You Approved the AI Strategy. Did You Approve What Your AI Agents Can Access?

AI adoption inside the enterprise has outpaced the controls built to manage it. Across Singapore and the broader region, organisations are deploying AI agents at speed. These are not passive tools. They make decisions, access sensitive data, trigger workflows, and interact with systems autonomously. Most operate with elevated privileges. Few are properly governed.

The consequences are no longer hypothetical. IBM’s 2025 Cost of a Data Breach Report found that 97% of organisations hit by an AI-related security incident had no proper access controls in place. One in five breaches was linked directly to shadow AI. These were not unprepared organisations. They were fast-moving ones that assumed governance would catch up.

It has not. In October 2025, Singapore’s Cyber Security Agency published a dedicated addendum to its AI security guidelines covering agentic AI risks. Three months later, Singapore became the first country in the world to publish a governance framework specifically for agentic AI systems. Regulators do not move that quickly without enforcement intentions forming behind them.

This roundtable addresses what comes next. Not the theory. The practice. How do senior leaders establish real visibility over AI agents operating inside their environment, reframe the risk beyond IT, and build controls that protect the business rather than simply satisfy a framework.

Governance is not the destination. Control is.