Singapore Sets a Risk Framework and Shared Platform for Government AI Agents

What happened

On November 5, Singapore's Senior Minister of State Tan Kiat How spoke at GovTech's STACK conference.¹² According to the Ministry of Digital Development and Information, he described two things. The first is the Agentic Risk and Capability (ARC) Framework, which the ministry says connects an agent's capabilities to safeguards. The second is GovHarness, which the ministry describes as shared infrastructure for building and operating AI agents across government.¹ The ministry also reports that the speech said higher-risk actions need stronger controls such as human approval, and that people and organizations stay accountable for outcomes.¹

MediaNama, reporting on November 8, adds detail. It says the ARC Framework separates an agent that recommends an action from one that carries it out, and that higher-risk actions, such as financial transactions, official communications, and data deletion, need stronger controls such as human approval.²

How sure we are. We are fairly sure of this outline, because both sources report the ARC Framework and the need for stronger controls such as human approval. The examples of higher-risk actions and the split between recommending and acting come from MediaNama alone, and GovHarness comes from the ministry alone. We cannot yet say which agencies will use GovHarness, when, or whether the framework is required.

What it means for public leaders

The announcement raises two decisions for anyone who runs a public service.

• Sorting actions by risk. As MediaNama reports it, the framework separates recommending from carrying out, and names financial transactions, official communications, and data deletion as higher-risk actions.² The open question for your agency is whether safeguards rise with what each agent can do, or whether every agent gets the same limits.
• Shared platform or separate builds. Singapore has described shared infrastructure across government.¹ The alternative is for each agency to run its own. That choice belongs to each government, and we take no side.

Our perspective, so far

This is our working view, a hypothesis drawn only from what we have published.

• Our AI Pattern Steps Only a Person May Take recommends naming the few steps no agent takes, such as granting access, deleting records, and sending words in a person's name; agents prepare them exactly, and a person reads, decides, and takes the step. It is Running for access and administrator changes and for the exact text of messages, and Early for requests to a person.³ Data deletion is among the higher-risk actions MediaNama reports.²
• Our AI Pattern A Record of Every Action, with a Way to Undo It recommends recording every action agents take for the organization, including who approved it and how to undo it. It is Running for recording actions and Planned for one log.⁴
• Two research notes describe how access works when agents serve many people. The Chief of Staff and the Staff Agents describes staff agents that serve everyone, by role and by what each person is cleared to see; it is Running for staff agents at this publication and Early for a Chief of Staff for every person.⁵ Agentic Transformation describes one shared knowledge core (the one place where an organization keeps what it knows) at several levels of access, with each person's agent acting only with that person's access; it is Running for the knowledge core and Early for an agent for every person.⁶

Our hypothesis: a human approval protects people best when it is recorded and can be undone, and a shared platform works best when access rules travel with it, so that what each agent may see and do follows the person or role it serves.

How we will test it. We will watch whether Singapore publishes how approvals and access work on GovHarness, and compare that with our own patterns.

What would change our mind. Evidence that a record and a fast undo alone protect people as well as a human approval does for actions such as payments and deletions.

The strongest view against

The strongest argument against our view is that a sign-off before each higher-risk action could become a formality, and that a reliable record and a fast undo might protect residents better than approval up front. It does not yet change our view that a few steps should stay with a person, but the evidence named above would.

For the wider argument, see the book's chapters Frame, Then Free⁷ and What Leaders Decide,⁸ and our Government section.

One step to take

List the actions your agency's AI agents can take. Mark each one that carries out, rather than recommends, a payment, an official message, or a deletion. For each, write down who approves it and where that approval is recorded.

Strictly nonpartisan: GSSF is a 501(c)(3) foundation, and we do not support or oppose any candidate, party, or ballot measure. This section reports on laws and policies; we do not lobby or urge readers to contact officials about legislation. Nothing here is legal, financial, investment, or medical advice.