Where this goes wrong

A weak answer is rarely a wrong one. It is usually a true statement doing less work than it appears to — a policy that exists but binds nobody, an artefact produced once and never since, a judgement recorded without the person who made it or the basis they made it on. Each entry below names the specific failure for its provision; the obligation page it links to sets out what discharges the duty instead.

The answer that does not hold

• IMDA Agentic AI Framework v1.5 §2.1Assess and bound the risks upfront

  The system prompt offered as the boundary. It is well drafted, it enumerates what the agent must not do, and under test the agent obeys it. What it cannot survive is the question of what happens when it does not, because nothing else stands behind it — and the framework classes exactly this as the kind of limit that triggers a requirement for compensating monitoring rather than one that discharges anything. A second version of the same answer is a service account confined to one system, offered as least privilege. It answers where the agent may go and stays silent on what it may do once it is there.

• IMDA Agentic AI Framework v1.5 §2.1.1 and §2.2.2Reversibility of agent’s actions

  A rollback plan, produced with confidence, against a finding about actions that cannot be undone. It describes restoring a model version or a database snapshot and it is usually a good plan — about the system rather than about the world. Nothing in it retracts a message, cancels an accepted offer or unmakes a disclosure. The subtler form is a scheme with two settings and no middle: because nobody wants to prohibit a useful capability, everything partly recoverable is filed as automatic, and the tier where the judgement belonged is never reached.

• IMDA Agentic AI Framework v1.5 §2.3.3Continuous testing and monitoring

  An observability dashboard offered as the trail. Latency, token spend, error rates and a searchable stream of calls — good engineering, and precisely what a platform vendor ships. Two questions expose it. Ask for the trajectory of one specific decision, end to end, and the answer arrives in fragments that a person has to narrate. Then ask whether the agent’s own service credentials can write to the store those fragments live in. Where the answer is yes, the record documents a blast radius it sits inside, and nothing in it can be relied on to establish what happened on the day it matters.

• MAS Consultation Paper P017-2025Consultation Paper on Guidelines on Artificial Intelligence Risk Management

  The gap analysis performed by searching the draft for the word "agent". It returns four hits, the conclusion is that MAS has not really addressed agents yet, and the work is deferred until the Guidelines are final. Both halves fail. The agentic content is deliberately embedded rather than sectioned off, so the whole lifecycle chapter applies to an agent and the searchable paragraphs are the least of it. And waiting for finalisation skips the one thing that takes longest to build — a materiality methodology in which autonomy is a scored input, without which every downstream intensity setting is derived from a classification that cannot see what the system now does.

• Model AI Governance Framework for Agentic AI v1.5, §§2.1.2 and 2.3.1Bound risks through design by defining agents limits and permissions

  The system prompt offered as an access control. It is well written, it lists the tools the agent must not use and the data it must not touch, and it has never been tested by attempting a forbidden call. On the framework’s own classification that is a non-deterministic limit, so even taken at face value it does not stand alone — it obliges the organisation to layer on monitoring or human review to catch the failures, which nobody has done because nobody registered the prompt as a control of that kind. The second half of the answer is usually a tool list, which records what the agent may reach and never what it may do there.

• Model AI Governance Framework for Agentic AI v1.5, §2.3.2Before deploying, test agents

  “We red-teamed it.” Pressed, that usually turns out to mean the model was red-teamed, or a guardrail layer was, by the supplier, before any tools were attached. Indirect prompt injection surfaces only at system level, where the agent is reading documents, tickets or web pages that somebody else wrote — one government sandbox exercise found an agent navigating to arbitrary URLs because content on a third-party page told it to. A generic corpus fired at the model establishes nothing about the deployment, and is offered as though it establishes everything.