Use the MGF for Agentic AI in Modulos

Modulos has two Frameworks for the IMDA Model AI Governance Framework (MGF) for Agentic AI. The two Frameworks have the name Singapore MGF for Agentic AI:

• OFF-17 at the Organization level. You add it to the organization AI System.
• MFF-17 at the AI System level. You add it to the AI System of each agentic AI system.

The MGF for Agentic AI is voluntary guidance. It is not law. See The MGF for Agentic AI.

Set up the AI Systems

For the MGF for Agentic AI, Modulos recommends one organization AI System and one AI System for each agentic AI system. The MGF does not set this structure.

AI System	Framework	Work in the AI System
The organization AI System	OFF-17	The work for all agents, for example who does each task in the agent value chain, the risk assessment method, and the central agent catalog
One AI System for each agentic AI system	MFF-17	The work for one agentic AI system, for example its risk assessment, its limits, human oversight, tests, deployment, and user information

An agentic AI system can contain one agent or more than one agent (MGF §1.1). Thus, one AI System with MFF-17 can contain more than one agent. See AI agents and systems.

The Requirements of MFF-17 refer to work in OFF-17:

• MRF-311 refers to ORF-390 for the risk assessment method of the organization.
• MRF-312 refers to ORF-391 for the central agent catalog.

Do this work one time in the organization AI System. Then use the method and the central agent catalog in the work of each AI System. Some MGF sections have Requirements at the two levels. The table in Requirement table gives the MGF sections of each Requirement.

Organization AI Systems

Frameworks at the Organization level, for example OFF-17, attach to the organization AI System of your organization. You cannot make a new organization AI System in the AI Registry. If your organization does not have one, contact Modulos Support before you add OFF-17.

Select the system scope

For the Singapore MGF for Agentic AI, your organization selects the scope of each agentic AI system with MFF-17. Find the system scope before design and development. Check if the system operates one agent or more than one.

The Requirement MRF-317 applies only when the system operates more than one agent. If the system operates one agent, set the status of MRF-317 to Out of scope. Record in MRF-317 that the system operates one agent. For the status of a Requirement, see Requirements.

For multi-agent systems, action-space, and autonomy, see Multi-agent systems and Action-space and autonomy. For the risk assessment of an agentic use case, see Risk assessment before development or deployment.

Requirement table

The table gives each Requirement of the Singapore MGF for Agentic AI in Modulos. The MRF codes are Requirements of MFF-17 (AI System). The ORF codes are Requirements of OFF-17 (Organization). For each Requirement, the table gives the MGF sections and where to find more information.

Requirement	Requirement name	MGF sections	Information
MRF-311	Determine agent use-case suitability and risk context	§§1.1.3, 1.2.3, 2.1.1, 2.1.2	Action-space and autonomy, Systemic and multi-agent risks, Risk assessment before development or deployment, Residual risk
MRF-312	Bound agent authority by design	§2.1.2	Limits on agents, Deterministic limits, Agent identity and authorization, Residual risk
MRF-313	Design and audit meaningful human oversight	§2.2.2	Human oversight
MRF-314	Implement technical controls during design and development	§2.3.1	Controls for agents
MRF-315	Test agent workflows and multi-agent behavior before deployment	§2.3.2	Test agent workflows before deployment
MRF-316	Deploy gradually, monitor continuously, manage agentic change	§2.3.3	Deployment and monitoring
MRF-317	Govern multi-agent and cross-system interactions	§§1.1.2, 1.2.3, 2.3.1, 2.3.2	Systemic and multi-agent risks, Test multi-agent systems
MRF-318	Disclose agent identity, authority, data use, and escalation	§2.4.2, and §2.4.3 for users who integrate agents	Information for users
MRF-319	Red-team agents and assess third-party components	§§2.2.1, 2.3.2	Red teaming and threat modeling, Contracts and external agents, Test agent workflows before deployment
ORF-389	Allocate value-chain and internal responsibilities for agentic AI	§2.2.1	Agent value chain
ORF-390	Maintain agentic risk and change-management methodology	§§2.1.1, 2.2.1, 2.2.2, 2.3.3	Risk assessment before development or deployment, Teams and accountability, Human oversight, Change management
ORF-391	Maintain central agent catalog	§2.1.2	Central agent catalog
ORF-392	Train integrating users and preserve manual fallback competence	§2.4.3	User training

Work sequence

For the MGF for Agentic AI, Modulos recommends the sequence of work below. The MGF does not give this sequence. The sequence follows the MGF lifecycle in §2.3: design and development, tests before deployment, and deployment with monitoring.

1. Do the Organization work. In the organization AI System, start with ORF-389, ORF-390, and ORF-391.
   • Select who does each task in the agent value chain and in your organization. See Agent value chain and Teams and accountability.
   • Write the risk assessment method and the change management method of your organization.
   • Make the central agent catalog. See Central agent catalog.
2. Do the risk assessment of each agentic AI system. In each AI System, do the work of MRF-311 and MRF-312.
   • Check if the system operates more than one agent. See Select the system scope.
   • Do the risk assessment of the use case. The MGF recommends that organizations "assess the risk against the benefits" (§2.1.1).
   • Set limits on the access, autonomy, and impact of each agent.
   • See Risk assessment before development or deployment and Limits on agents.
3. Prepare human oversight and the work with external parties. Do the work of MRF-313 and MRF-319.
   • Prepare the checkpoints for human approval. See Human oversight.
   • Examine the agents and components from external parties before you use them. The MGF does not give a time for this work. See Contracts and external agents.
4. Add the technical controls. Then test the agents before deployment. Do the work of MRF-314 and MRF-315.
   • If the system operates more than one agent, also do the work of MRF-317.
   • Start the red teaming of MRF-319 in this step, before deployment.
   • See Controls for agents and Test agent workflows before deployment.
5. Prepare the users. Do the work of MRF-318 and ORF-392.
   • Prepare the information for users. The MGF recommends that the user interface tells users that they interact with agents "at the point of interaction" (§2.4.2). For the other information, the MGF does not set a location.
   • Give training to the users who integrate agents into their work. Help them keep their "foundational skills" (§2.4.3).
   • See Information for users and User training.
6. Deploy and monitor. Do the work of MRF-316, with the change management method of ORF-390.
   • The MGF tells organizations that pre-deployment testing "needs to be complemented by continuous monitoring and testing during deployment" (§2.3.3).
   • The MGF recommends that organizations "consider gradually rolling out agents into production" (§2.3.3).
   • For the MGF's "can consider" guidance on monitoring (§2.3.3), see Deployment and monitoring.
   • For changes to agents during their lifecycle, see Change management.
7. Review the Requirements. Do the Review of each Requirement. See Review Requirements.
8. Examine the "earlier dimensions" again after anomalies. The MGF recommends that organizations "re-evaluate the earlier dimensions, re-assessing and further bounding the risks if needed" after anomalies during "implementation or monitoring" (§2).

Review Requirements

For the Singapore MGF for Agentic AI, the Requirement Owner does the Review of each Requirement of MFF-17 and OFF-17. The Requirement Owner examines the completed work and makes the decision if the Requirement can have the Fulfilled status. For the conditions of a Review, see Requirements.

The Review of a Requirement does not record a decision about residual risk. See Work not held in Modulos.

Work not held in Modulos

For the MGF for Agentic AI, your organization makes the governance decisions and operates the technical controls of its agentic AI systems. Modulos does not make these decisions and does not operate these technical controls. In Modulos, you record the work for each Requirement and its status. Modulos does not hold these items:

• The decision about residual risk. Make the decision in the governance of your organization, with the MGF guidance on residual risk (§2.1.2). Modulos has no function that records a decision to accept residual risk. In MRF-311 or MRF-312, record the work that you do before the decision.
• The technical controls of your agents. Your organization makes and operates the technical controls of its agents. Examples are access limits, human approval steps, and mechanisms to "take agents offline" (§2.1.2). See Controls for agents.

Related information

• MGF for Agentic AI: the status of the MGF, its four dimensions, and its sources.
• FAQ.
• New AI System: how to make an AI System in Modulos.
• Requirements: Requirements, their status, and their Review.
• Control overlap: the Controls that more than one Modulos Framework uses.

Sources

• IMDA (Infocomm Media Development Authority), Model AI Governance Framework for Agentic AI, Version 1.5 ("Published 20 May 2026", "Updated 5 June 2026"), §§1.1, 1.1.2, 1.1.3, and 1.2.3 (pages 6–12), and §2 (page 13). It also uses §§2.1.1, 2.1.2, 2.2.1, 2.2.2, 2.3, 2.3.1, 2.3.2, 2.3.3, 2.4.2, and 2.4.3 (pages 15–47).

Disclaimer

This page gives general information. It is not legal advice.