Singapore’s GovTech is building a register of every AI agent in government, recording who owns each one and what it does. It is building that register before deploying agents across 150,000 public officers, not after.
The order is the whole lesson. Almost every organisation will do this the other way round.
A chatbot answers. An agent acts.
The distinction sounds like hair-splitting until you look at what it covers. A chatbot gives you an answer and you decide what to do with it. An agent does the thing itself. It approves an invoice, updates a customer record, moves funds between accounts.
That changes who carries the consequences. When a chatbot is wrong, someone reads the answer and catches it, or does not. When an agent is wrong, the invoice is already paid.
Accountability for that stays exactly where it was. It sits with the manager who deployed the agent, or authorised it, or inherited it from someone who left. In most organisations that manager cannot see what the agent actually did, which is an uncomfortable combination: full responsibility, no visibility.
What Singapore is actually doing
Three things are worth taking seriously here, and all three are checkable rather than promised.
IMDA, Singapore’s Infocomm Media Development Authority, has published a Model AI Governance Framework for Agentic AI. Keeping humans meaningfully accountable is one of its four pillars, which is a stronger position than most governance documents take. It does not say a human should be consulted. It says a named human remains answerable.
GovTech is building the ownership register described above, ahead of the 150,000-officer rollout. Not a policy about registers. An actual list.
Singtel has restructured its corporate organisation to manage blended human and AI teams. That is a telecoms company deciding its org chart needs to account for something that is not a person and is not a tool either.
None of that requires you to care about Singapore. It matters because it converts an abstract worry into something with a shape: somebody built the list, and they built it first.
The failure has a name
The risk being guarded against is AI sprawl. Agents created without central oversight, drifting past their intended purpose, reaching data they were never meant to touch.
What makes sprawl worth naming is that nobody decides it. It accumulates. One team automates a handover. Someone in finance sets up a reconciliation that runs overnight. A supplier’s tool starts doing something on your behalf that nobody quite authorised, because authorising it was a checkbox in an onboarding flow.
Each of those is reasonable on its own. The problem is only visible in aggregate, and only if somebody is keeping the aggregate.
A register is not a policy
There is a version of this that goes wrong, and it is worth naming because it is the more likely outcome. An organisation reads about agent governance, agrees it matters, and writes a policy.
A policy says what should happen. A register says what is happening. Those are different documents and only one of them tells you anything you did not already know. The policy will say agents must be approved and owned. The register will tell you about the three nobody approved, which is the information you were actually missing.
Start with the register. If it turns out to be short and tidy, you have spent an hour and confirmed something useful. If it turns out to be longer than you expected, you have found the reason to write the policy, and you will write a better one for having seen the list first.
The test most departments will fail
Here is the version you can run this week, and it takes an hour.
Name every AI agent operating in your area. Not every AI tool: every agent, meaning every piece of software that takes an action rather than producing a suggestion. Then name the person accountable for each one.
Most managers cannot complete that list. More to the point, most have never been asked to, which is why the gap has not surfaced. It is not a competence failure. Nobody has requested the inventory, so nobody has kept it.
If your answer is that you do not have any agents yet, that is the best possible time to write the register. A list of nothing takes five minutes and establishes the habit before there is anything to reconstruct. The version of this exercise that takes three weeks is the one done in eighteen months, backwards, from expense reports and vague recollections.
What the register needs to hold
Four columns will do.
What the agent is, in a sentence a non-specialist can read. What it is permitted to act on, stated as a boundary rather than a purpose. Who owns it by name, not by team. And what happens if it is wrong, including who finds out and how quickly.
That last column is the one people skip, and it is the one that turns a list into a control. An agent nobody monitors is not governed by having been written down.
Who is telling you this, and what they sell
The article that carried the Singapore material is a contributed column by Karl Crowther, Area Vice President for Middle East and Africa and South Asia at UiPath. UiPath sells agent orchestration software.
His recommendation is that organisations build an orchestration layer before scaling. That may well be right, and it is also his employer’s product, so treat it as a position rather than as advice.
The IMDA framework, the GovTech register, the 150,000 officers and the Singtel restructure are different in kind. They are facts about what named organisations have done, and you can check every one of them without going anywhere near a vendor. Build on those. His two best lines survive the disclosure intact: accountability cannot be coded, and you cannot manage what you cannot see.
The part that costs nothing
Registers are unglamorous and nobody gets promoted for keeping one. The argument for writing yours now is narrower than governance and more practical.
At some point in the next two years, someone is going to ask what your department has running and who is answerable for it. That question arrives either as a planning exercise or as an incident. In the first case the list is an afternoon. In the second it is an archaeology project conducted under pressure, in front of people who are not in a generous mood.
Singapore is doing the afternoon version, for 150,000 people, before switching anything on.