Governance at the Point of Action: Singapore's SAFR Signal

Most AI governance lives in a PDF. It describes what an agent should and should not do, gets signed off by a committee, and is filed away. Then the agent goes live and makes decisions at machine speed, thousands of times a day, while the PDF sits in a shared drive.

In July 2026, the Monetary Authority of Singapore drew a line under that model. Together with industry partners including HSBC, J.P. Morgan, OCBC, Mastercard and Visa, MAS published Safeguards for Agentic Finance at Runtime (SAFR): a framework for checking every proposed agent action before it executes.

What SAFR Actually Does

SAFR moves governance from the boardroom to the runtime. Four components work together: an Agent Identity that says who is acting, a Controls Repository that says what is allowed, a Disposition Engine that rules on each proposed action, and an Audit Log that records the outcome. Every action resolves to one of four verdicts: Deny, Escalate, Auto-Execute or Observe.

Authority is not granted once for a whole task. It is checked fresh, action by action.

The Missing Layer

Runtime enforcement answers how an action is checked. It does not answer who is accountable, what outcomes matter, or whether the agent is still fit for its job six months later. Those questions sit in the organisational and performance layers above it.

This is where our FRAME and AAEF frameworks fit. FRAME's Authority dimension already demands that autonomous and prohibited actions be enforced technically. SAFR now provides a reference design for doing exactly that, and AAEF supplies the ongoing appraisal of whether each agent stays within its boundaries.

Conclusion

Regulators have shown their hand. The question for every organisation deploying agents is no longer "Do we have an AI policy?" It is "Can our policy stop an agent in the next 50 milliseconds?" If the answer is no, the time to build that layer is now, before your regulator asks.