the code/model split; the computed figure reproduced independently from raw inputs. | 1st line (build) | T · A |
| 2 · Evidential grounding Every output traces to a source, or there is no output. |
Cite-or-abstain gate: an output must reference the record or clause it rests on; with no support, the system abstains. | Sampled outputs with their citations; the abstention rate and a review of what was declined. | 1st line | T · F |
| 3 · Bounded autonomy The agent acts alone only within an agreed envelope. |
Risk-classification + human gate: each action is tiered; consequential actions escalate to a named approver and cannot auto-complete. | The policy defining the envelope; the log of escalations and who approved them; evidence the agent stopped on an open control. | 1st line · 2nd line (sets envelope) | A |
| 4 · Auditability & replay Every decision is reconstructable after the fact. |
Append-only, tamper-evident decision log; each decision re-derivable from its recorded inputs. | A replay run reproducing decisions from inputs; a tamper test that breaks the chain at the altered record. | 2nd line (attests) | A · T |
| 5 · Evaluation & monitoring Performance is measured before and during deployment. |
Pre-deployment eval gate (accuracy, false-positive and abstain rates on a held-out set); ongoing drift and exception-rate monitoring. | The eval report with honest provenance; the monitoring dashboard; the threshold-tuning record. | 2nd line (validates) | F · A |
The framework is deliberately built so the ownership column lines up with how a regulated firm already organises itself. The first line builds the controls into the system: the boundary, the citations, the gates. The second line sets the autonomy envelope and independently attests the replay and the evaluation; crucially, it should not be the same people who built the agent, which is exactly why "self-graded" evidence is the weakest kind. The third line, internal audit, tests that the controls operated as designed over a period. Agentic AI does not need a new governance organisation. It needs the existing one pointed at a new control surface, with evidence it can actually inspect.
I run it as a one-page assessment. For each of the five objectives: is the control present in the system or only in a document? Can the firm produce the evidence column today, or is it an aspiration? Who owns it, and is that owner independent of the build? The answers sort quickly into three buckets: controls that exist and are evidenced, controls that exist but are self-attested, and controls that are still slideware. A firm that can fill the matrix has a defensible position with MAS. A firm that can fill only the first column has an intention.
Two things this framework does not do. It does not make a poorly-scoped automation safe; if you have pointed an agent at a decision that should never have been automated, no amount of logging redeems it, and the most valuable advice is often "don't build this." And it is Singapore-anchored by design. The same five objectives map readily onto the EU AI Act's human-oversight and record-keeping obligations for high-risk systems, but the evidence a European regulator expects differs in the detail. The objectives travel; the specifics are local.
The reason I lead with controls rather than capability is that capability is no longer the scarce thing. Any competent team can build an agent that does the work. The scarce thing, and what a MAS-regulated client is actually buying, is the person who can stand in front of their risk committee and show, objective by objective, evidence column by evidence column, that the system stayed inside the line. That is the work.
Written by Willy Tai, Chartered Accountant and Certified Internal Auditor. The five controls are demonstrated in the case studies. · More writing