Appearance
Components and risks of agentic AI
Section 1 of the IMDA Model AI Governance Framework for Agentic AI (MGF for Agentic AI), Version 1.5, gives the basic information for its four dimensions. This information is about agents, their components, multi-agent systems, action-space and autonomy, and the risks of agentic AI.
AI agents and systems
The MGF for Agentic AI gives this information about AI agents (§1.1):
There is no consensus on what defines an AI agent, but there are certain common features – agents usually possess some degree of independent planning, decision-making, and action-taking (e.g. searching the web or creating files) over multiple steps to achieve a user-defined goal.
An agentic AI system is a software system that has one or more AI agents (§1.1). These agents "may operate individually or collaboratively".
IMDA tells organizations: "In this framework, we focus on agents built on generative AI models" (§1.1). Usually, such an agent uses a language model to make decisions and complete tasks. This model is a small language model (SLM), a large language model (LLM), or a multimodal large language model (MLLM). The MGF tells organizations that "software agents are not a new concept" and that there are other types of agents. For example, some agents use deterministic rules or other neural networks to make decisions.
IMDA's MGF for Agentic AI gives voluntary guidance, not law.
Agent components
The MGF for Agentic AI gives eight core components of an agent (§1.1.1). It puts them in three groups:
- Components 1 to 3 are the core components of a "simple LLM-based app". An agent uses them "in similar ways".
- Components 4 to 6 let an agent complete "more complex tasks".
- Components 7 and 8 are "components for safe and reliable performance". An agent "usually also has" these components.
| No. | Component | Information in the MGF for Agentic AI (§1.1.1) |
|---|---|---|
| 1 | Model | An SLM, LLM, or MLLM that "serves as the central reasoning and planning engine" of the agent. It "processes instructions, interprets user inputs, and generates contextually appropriate responses". |
| 2 | Instructions | "Natural language commands that define an agent's role, capabilities, and behavioural constraints". An example is a system prompt for an LLM. |
| 3 | Memory | "Information that is stored and accessible to the LLM, either in short or long-term storage". Memory is "Sometimes added to allow the model to obtain information from previous user interactions or external knowledge sources". |
| 4 | Planning and reasoning | The model "is usually trained to reason and plan". Thus, it "can output a series of steps needed for a task". |
| 5 | Tools | Tools "enable the agent to take actions and interact with other systems". Examples are "writing to files and databases, controlling devices, or performing transactions". "The model calls tools to complete a task." An agent can also be a tool for a different agent, for example when "one supervisor agent invokes another specialist agent for a certain task". |
| 6 | Protocols | "Standardised ways for agents to communicate with tools and other agents". An example for communication between agents and tools is the Model Context Protocol (MCP). An example for communication between agents is the Agent2Agent Protocol (A2A). The MGF identifies protocols as "a fast-developing space" in which "more protocols are being developed to standardise agent interactions, especially in agentic commerce". |
| 7 | Controls | Controls "limit the agent's action-space and autonomy". The types of controls "most relevant to agents" are access controls, guardrails, and human approvals. |
| 8 | Logging and monitoring | Logging and monitoring "records agent actions, decisions, and interactions across all components to enable monitoring, debugging, and accountability". |
The MGF for Agentic AI gives this information about the three types of controls in component 7 (§1.1.1):
- Access controls — these "limit what an agent is allowed to see, use or change, including restricting access to sensitive data, tools and systems".
- Guardrails — these "monitor and constrain an agent's behaviour before, during or after it acts". Guardrails can help to find "unsafe instructions, policy violations, or actions that appear inconsistent with user intent".
- Human approvals — "Requirements for a human to review or approve agent actions".
Multi-agent systems
The MGF for Agentic AI tells organizations that, in an agentic system, "it is common for multiple agents to be set up to work together" (§1.1.2). This has two effects:
- Each agent can "specialise in a certain function or task and/or work in parallel".
- The tools and permissions of each agent "can be separately scoped and defined, compared to a single agent with access to many tools".
The MGF for Agentic AI gives "Three simple design patterns for multi-agent systems" (§1.1.2):
| Design pattern | How the agents work |
|---|---|
| Sequential | The agents "work one after another in a linear or otherwise structured workflow e.g. a graph". The output of each agent is the input of the next agent. |
| Supervisor | "One supervising agent coordinates specialised agents under it, calling specific agents as tools when required." |
| Swarm | The agents work at the same time. An agent gives the work to a different agent when it is necessary. |
The MGF for Agentic AI tells organizations that "There is no universally correct architecture for a multi-agent setup, and the task at hand can require different or hybrid patterns" (§1.1.2). It gives two examples:
- "A well-defined task with a step-by-step workflow can lend itself to a sequential architecture".
- "A more open-ended task that requires brainstorming or pursuing different lines of inquiry may benefit from a swarm architecture".
Action-space and autonomy
The MGF for Agentic AI tells organizations that "the design of each component can significantly affect what the agent can do" (§1.1.3). It adds that it is "generally helpful to distinguish between two concepts when considering what an agent can do":
- Action-space (or "authority, capabilities") — the range of actions that are available to the agent. This range includes the transactions that the agent can do. The tools that the agent has permission to use, and the permissions on those tools, set its action-space.
- Autonomy (or "decision-making") — the "Degree to which an agent can decide how to act". For example, an agent with more autonomy can make decisions about the steps of its task. The instructions of the agent and the level of human involvement set its autonomy.
SOPs are standard operating procedures (§2.1.2, footnote 19).
The MGF for Agentic AI gives examples of a "software engineering agent" with different action-spaces and different levels of autonomy (§1.1.3):
| Example (§1.1.3) | Small action-space | Large action-space |
|---|---|---|
| More autonomy | The agent can read all files to find the cause of problems. It cannot write, and it cannot access external systems. | The agent can independently use the web, write code, do tests, and "deploy features and fixes". |
| Less autonomy | The agent can see the names of the files, but it can read a file only after approval. It cannot write to files or access the web. | The agent can use the web and read and change files. It can do this only with human approval at each step, or "according to a fixed SOP", or with human approval and "a fixed SOP". |
The autonomy of an agent "mainly depends on its instructions and the level of human involvement in the agentic system" (§1.1.3):
- Instructions — "An agent instructed to follow a detailed SOP to complete a task would be limited in the decisions it can make at each stage." But "An agent instructed to use its own judgment to complete a task would have more freedom to define its plan and workflow."
- Level of human involvement — the four levels are in Human approval.
For instructions, the MGF for Agentic AI gives two levels: "Detailed instructions and SOP", and "Using its own judgment" (§1.1.3). The MGF also tells organizations: "In enterprise deployments, most agentic implementations are hybrid systems combining deterministic rules with some autonomy." The MGF does not give "hybrid systems" as a level of instructions or of autonomy.
Tool access
The MGF for Agentic AI tells organizations that "An agent's action-space mainly depends on the tools it has access to" (§1.1.3). The tools have an effect on two properties:
- The systems that the agent can access:
- Sandboxes only — "Sandboxed tools (e.g. for code execution, data analysis) that cannot affect any other system".
- Internal systems — tools in the organization, for example tools that let the agent "search and update the organisation's databases".
- External systems — "Tools that enable the agent to access external services", for example to get and change data "through third-party pre-defined APIs".
- The actions that the agent can do on these systems — some agents can only read and get information from a system. These agents cannot write or change data in the system.
The MGF for Agentic AI identifies the computer use agent as "An emerging modality of agentic AI" (§1.1.3). Its primary tool is access to a computer and a browser. Thus, it can do all actions that a person can do with a computer and a browser, for example to click and type. It does this "without having to rely on specifically defined tools and APIs". The MGF tells organizations: "This significantly increases what the agent can access and do."
In §2.1.2, the MGF for Agentic AI tells organizations that they "should consider defining limits on" three properties of an agent. These properties are its access to tools and systems, its autonomy, and its area of impact. See Limits on agents.
Human approval
The MGF for Agentic AI identifies the level of human involvement as "Another relevant factor" for the autonomy of an agent (§1.1.3). It gives four levels of human involvement:
| Level (§1.1.3) | Work of the person and the agent |
|---|---|
| "Agent proposes, human operates" | "The human reviews and approves every agent action." |
| "Agent and human collaborate" | The person and the agent work together. The agent "requires human approval at significant steps, such as before writing to a database or making a payment". But the person "can intervene anytime by taking over the agent's work or pausing the agent and requesting a change". |
| "Agent operates, human approves" | The agent "requires human approval only at critical steps or failures, such as deleting a database or making a payment above a predefined amount". |
| "Agent operates, human observes" | The agent "does not require human approval as it completes its task, though its actions may be audited after the fact". |
In §2.2.2, the MGF for Agentic AI tells organizations that they "should define significant checkpoints or action boundaries that require human approval, especially before sensitive actions are executed". See Human oversight.
Agent risks
The MGF for Agentic AI tells organizations that "The new components of an agent constitute new sources of risks" (§1.2.1). It adds that "The risks themselves are familiar", because "agents are software systems built on LLMs". Agents "inherit traditional software vulnerabilities", for example SQL injection. Agents also have LLM-specific risks, for example hallucination, bias, data leakage, and "adversarial prompt injections".
The MGF for Agentic AI tells organizations that the risks "can manifest differently through the different components" (§1.2.1). Its examples are:
- Planning and reasoning — because of hallucination or semantic misalignment, an agent can "create a plan that cannot achieve the requested task, or that contradicts the user's intent, or drifts from an earlier plan". Semantic misalignment is an "incorrect interpretation of the user's intent".
- Tools — an agent "can hallucinate and call non-existent tools, make errors by calling the wrong tools, calling the right tools with the wrong input, or call tools in a biased manner". Tools connect the agent to external systems. Thus, prompt injections or code injections can also make the agent "exfiltrate or otherwise manipulate the data it has access to".
- Protocols — new protocols "can be poorly deployed or compromised". An example is "deploying an untrusted MCP server that contains code to exfiltrate the user's data".
The MGF for Agentic AI gives five types of risk (§1.2.2). It tells organizations: "Because agents take actions in the real world, when they malfunction, it can lead to harmful real-world impact. Organisations should be aware of these negative outcomes".
| Type of risk (§1.2.2) | Information in the MGF for Agentic AI |
|---|---|
| Erroneous actions | Incorrect actions, for example "an agent fixing appointments on the wrong date or producing flawed code". "The exact harmful outcome depends on the action in question". For example, "flawed code can lead to exploited security vulnerabilities, and wrong medical appointments may affect a patient's health outcomes". |
| Unauthorized actions | "Actions taken by the agent outside its permitted scope or authority". An example is "taking an action without escalating it for human approval based on explicit human instruction, a company policy, or standard operating procedures". |
| Biased or unfair actions | "Biased or unfair output is a known problem for LLMs and can translate to biased actions in agents". These actions "lead to unfair outcomes, especially when dealing with groups of different profiles and demographics". Examples are "biased vendor selection in procurement, disbursements of grants, and/or hiring decisions". |
| Data breaches | "Actions that lead to the exposure or manipulation of sensitive data", for example "personally identifiable or confidential information". One cause is "a security breach, where attackers exploit agents to reveal private information". A different cause is "an agent disclosing sensitive data due to a failure to recognise it as sensitive". Agents "generally have greater access to data, and can not only leak but also wrongly modify data". |
| Disruption to connected systems | Agents connect to other systems. Thus, agents "can cause disruption to connected systems when they are compromised or malfunction". Examples are "deleting a production codebase, or overwhelming external systems with requests". |
Systemic and multi-agent risks
The MGF for Agentic AI tells organizations that "The speed and complexity of agentic systems can increase the risks above" (§1.2.3). These risks are the sources of risk in §1.2.1 and the types of risk in §1.2.2. The MGF gives two effects:
- Speed and volume — "The speed at which agents take decisions make it difficult for oversight mechanisms to detect and prevent unauthorised actions in real-time before they cause harm." Also, "Requiring human approvers to continuously oversee agents as a safeguard can also lead to automation bias and alert fatigue."
- Cascading or compounding effects — "A mistake in one step can propagate and amplify across later steps, resulting in outsized impact." For example, "in supply chain management, an initial hallucinated inventory figure could potentially cause downstream actions to reorder excessive or insufficient stock".
"Multi-agent systems exacerbate these risks because of the increase in number of interacting agents" (§1.2.3). For example, multi-agent systems "often require agents to share context, memory, and intermediate outputs with other agents". This increases the likelihood that sensitive data is "unintentionally logged, passed to less secure agents, or exposed through prompt injection attacks".
"The extent to which multi-agent systems introduce qualitatively different risks is still being studied" (§1.2.3). The MGF gives these risks as "some of the more pertinent ones":
| Risk (§1.2.3) | Information in the MGF for Agentic AI |
|---|---|
| Agent sprawl | "The uncontrolled proliferation of AI agents without centralised management", which can occur "As more AI agents are created and deployed within the organisation". This can cause "issues with provenance, incompatibility between old and new agents, and/or difficulties in managing agents from different generations that may not communicate well". |
| Collaborative failures: miscoordination | "Agents working together can lead to unintended failures through bad communication or miscoordination." For example, "agents working on the same task may interpret the user's intent differently, and work towards different goals". |
| Collaborative failures: conflict | "Agents optimising different goals can come into conflict." For example, "a customer support agent may offer refunds to resolve complaints quickly, while a revenue protection agent may block refunds above a certain threshold". |
| Collaborative failures: collusion | "Agents may develop behaviours that appear coordinated, even if no explicit instruction to collude was given." For example, "pricing agents used by different organisations could observe each other's prices and converge on higher prices rather than competing". "This behaviour has already been studied for pricing algorithms" and "is being studied for LLM-based agents". |
| Unpredictability and other emergent behaviors | "When multiple non-deterministic agents work together, the number of possible outcomes grows exponentially. This can cause emergent behaviours that cannot be predicted from testing each agent individually." |
Agents "can interact both within a system or across systems" (§1.2.3). "When agents cross system or organisational boundaries, it becomes more difficult to test for and anticipate the spectrum of potential outcomes, especially if an organisation does not have white-box access to these external systems."
To prevent agent sprawl, §2.1.2 of the MGF for Agentic AI tells organizations that "all agent identities (and their attendant permissions) should be issued from and tracked by a centralised system". See Central agent catalog.
Use the framework in Modulos
In Modulos, the Organization Framework OFF-17 and the AI System Framework MFF-17 contain the Requirements for the MGF for Agentic AI. In MFF-17, the Requirement MRF-317 applies only to an AI System that has more than one agent. For the procedure and the Requirements of each Framework, see Use the MGF for Agentic AI in Modulos.
Related information
- The MGF for Agentic AI: the framework, its sources, and its four dimensions.
- Risk assessment and limits on agents (§2.1).
- Controls, tests, and monitoring for agents (§2.3).
- FAQ about the MGF for Agentic AI.
Sources
- IMDA (Infocomm Media Development Authority) — Model AI Governance Framework for Agentic AI, Version 1.5, "Published 20 May 2026", "Updated 5 June 2026". PDF. §§1.1, 1.1.1, 1.1.2, 1.1.3, 1.2.1, 1.2.2, 1.2.3, 2.1.2, and 2.2.2.
Disclaimer
This page gives general information. It is not legal advice.