At ATxSummit in May, Singapore refreshed its Model AI Governance Framework for Agentic AI. Initially published in January as the first of its kind, it governs AI agents that can plan and carry out software work on their own. It is blunt about accountability. An agent may do the work, but the people who deployed it own the result.
The refined framework set the tone for the event week, where the question had clearly moved from whether to use AI to how to govern it now that agents are making their way into the systems businesses depend on.
Singapore ranks among the world’s leading adopters of agentic AI, and its executives report more pressure to move quickly than peers in any other market. A growing share of the software shipping across the region is already written, in whole or in part, by a machine.
All of this assumes the work these agents produce can be trusted, but trust must be earned. Before the code ships, someone or something needs to confirm that it does what it is supposed to do.
Today’s coding models are powerful, but speed has outpaced teams’ ability to verify what they produce. As AI-generated code becomes a larger share of what gets committed, the risk includes defects, vulnerabilities, and unverified code entering production faster than teams can review it.
The trouble often hides in plain sight. AI-generated code can look polished while still introducing subtle vulnerabilities, fragile logic, or unnecessary complexity. Despite its fluency, it does not inherently understand your codebase, standards, or intent. Every change, whether written by a developer or an agent, therefore needs consistent verification.
The verification gap
Amazon CTO Werner Vogels captured this well at last year’s AWS re:Invent. AI now produces code faster than people can make sense of it, opening a gap he called verification debt. Software reaches production before anyone has fully confirmed what it does.
The instinctive response is to set AI on its own work, with one model reviewing another. That is not enough on its own. AI-based review is nondeterministic. It can produce different answers to the same question, making it difficult to rely on as the primary control in environments where consistency, auditability, and explainability are important. AI review still has a place, but it needs firmer ground.
Deterministic analysis should remain the foundation. It applies a consistent set of checks to every change and is well suited to surfacing known classes of issues across security, reliability, maintainability and architectural conformance. It is fast, repeatable and auditable, making it an appropriate backbone for governance.
AI-assisted review adds something different. It can reason about logic, behavior and intent in ways fixed rules cannot, helping to identify context-dependent issues that complement deterministic analysis.
The strongest approach is to use deterministic verification as the authoritative gate and AI review as a complementary layer that broadens coverage.
What good verification looks like
The organizations that handle this best have stopped treating verification as a contest between tools. A better question is what each part of the process covers and where the gaps remain. A zero-trust, multilayer verification model is key.
A mature setup uses several layers, each with a distinct role. Deterministic analysis continuously scans the codebase and reaches beyond security, catching bugs, vulnerabilities, risky dependencies, exposed secrets, reliability issues, maintainability concerns, and drift from a team’s coding and architectural standards.
AI-assisted review handles contextual and logic-level issues. Automated testing confirms that code behaves as intended. Human reviewers make design judgments and catch what the other layers miss. No layer catches everything, which is the reason for using more than one.
What ties these layers together is verification that remains consistent and transparent and applies to every change, whether a person or an agent wrote it.
Singapore is one of the places where this model is taking shape in practice. Using technology acquired from the National University of Singapore, and with IMDA as a design partner, we developed a remediation agent that proposes fixes to identified issues and checks them against the same analysis before opening a pull request for a developer to approve.
None of this is purely a security exercise. Code can be free of obvious vulnerabilities and still become a liability if it quietly accumulates complexity or grows too tangled to maintain. That kind of debt is repaid later, with interest.
Singapore’s agentic framework likewise calls for technical controls and testing throughout an agent’s lifecycle, with people remaining accountable for what ships. Our research underscores the value of consistent verification. It found that teams using our automated code analysis for verification are 44 percent less likely to suffer outages caused by AI-generated code.
This is no argument for slowing down. Across Asia Pacific, the businesses that gain the most from agentic development will be those that can show that their AI-written code is dependable, secure and maintainable, and that it holds up under audit.
Singapore wants to be a trusted place to build and deploy AI, and verification can help make that ambition real. It can also stop this year’s burst of speed from becoming next year’s bill for rework and downtime. Speed without governance creates risk at scale.
Marcus Low is Corporate Vice President, Managing Director, Asia Pacific & Japan, Sonar.
TNGlobal INSIDER publishes contributions relevant to entrepreneurship and innovation. You may submit your own original or published contributions subject to editorial discretion.
Featued image: Fotis Fotopoulos on Unsplash
AI agents are joining the workforce; Inclusion must be part of the job description