Everything we've published, searchable.
Research, analysis and practical guidance on governing what AI agents actually do. Filters and topics are derived from the writing itself.
Research, analysis and practical guidance on governing what AI agents actually do. Filters and topics are derived from the writing itself.
60 articles in the Crelis knowledge base.
A practical policy separates agent proposals from permission, names approval states, tests material changes, and keeps evidence for disputed actions.
AI model risk management for Singapore banks is an evidence problem, especially when agents can act at runtime.
Compliance agents can help with review, but verification is not sign-off and evidence must attach to the action.
Agentic AI controls are the limits, checks, approvals, and records that decide what an agent may do before it changes money, data, access, or records.
Agent security maps help only if they lead to evidence for the permission behind a consequential action.
OWASP gives teams a dated field reference for agentic AI risk, not proof that a live action was authorised.
Transparency can explain that AI was involved. It does not prove that an agent had authority to release money, delete a record, or change a credit limit.
NIST's agent standards work matters, but it does not prove that a payment release, deleted record, or changed credit limit was authorised.
MCP approval can move a workflow forward, but the specification text separates transport authorization, elicitation, and later evidence of who had authority for a particular tool call.
MCP authorization uses OAuth to govern access to a server, but it does not prove why a payment release or record deletion was allowed.
MAS’s AI risk management material increases pressure to evidence authorization at the point an agent acts.
MCP Multi Round-Trip Requests make approval easier to place in the request path, but they do not preserve the evidence behind an authority decision.
MCP server guidance can reduce unsafe calls, but the audit problem is proving who authorised the action before money, records, or tools changed.
OWASP maps agentic AI risks; it does not prove who authorised a payment, record change, or refund.
OWASP gives agentic AI teams a threat model, not proof that a payment, deletion, or credit change was authorised.
An LLM judge can return a different verdict on the same facts tomorrow; a deterministic policy engine returns the same decision each time and can name the rule that made it — that difference decides w
Identity tells you who an AI agent is. Authorization tells you it was allowed to act. Evidence tells you that you can still prove both later, to someone who does not trust your dashboard, and that thi
Runtime security asks whether an AI agent's activity is a threat. Runtime authorization asks whether the action was permitted — and whether you can prove who permitted it.
Every governance pilot dies on the same objection: we cannot risk it blocking a live workflow. Shadow mode answers it by deciding nothing at all.
Blocking a bad action proves nothing about the good ones you allowed. Enforcement stops an action; evidence proves, afterwards, that an action was authorized and by whom — and almost no one sells the
MAS SAFR, read for financial institutions: every safeguard the white paper names, the record it implies, and what your agentic AI would have to be able to produce.
MCP can authorize an individual tool call and can pause mid-call for a human decision; what it cannot do is record which policy permitted the action, or keep that record after the call returns.
Entry-tier tracing plans keep traces for days or weeks, while a Singapore capital markets services licence holder must keep the books the Securities and Futures Act requires for not less than five yea
As of January 1, 2026, the legal landscape shifted permanently.
Dynatrace found that nearly half of organizations discard log data, excluding an average of 86% of it. Tamper-evident AI audit logs turn passive monitoring into proof of authorized execution.
What happens when an autonomous agent executes a high-value transfer that no human authorized and no legacy log can explain? MAS and industry published the SAFR white paper in July 2026.
Understanding a model's logic is not a legal defence. The industry is moving from model explainability to verifiable proof of what an agent actually did.
In a high-stakes clinical environment, an AI's output is a mere proposal until a human grants the permission to execute.
Trust is a structural vulnerability in your enterprise AI stack. As autonomous agents scale, the gap between an AI proposal and a permitted action becomes a high-stakes liability. You cannot audit an
An autonomous agent operating without a clinical oversight protocol is a liability, not an asset. In high-stakes environments, the gap between an AI proposal and a finalized execution is where enterpr
ClearPoint found that only 14.7% of AI-related metrics have a named owner. That structural void leaves autonomous agents operating without a definitive chain of command.
Traditional policy frameworks cannot govern non-deterministic agentic systems. Paper-based compliance is dead, and selecting the right AI compliance platform is now a matter of legal survival.
Intelligence isn't authority. A model's capacity to act matters less than your ability to prove why it acted — and what the record has to contain to do that.
The "black box" is not a legal defense. It's a confession of technical negligence. As the EU AI Act transparency obligations take effect on August 2, 2026, the era of blaming the algorithm has ended.
An autonomous AI agent is a high-stakes liability the moment it operates without oversight. The gap between raw model output and enterprise accountability is widening.
McKinsey found that 88% of organizations report regular AI use in at least one business function. Governance has not kept pace, and that gap turns a pilot into a liability.
The era of "move fast and break things" has ended at the regulatory border. Every autonomous decision your system makes is a potential point of failure without a verifiable trail. You know that retros
Autonomous agents can make decisions that a legal team may struggle to defend. Speed is a poor substitute for security. Non-deterministic systems carry inherent risk.
Will your current GRC platform actually stop an autonomous agent from breaching the EU AI Act, or will it simply record the disaster in a tidy PDF? The gap between documentation and enforcement is now
The EU AI Act's high-risk obligations were deferred to 2 December 2027 by the Digital Omnibus. That is preparation time, not a reprieve, and most organizations are not using it.
An autonomous AI agent without a kill switch is not an asset. It is a systemic risk. The EU AI Act's human-oversight duty for high-risk systems now applies from 2 December 2027.
Grant Thornton found that just 18% of banking leaders were fully confident they could pass an independent review of their AI controls in the next 90 days.
The moment an autonomous agent executes a six-figure transfer without explicit human authorization, the technology ceases to be an asset. It becomes a liability. Most enterprises currently operate in
Retool's 2026 survey found 22% of organizations had a production incident caused by an AI-generated internal tool, and 51% could not say for certain either way. That is the liability gap.
Theatrical oversight is the greatest hidden liability in your AI stack. Most governance processes are performances: they leave no evidence that a human ever meaningfully engaged.
From 2 December 2027 the EU AI Act's obligations for standalone high-risk systems begin to apply. "Best effort" AI compliance is running out of road.
The gap between an AI's proposal and an enterprise's permission is where catastrophic liability lives. Trust is a systemic vulnerability. You recognize that LLM agents exhibit unpredictable emergent b
Ungoverned AI agents are not assets. They are liabilities. Without a verifiable governance layer, your production models operate in a vacuum of accountability.
Singapore governs AI through voluntary frameworks, data protection law and sector guidance rather than a binding AI statute — this reference maps each instrument, what it asks of an enterprise, and th
An autonomous agent's mandate is only as strong as the infrastructure that constrains it. Accountability for unauthorized actions is a matter of architectural integrity, not better model training.
Key Takeaways Understand the fundamental distinction between passive data logging and a tamper-evident audit trail AI that provides mathematically detectable proof of every autonomous decision. Le
The framework a bank needs is not a policy document. It is the ability to show, for one agent action, the authority it relied on, the decision that let it through, and a record of both that does not d
Optro found that 85% of enterprises have integrated AI into core operations, while only a quarter have comprehensive visibility into how their employees use it. That gap is a systemic vulnerability.
A standard text file is not an audit trail; it is a liability. A log entry reading "Task Completed" offers no protection when an autonomous agent executes a flawed transaction.
Your autonomous agents are executing transactions and data decisions that your legal department cannot defend in a court of law. The Liability Gap is an active operational vulnerability.
Security decides what an AI agent is able to do; governance decides who is answerable for what it did — and only one of them leaves you evidence.
We have filed our first patent application covering the GREENLIGHT decision runtime.
Policy is not proof. In the high-stakes environment of Singapore’s regulatory landscape, a document stating your AI is "safe" holds no weight against a systemic failure. You're facing a reality where
Why the next era of enterprise AI is not about smarter models — it is about trustworthy execution.
A short film on the question every enterprise will have to answer — who, actually, authorized the AI?