Seven Frameworks in Nine Months: What the Global Rush to Govern Agentic AI Actually Tells Us

I. The pattern behind the paperwork

Between January and August this year, seven governments and standards bodies across four continents each independently concluded the same thing: agentic AI needed its own governance category, separate from the generative AI rules already on the books. Singapore published two frameworks. China published one. Australia, Canada, the Five Eyes cyber agencies and OWASP each published one more. None of them coordinated with each other. All of them arrived at a strikingly similar architecture.

That is not a coincidence, and it is not really seven stories. It is one governance object, described seven times from seven different vantage points: soft-law policy, hard financial regulation, industry security standard, academic risk taxonomy and national security posture. Read individually, each is a useful compliance document. Read together, they are the clearest evidence yet that the industry has settled on where the real governance problem sits: not at the model, and not at the point of disclosure, but at the point of action, the exact millisecond an agent decides to do something in the world.

II. Singapore’s two frameworks, and the point-of-action shift

Singapore published twice this year, and the two documents are worth reading as a pair because together they show governance moving from principle to mechanism inside a single jurisdiction in under six months.

IMDA’s Model AI Governance Framework for Agentic AI (MGF), launched at Davos on 22 January 2026 and updated on 20 May with real-world case studies, was the world’s first governance framework built specifically for autonomous agents. It is voluntary, but organisations remain legally accountable for their agents’ behaviour, and it structures the problem across four dimensions: bounding risk upfront, meaningful human accountability, technical controls, and end-user responsibility. One academic paper on agent identity protocols reads the MGF’s real contribution correctly: it is the first framework to require that each agent carry a verifiable digital identity and an audit trail of which agent acted under whose authorisation, rather than treating agents as generic service accounts.

Then, on 3 July, MAS went further and made the mechanism specific to finance. SAFR (Safeguards for Agentic Finance at Runtime), co-developed with financial institutions under MAS’s BuildFin.ai initiative, does not just say agents should be accountable. It specifies governance checkpoints that verify and record an AI agent’s proposed action before that action executes, with policy-bound execution, real-time validation, auditability and interoperability as the four operating primitives. It builds on Project Mindforge’s earlier AI risk taxonomy, but asks the question the taxonomy left open: what actually stops a non-compliant action at the moment it is about to happen. Crucially, MAS is explicit that SAFR is not regulatory guidance, it is a runtime standard, which is a more interesting move than it sounds: Singapore is trying to get the market to converge on a technical specification before it has to legislate one.

This is Prompts → Loops → Loop Governance made literal. A prompt has no runtime to govern. A loop, an agent iterating, calling tools, delegating, does. SAFR is the first regulator-sponsored document I have seen that treats loop governance as an engineering discipline with its own primitives, rather than as a paragraph inside a broader responsible-AI policy.

III. China’s recall regime, and the vocabulary that matters more than the law

China moved on 8 May, when the Cyberspace Administration, the NDRC and MIIT jointly released the Implementation Opinions on the Standardized Application and Innovative Development of Intelligent Agents, effective 15 July. It is not binding law, but it is the first time China has treated agents as a governance category distinct from generative AI: the document marks the first time China has begun systematically treating agentic AI as a future digital infrastructure and governance object in its own right, rather than simply another application layer built on top of large language models.

Two things about this document are more significant than the headline. First, the decision-authority taxonomy: developers must clarify the boundaries of decisions an agent may take entirely on its own, decisions that require user authorisation, and decisions the user must always retain. That is a cleaner articulation of the human-accountability problem than most Western frameworks manage, precisely because it forces the tiering question at the design stage rather than leaving it as a governance afterthought. Second, and more striking, is the vocabulary: the Opinions put product recall into official governance language for autonomous software, applied to agents deployed in healthcare, transportation, media and public safety. One commentator put the implication bluntly: you cannot recall what you cannot identify. That single requirement, that a recallable agent must first be identifiable and traceable, does more to force auditability into deployment architecture than several pages of principle-based guidance would.

IV. The security agencies and the practitioners: OWASP and Five Eyes

While regulators were writing policy, the people who actually have to defend these systems were writing something closer to a threat model. OWASP’s GenAI Security Project released the Top 10 for Agentic Applications on 9 December 2025, built by more than 100 security researchers and practitioners over more than a year, running from ASI01 (Agent Goal Hijack) through ASI10 (Rogue Agents). Its most useful single concept, for anyone building governance rather than just reading about it, is least agency: granting an agent only the minimum autonomy, tools and permissions its task requires, with autonomy earned through demonstrated safety rather than granted by default.

Five months later, on 1 May, the Five Eyes cyber agencies (America’s CISA and NSA, the UK’s NCSC, Australia’s ASD-ACSC, Canada’s Cyber Centre and New Zealand’s NCSC-NZ) co-published Careful Adoption of Agentic AI Services, which reads as OWASP’s operational counterpart at the deployment level. Its message is unusually blunt for a joint government paper: agentic AI inherits every weakness of large language models, then adds a wider attack surface, more autonomy, and harder-to-trace accountability. Its practical advice is the kind that will make procurement teams uncomfortable and should: never grant agentic AI broad or unrestricted access, and confine it to low-risk, non-sensitive tasks until oversight and evaluation mature.

Note what these two documents share with SAFR and the MGF: continuous monitoring of the agent’s actual behaviour (inputs, tool calls, internal reasoning, decisions, outputs), not a one-time pre-deployment review. Four frameworks, four jurisdictions, one converging answer to “when do you check.”

V. Australia and Canada: the cross-boundary problem, and the public-sector test case

Australia’s contribution is, on the merits, the most technically original of the seven. The AI Safety Institute commissioned the Gradient Institute to study what happens when one organisation’s well-governed agent has to interact with another organisation’s equally well-governed agent, published 9 August as Risks and Controls for Multi-Agent Systems. Its central insight is that safety does not compose: a collection of individually safe agents does not guarantee a safe collection of agents, because interactions between agents create emergent failure modes that no single agent’s controls can reach. The report’s three-tier structure, singular governance, federated governance, and open environments, defined by the minimum common governance binding any two interacting agents, is the first serious attempt I have seen to make cross-organisational agent risk a distinct, analysable governance category rather than a footnote to single-agent safety.

Canada’s Guide on the Use of Agentic Artificial Intelligence, published 22 May by the Treasury Board Secretariat, is less technically novel but more organisationally honest. It draws the distinction that matters for any board evaluating this technology: generative AI describes what should be done in response to a prompt; agentic AI attempts to do it, sequencing steps, calling tools, and pursuing goals over extended periods with limited supervision. Written for federal departments, it is one of the few frameworks explicitly designed to sit on top of an existing generative-AI policy rather than replace it, which is the right instinct: agentic risk is additive to generative risk, not a substitute for it.

VI. Academia is catching up, and it is not being polite about the gap

The panel I consult on these questions has been unusually aligned this year on one point: governance is now the binding constraint, not capability. Stanford’s 2026 AI Index, led by Fei-Fei Li’s institute, documented the gap in numbers that should worry any board treating AI governance as a slide in the annual report rather than an operating discipline: documented AI incidents rose from 233 in 2024 to 362 in 2025, even as organisational AI adoption reached 88% worldwide. Fei-Fei Li’s own framing of what “human-centred” actually requires, interoperability, transparency, accountability and equity, is a useful four-word test to run any of the seven frameworks above against; most pass on transparency and fail on accountability, which is exactly the gap SAFR and the MGF are trying to close.

Stanford HAI went further on 25 August, with a brief titled Designing Loyalty: AI Agents and Conflicts of Interest, arguing that disclosure-based governance is structurally insufficient and that developers and deployers of agents should be held to a formal fiduciary duty of loyalty to the user: the proposal would require entities to act in the best interests of their users within the scope of any delegated task, effectively prohibiting the use of undisclosed conflicts of interest to manipulate user outcomes. This is the first time a major academic institution has proposed treating an agent’s operator the way the law already treats a trustee or a company director, and it is, in my view, the single most important governance idea to come out of academia this year. It converts “the agent should act in the user’s interest” from a design aspiration into an enforceable legal standard.

And then there is Yoshua Bengio, chairing the International AI Safety Report 2026 with over 100 contributing experts and an advisory panel nominated by more than thirty countries. Bengio’s own public framing of the moment has not softened: he describes current systems as ones we are building without knowing how to control, and the convergence of AI with biotechnology as a serious near-term biosecurity concern. Whatever one makes of the more existential end of his warnings, the report’s core recommendation, that governance mechanisms should scale with degrees of agency rather than treat autonomy as binary, is precisely the design principle SAFR, the MGF and Gradient’s tiered framework are all independently converging on.

VII. What actually ties the seven together, and what to do about it

Run all seven through the enforceability test and a single pattern falls out. The frameworks that specify a checkpoint, a decision tier, an identity requirement, or a recall trigger (SAFR, the MGF, China’s Opinions) are enforceable in the sense that a specific party can invoke a specific mechanism when something goes wrong. The frameworks that describe risk without specifying a checkpoint (most of the corporate responsible-AI policies these frameworks are quietly replacing) are not. Stanford’s fiduciary-duty proposal is the missing piece that would make the whole stack enforceable at the legal layer, not just the technical one: it gives the user exposed to an agent’s failure an actual cause of action, rather than a grievance.

For any organisation deploying agentic AI now, the seven documents collapse into three practical requirements, regardless of jurisdiction: every agent needs a verifiable identity and an audit trail of who authorised what; every consequential action needs a defined checkpoint, whether that is a value threshold, an action-rate limit, or a human-in-the-loop escalation, before it executes, not after; and every deployment needs an explicit answer to the cross-boundary question Gradient Institute raised, namely what happens when your well-governed agent talks to someone else’s. Get those three right and you have, in effect, built your own private-sector version of what Singapore, Canada and the Five Eyes each spent the first half of 2026 writing down separately. Get them wrong, and China’s vocabulary is the one that will eventually catch up with you: not a fine, a recall.

Sources: IMDA, “Model AI Governance Framework for Agentic AI” (22 Jan 2026, updated 20 May 2026); Monetary Authority of Singapore, “Safeguards for Agentic Finance at Runtime (SAFR)” white paper v1.0 (3 Jul 2026); Cyberspace Administration of China, NDRC and MIIT, “Implementation Opinions on the Standardized Application and Innovative Development of Intelligent Agents” (8 May 2026); Australian AI Safety Institute / Gradient Institute, “Risks and Controls for Multi-Agent Systems” (9 Aug 2026); Government of Canada, Treasury Board of Canada Secretariat, “Guide on the Use of Agentic Artificial Intelligence” (22 May 2026); CISA, NSA, Canadian Centre for Cyber Security, ASD-ACSC, NCSC-UK and NCSC-NZ, “Careful Adoption of Agentic AI Services” (30 Apr 2026); OWASP GenAI Security Project, “Top 10 for Agentic Applications” (9 Dec 2025); Stanford HAI, “2026 AI Index Report” and “Designing Loyalty: AI Agents and Conflicts of Interest” (25 Aug 2026); Bengio et al., “International AI Safety Report 2026,” Mila – Quebec AI Institute / UK AI Security Institute.