AI agent governance: controls, frameworks and tools

What does AI agent governance cover?

Model governance asks whether outputs are accurate and fair. Agent governance adds the question of actions: agents call tools, change records and spend money with delegated authority.

Singapore’s IMDA framework, launched in January 2026 and updated on May 20, 2026 with input from over 60 organizations, sorts the work into 4 dimensions.

• Assess and bound the risks upfront: pick suitable use cases and limit the agent’s autonomy and its access to tools and data.
• Make humans meaningfully accountable: define the checkpoints where a person must approve.
• Implement technical controls and processes across the agent lifecycle, such as baseline testing and access only to allowlisted services.
• Enable end-user responsibility through transparency and training.

Which controls should every AI agent have?

Each control answers one question an auditor or incident responder will ask. The examples are products that implement it today.

Which tools help govern AI agents?

No single product covers every control. Identity platforms govern who the agent is. Gateways govern which tools it reaches. Spend platforms govern what it pays. Facts and prices come from vendor pages on November 10, 2026.

• Microsoft Entra Agent ID: agent identities built from blueprints, Conditional Access, access reviews where sponsors re-approve each agent every 6 to 12 months, and a blueprint switch that blocks every agent built from it.
• Okta for AI Agents: a registry for homegrown agents, discovery of unmanaged agents through a browser plugin and CrowdStrike Falcon, vaulted secrets on demand, manual deactivation, and audit logs sent to your SIEM.
• MCP enterprise-managed authorization: your identity provider decides which MCP servers each employee may use. Okta, Ping Identity and Descope list support.
• AWS AgentCore Policy: checks each AgentCore Gateway tool call against Cedar policies before it runs. AWS prices it at $0.000025 per authorization request. Prices checked November 10, 2026.
• MCP gateways such as Cloudflare MCP server portals and Kong AI Gateway: one endpoint with tool filtering, rate limits and logs.
• Locus Pro: spend controls and call history for paid API calls made through Locus.

• MCP gateways compared
• MCP OAuth and enterprise sign-in

How do you govern what an agent spends?

Paid tools turn a bad loop into a bill. Locus Pro puts spending rules on every paid API call an agent makes through it. The caps are opt-in, so set them when you connect the agent.

• Per-call ceiling: max_credits on each call. A call priced above it fails and nothing is charged.
• Workspace monthly hard limit: new calls are refused once the month’s charges and holds reach it.
• Monthly budget per agent key or connected app.
• Approval for any call over a set amount. An admin opens a link, and the agent retries with the approval token.
• Tool access requests: an agent asks for a tool that is off, and an owner or admin approves it. Requests expire after 30 minutes.
• Read-only grants: an OAuth connection with only mcp:read can search but not spend.
• Call history: each call with its tool, status and credits charged.
• Enterprise: bill each of your customers from their own balance at base price plus your markup, and filter the ledger by customer or by your own attribution keys.

What does a governed research agent look like?

Worked example: a research agent on Locus Pro runs web searches for a sales team. The admin sets max_credits to 10 on each call and a $50 workspace monthly hard limit.

Perplexity search, at up to 5.8 credits, runs freely. Parallel search costs 1 to 15.2 credits depending on mode and options, so any request priced above 10 is refused before it runs and nothing is charged. Brave web search, at 30.3 credits, is refused too. At up to 5.8 credits a search, $50 covers at least 8,620 Perplexity searches before the hard limit stops new calls. Prices checked November 10, 2026.

• Control AI agent tool spending

How should I roll out agents under governance?

Start small and widen access as controls prove out. Two of IMDA’s case studies follow this pattern.

• GovTech Singapore first limited coding assistants to its own staff, blocked external MCP servers, and allowed only low-risk systems. It built central logging and monitoring before a wider rollout.
• Dayos tiered its IT agent by risk. It automates low-severity, reversible actions with audits every 2 weeks, needs human approval for moderate ones, and blocks high-severity actions such as permission changes.
• Microsoft recommends one identity per agent instance, configs checked into source control, and agent-specific Conditional Access policies tested in report-only mode first.

How do I choose a governance approach?

Match the controls to your size and risk.

• A few personal agents: scoped OAuth grants, a monthly spend cap, approvals for writes, and a call log you read.
• A team: add an MCP gateway for one tool allowlist, plus per-agent budgets.
• An enterprise: register every agent in your identity provider, use enterprise-managed authorization for MCP, and stream logs to your SIEM.
• Locus Pro covers paid API calls made through Locus. It does not govern an agent’s identity or its access to your own systems, so pair it with an identity platform.