Singapore agentic-finance runtime readiness

Singapore SAFR runtime readiness for financial AI agents

Map proposed financial-agent actions, policy checkpoints, escalation paths, and governance records against the SAFR reference approach before execution.

SAFR is an industry reference developed under MAS BuildFin.ai. It is not regulatory guidance or a statement of supervisory expectations. This page is a bounded technical mapping, not legal advice, certification, endorsement, or a finding that an institution has implemented SAFR.

Discuss Singapore SAFR readiness Inspect the control catalogue

Official status Voluntary framework

Issuer Monetary Authority of Singapore BuildFin.ai

Paper published 3 July 2026

Effective date Not applicable

Last verified 27 July 2026

Source boundary

A reference approach for institutional design, not a supervisory rule.

SAFR is an industry reference approach developed through MAS BuildFin.ai collaboration for governance at the point of an agent action. The paper states that it is not regulatory guidance or supervisory expectations and leaves implementation and applicable governance decisions to each institution.

Each institution remains responsible for deciding how its deployment aligns with applicable supervisory expectations, internal governance requirements, financial controls, and operational risk ownership.

The official paper's runtime model

A Governance Envelope passes through four components before action.

SAFR describes the Governance Envelope as the proposed action, its action trace, and the context needed to assess it. The paper also warns that agent-declared contents need authentication against their origin.

01
Agent Identity
Resolve a recognised registered agent and verify it against the authoritative registry for the action context.
02
Controls Repository
Retrieve the institutional rules, product constraints, regulatory controls, and explicit user mandates relevant to the proposed action.
03
Disposition Engine
Evaluate the action against those controls and return a defined, binding handling outcome.
04
Audit Log
Retain the governance decision, its basis, and the action record independently of the agent's later account.

Disposition comparison

Three concepts have bounded HaltState counterparts; Observe remains a gap.

The names are not treated as certification or protocol equivalence. The comparison identifies the closest verified runtime behavior and the work the institution still owns.

SAFR

Deny

Closest HaltState result: DENY

Under active governance, a matching deny policy can stop the customer-integrated worker before the protected side effect.

SAFR

Escalate

Closest HaltState result: APPROVAL_REQUIRED

The worker must hold the action while the customer owns reviewer authority, queue capacity, persistence, expiry, and retry handling.

SAFR

Auto-Execute

Closest HaltState result: ALLOW

The customer worker may proceed only after the guard result and remains responsible for execution idempotency and outcome reporting.

SAFR

Observe

No distinct verified Observe disposition

Monitoring-only execution and its structured observation record remain customer-owned design work rather than a separate HaltState decision result.

Concept-to-control crosswalk

Where reviewed HaltState controls can support integration, and where they stop.

Each row carries its own institution responsibility and verified limitation. These are readiness inputs, not conformance findings.

supports integration

Agent Identity and Governance Envelope

Attach caller-supplied agent attribution and a declared action to a pre-execution guard request.

Mapped controls: HS-IDENT-001 HS-ACTION-001
Institution responsibility: The institution owns the authoritative agent registry, credential and principal binding, mandate authenticity, action-trace capture, context integrity, and placement of the guard before every in-scope side effect.
Verified limitation: HaltState records caller-supplied agent attribution under authenticated tenant scope; this is not cryptographic workload identity. The current guard request does not provide a complete authenticated Governance Envelope or verify a registry-backed agent identity.

supports integration

Controls Repository and bounded authority

Evaluate a declared action against configured policy rules and thresholds under active governance.

Mapped controls: HS-ACTION-001 HS-DECIDE-001
Institution responsibility: The institution owns mandate modelling, policy authorship, authority hierarchy, policy review and activation, availability, validity periods, revocation, and complete coverage of each protected action.
Verified limitation: The verified catalogue does not establish an authoritative institutional Controls Repository. Expired trials bypass governance, policy-load failure can return an empty policy set, and no matching policy can default to ALLOW.

supports integration

Disposition Engine and escalation

Return ALLOW, APPROVAL_REQUIRED, or DENY before a customer-integrated worker performs a protected side effect.

Mapped controls: HS-DECIDE-001 HS-APPROVAL-001
Institution responsibility: The institution owns risk calibration, reviewer authority and capacity, pending-work persistence, timeout and retry handling, and enforcement of the returned decision before execution.
Verified limitation: HaltState maps DENY, APPROVAL_REQUIRED, and ALLOW to the SAFR Deny, Escalate, and Auto-Execute concepts only within active governance. There is no distinct verified Observe disposition, and policy availability or default-ALLOW paths limit parity.

supports evidence

Audit Log and governance records

Receive best-effort execution reports and demonstrate hash-referenced, redacted refund evidence outside the agent action loop.

Mapped controls: HS-REPORT-001 HS-EVID-001
Institution responsibility: The institution owns durable record linkage, storage immutability, append-only enforcement, access control, retention, independent verification, and reconciliation with compliance and transaction systems.
Verified limitation: The current catalogue is not an immutable, append-only, tamper-evident audit log. Reporting is best-effort, immediate ALLOW can have no approval row, and the demonstrated refund verifier does not recompute the embedded action-evidence hash.

Reviewed control detail

Inspect the exact HaltState capability boundary behind the crosswalk.

The catalogue records below are reused without broadening their capability status, enforcement point, evidence, customer responsibility, or limitation.

HS-IDENT-001 Native control

Attribute a proposed action to a declared agent

Bind each guard request and evidence record to a stable agent label within the authenticated tenant context.

Enforcement point: Guard request ingestion and decision recording.
Evidence link: /haltstate/docs/guard-pattern
Customer responsibility: Provide a trustworthy agent label and protect the tenant credentials that establish request scope.
Control limitation: The agent label is caller-supplied attribution metadata, not cryptographic workload identity or proof of the human principal.

HS-ACTION-001 Native control

Declare the business action before its side effect

Submit the intended action and bounded context to HaltState before the protected system is changed.

Enforcement point: Immediately before the customer-owned tool or business action executes.
Evidence link: /haltstate/docs/guard-pattern
Customer responsibility: Wrap every protected side effect and remove unguarded execution paths.
Control limitation: The customer must place the guard call before every protected side effect and must not provide an unguarded bypass.

HS-DECIDE-001 Native control

Return a policy result under active governance

When the trial is active and policy loading succeeds, evaluate a declared action and return ALLOW, APPROVAL_REQUIRED, or DENY before execution.

Enforcement point: Between action declaration and the protected side effect.
Evidence link: /live/ /haltstate/docs/guard-pattern
Customer responsibility: Treat the returned decision as authority, execute only an allowed or later-approved action, and monitor trial state and policy availability.
Control limitation: Expired trials bypass governance and return allowed with governance inactive. A policy-load failure returns an empty policy set, and no matching policy defaults to ALLOW. Customers must not treat this control as fail-closed.

HS-APPROVAL-001 Native control

Hold a guarded action for human approval

Prevent execution while a selected action awaits an authorised decision.

Enforcement point: After an approval-required decision and before any customer-side execution.
Evidence link: /haltstate/docs/approval-lifecycle /live/
Customer responsibility: Persist the pending operation and prevent execution until an authorised approval is returned.
Control limitation: The customer worker must persist the pending business operation and retry only after an approved decision.

HS-REPORT-001 Native control

Receive and best-effort record an execution report

Accept an authenticated guard report, attempt to update a matching approval context, write an action-log entry, and emit a runtime event.

Enforcement point: After allowed execution succeeds or fails.
Evidence link: /live/
Customer responsibility: Report the final execution result accurately, retain the operation-to-report binding in the customer ledger, and verify durable receipt when that matters.
Control limitation: This is report receipt and best-effort recording, not proof that a guarded action was durably linked. Immediate ALLOW can have no approval row; the endpoint does not check whether its UPDATE matched a row; the idempotency key is not written to the action log; and event emission failures are ignored.

HS-EVID-001 Demonstrated integration

Hash a redacted refund evidence document before proof storage

The refund worker computes SHA-256 over the canonicalized redacted in-memory evidence document and stores that digest beside a logical haltstate:// artifact URI in a Proof Pack.

Enforcement point: After the governed workflow has a final decision and before the demonstrated refund execution is recorded.
Evidence link: /live/
Customer responsibility: Supply accurate redacted evidence, independently verify exported evidence when integrity assurance is required, and retain records according to policy.
Control limitation: The artifact URI is logical and the verifier does not recompute the embedded action-evidence hash. The live page demonstrates Proof Pack integration only, not evidence integrity. This is not a digital signature, external timestamp, immutable store, or legal certification.

Public evidence and implementation detail

Review the demonstrated action boundary before designing the target architecture.

Live governed action feedInspect sanitized pre-execution refund decisions and reported outcomes. Guard integration patternReview customer instrumentation immediately before a protected side effect. Runtime Control CatalogueInspect capability status, evidence links, customer responsibility, and limitations.

Integration architecture

Separate the demonstrated native guard pattern from gateway design work.

Instrumented action guard

HaltState's verified pattern is customer instrumentation that calls the guard before a protected action. It supports a native-integration design, but the current request is not a complete authenticated Governance Envelope.

Gateway integration

SAFR also describes infrastructure interception for existing agents. A transparent gateway, envelope construction, identity authentication, and complete action coverage are customer-owned architecture and are not claimed as a currently verified HaltState capability.

Runtime readiness checklist

Turn the reference model into a bounded implementation plan.

Inventory in-scope actions.Name every financial side effect and place its checkpoint before execution.
Establish authoritative identity.Define agent registries, credentials, principals, mandates, and rejection behavior outside caller-supplied labels.
Model authority and controls.Assign policy owners, validity periods, revocation, thresholds, and complete no-match behavior.
Map all four dispositions.Define Deny, Escalate, Auto-Execute, and Observe behavior without treating one result as authority for a later action.
Engineer the record layer.Specify append-only storage, tamper evidence, linkage, retention, access, and independent verification.
Test failure and recovery paths.Exercise policy unavailability, reviewer backlog, timeouts, duplicates, downstream errors, reconciliation, and rollback.

Responsibility boundary

HaltState can support selected checkpoints; the institution owns the complete control system.

Agent attribution is caller supplied under tenant authentication and is not cryptographic workload identity or authoritative registry verification.
The current guard does not provide a complete authenticated Governance Envelope, action trace, mandate token, or origin attestation.
Expired trials, policy-load failure, and no-match handling include paths that can default to ALLOW.
There is no distinct verified Observe disposition in the published HaltState decision contract.
Execution reporting is best-effort, and the demonstrated refund evidence path is not an immutable, append-only, tamper-evident audit log.
The institution owns legal and supervisory interpretation, controls governance, complete action coverage, reviewer operations, record retention, and recovery.

Deployment review

Singapore SAFR Runtime Readiness Sprint

Map a financial-agent workflow across identity, authority, pre-execution disposition, escalation, evidence, integration pattern, and institution-owned gaps.

Discuss the Singapore SAFR sprint

Primary sources

Official MAS paper and publication announcement

Last verified 27 July 2026. Official sources can change; confirm the current paper before making legal, supervisory, or deployment decisions.