Singapore MAS Wrote Down Three Runtime Questions for AI Agents in Finance

On 5 August 2026 the Monetary Authority of Singapore answered a written parliamentary question on agentic AI in financial services. The reply came from Deputy Prime Minister and Minister for Trade and Industry Gan Kim Yong, in his capacity as MAS Chairman. It confirmed that MAS is staying with a principles-based supervisory approach, and that the proposed Guidelines on Artificial Intelligence Risk Management, published for consultation in November 2025 and due to be finalised soon, apply to all AI use cases at financial institutions including agentic AI.

Those Guidelines remain at the proposal stage. They have been through consultation and have not been finalised, and any reading that describes them as binding rules today is running ahead of the regulator.

The substance worth a compliance owner's afternoon is the companion paper. On 3 July 2026 MAS published Safeguards for Agentic Finance at Runtime, and it is the first time a financial regulator has written the runtime control problem down as three specific questions.

The three SAFR questions

SAFR addresses what the system is authorised to do, how proposed actions are assessed at runtime before execution, and what records are retained to support review, accountability, and remediation when outcomes diverge from intent.

Read those three together and they describe a component, not a governance programme. Something has to hold the authorisation scope, evaluate a proposed action against it before the action happens, and write down what it decided. In network security that component has a name and thirty years of design behind it. Applied to an agent calling a model endpoint or an internal API over HTTPS, it is a policy decision point sitting on the path of every action.

MAS is explicit that the paper does not carry regulatory force. The framework "does not constitute regulatory guidance or supervisory expectations, nor does it prescribe or anticipate future directions for such guidance or expectations." MAS gave no commitment to making SAFR mandatory and no timeline for doing so. I would still build against it, and the reason is practical rather than deferential: a regulator that has written down the three questions has told you which three questions its supervisors will eventually know how to ask.

Question one: what the system is authorised to do

An agent at a bank runs with a credential. In most deployments that credential carries the union of every permission any user of the agent might need, because it was provisioned once against the agent rather than per interaction.

The authorisation scope SAFR asks about is narrower than that. A relationship manager asks the agent to summarise a client's exposure, and the scope for that action derives from the relationship manager's own entitlements, the client's data classification, and the destination the agent is about to call. Evaluating scope at provisioning time answers a different question from the one asked at runtime. This is the post-authentication gap in a regulated setting: the user authenticated, the agent authenticated, and nothing then established whether this particular action by this particular principal against this particular data was permitted.

The artifact that evidences an answer is a per-request policy decision naming the originating principal, the rule applied, and the outcome.

Question two: assessment before execution

The phrase MAS chose is "at runtime before execution," and the ordering carries the whole requirement.

A control that inspects an action after it executed produces forensic value and prevents nothing. In a payments or advice context that distinction has a cost attached: a trade placed, a limit breached, a client instruction acted on. Mandiant's M-Trends 2026 research, built on more than 500,000 hours of frontline incident response, found the median time between initial access and handoff to a secondary threat group collapsed from over eight hours in 2022 to 22 seconds in 2025. Asynchronous review operates on a different clock from the systems it reviews.

Pre-execution assessment means the decision happens inline, on the request path, with a fail-closed default so an ambiguous action is denied rather than allowed pending review. Enforcement overhead measures under 50 ms in internal DeepInspect testing against LLM inference times of 500 ms to five seconds, which is why the inline placement costs a bank nothing it would notice.

Human oversight belongs in this question rather than beside it. Oversight activates when a policy evaluation produces an escalation instead of a pass or a block, which makes it an output of the decision point rather than a separate committee.

Question three: what is recorded at a consequential decision

MAS asks what records are retained to support review, accountability, and remediation when outcomes diverge from intent.

Note the condition attached: when outcomes diverge from intent. That is a description of an investigation, and an investigation has an evidential standard. The record has to state the caller, the action proposed, the data classification involved, the policy state in force at that moment, the destination, and the outcome. It also has to have been produced by something the agent had no custody over, because a record the acting system wrote about itself carries the self-attestation problem into a supervisory conversation. Application-controlled logging fails on selective logging of the successful path, on modification by the same component that failed, and on loss when the process dies between the action and the log commit.

What sits outside a gateway

Most of the proposed MAS Guidelines describe work no proxy performs, and a vendor mapping that claims otherwise is worth discarding.

Board and senior management oversight of AI risk is an organisational design question. Model validation methodology belongs to model risk management and the quantitative teams who own it. AI lifecycle controls span procurement, development, testing, and decommissioning. Institutional capability building, and the AI Risk Management Toolkit the industry developed under Project MindForge to help firms implement the Guidelines, are programme work. None of it is delivered by a component on the HTTP path.

The SAFR triad is the slice that is, and it is the only slice a gateway should claim. The EU operational-resilience read on the same architecture sits in DORA AI compliance for banks.

The triad as a control table

Three questions, one component, one record store. A supervisor asking any of the three gets an answer from the same query.

DeepInspect

This is the gap DeepInspect closes. DeepInspect sits at the AI request boundary as an external enforcement layer: deterministic, identity-aware, and independent of the agent's own behaviour. Every request is evaluated against who is asking, what role they hold, what data is involved, and which endpoint is about to receive it. Enforcement happens inline and fails closed.

For a bank or insurer reading SAFR, that maps to the triad directly. Authorisation scope is evaluated per action against the originating identity rather than the agent's standing credential. Assessment happens before the action executes, with escalation as a first-class outcome for the human oversight question. The record is written by the enforcement layer, so it survives an investigation into an agent whose own logs are the thing under review. If your firm is preparing for the finalised Guidelines, let's talk today.