Singapore agentic-finance runtime readiness

Singapore SAFR runtime readiness for financial AI agents

Map proposed financial-agent actions, policy checkpoints, escalation paths, and governance records against the SAFR reference approach before execution.

SAFR is an industry reference developed under MAS BuildFin.ai. It is not regulatory guidance or a statement of supervisory expectations. This page is a bounded technical mapping, not legal advice, certification, endorsement, or a finding that an institution has implemented SAFR.

Discuss Singapore SAFR readiness Inspect the control catalogue

Official status Voluntary framework

Issuer Monetary Authority of Singapore BuildFin.ai

Paper published 3 July 2026

Effective date Not applicable

Last verified 27 July 2026

Source boundary

A reference approach for institutional design, not a supervisory rule.

SAFR is an industry reference approach developed through MAS BuildFin.ai collaboration for governance at the point of an agent action. The paper states that it is not regulatory guidance or supervisory expectations and leaves implementation and applicable governance decisions to each institution.

Each institution remains responsible for deciding how its deployment aligns with applicable supervisory expectations, internal governance requirements, financial controls, and operational risk ownership.

The official paper's runtime model

A Governance Envelope passes through four components before action.

SAFR describes the Governance Envelope as the proposed action, its action trace, and the context needed to assess it. The paper also warns that agent-declared contents need authentication against their origin.

01
Agent Identity
Resolve a recognised registered agent and verify it against the authoritative registry for the action context.
02
Controls Repository
Retrieve the institutional rules, product constraints, regulatory controls, and explicit user mandates relevant to the proposed action.
03
Disposition Engine
Evaluate the action against those controls and return a defined, binding handling outcome.
04
Audit Log
Retain the governance decision, its basis, and the action record independently of the agent's later account.

Disposition comparison

Three concepts have bounded HaltState counterparts; Observe remains a gap.

The names are not treated as certification or protocol equivalence. The comparison identifies the closest verified runtime behavior and the work the institution still owns.

SAFR

Deny

Closest HaltState result: DENY

Under active governance, a matching deny policy can stop the customer-integrated worker before the protected side effect.

SAFR

Escalate

Closest HaltState result: APPROVAL_REQUIRED

The worker must hold the action while the customer owns reviewer authority, queue capacity, persistence, expiry, and retry handling.

SAFR

Auto-Execute

Closest HaltState result: ALLOW

The customer worker may proceed only after the guard result and remains responsible for execution idempotency and outcome reporting.

SAFR

Observe

No distinct verified Observe disposition

Monitoring-only execution and its structured observation record remain customer-owned design work rather than a separate HaltState decision result.

Concept-to-control crosswalk

Where reviewed HaltState controls can support integration, and where they stop.

Each row carries its own institution responsibility and verified limitation. These are readiness inputs, not conformance findings.

supports integration

Agent Identity and Governance Envelope

Attach caller-supplied agent attribution and a declared action to a pre-execution guard request.

Mapped controls: HS-IDENT-001 HS-ACTION-001
Institution responsibility: The institution owns the authoritative agent registry, credential and principal binding, mandate authenticity, action-trace capture, context integrity, and placement of the guard before every in-scope side effect.
Verified limitation: HaltState records caller-supplied agent attribution under authenticated tenant scope; this is not cryptographic workload identity. The current guard request does not provide a complete authenticated Governance Envelope or verify a registry-backed agent identity.

supports integration

Controls Repository and bounded authority

Evaluate a declared action against configured policy rules and thresholds under active governance.

Mapped controls: HS-ACTION-001 HS-DECIDE-001
Institution responsibility: The institution owns mandate modelling, policy authorship, authority hierarchy, policy review and activation, availability, validity periods, revocation, and complete coverage of each protected action.
Verified limitation: The verified catalogue does not establish an authoritative institutional Controls Repository. Expired trials bypass governance, policy-load failure can return an empty policy set, and no matching policy can default to ALLOW.

supports integration

Disposition Engine and escalation

Return ALLOW, APPROVAL_REQUIRED, or DENY before a customer-integrated worker performs a protected side effect.

Mapped controls: HS-DECIDE-001 HS-APPROVAL-001
Institution responsibility: The institution owns risk calibration, reviewer authority and capacity, pending-work persistence, timeout and retry handling, and enforcement of the returned decision before execution.
Verified limitation: HaltState maps DENY, APPROVAL_REQUIRED, and ALLOW to the SAFR Deny, Escalate, and Auto-Execute concepts only within active governance. There is no distinct verified Observe disposition, and policy availability or default-ALLOW paths limit parity.

supports evidence

Audit Log and governance records

Receive Standard contract execution reports and demonstrate generation-labelled, redacted Proof Pack evidence outside the agent action loop.

Mapped controls: HS-REPORT-001 HS-EVID-001
Institution responsibility: The institution owns durable record linkage, storage immutability, append-only enforcement, access control, retention, independent verification, and reconciliation with compliance and transaction systems.
Verified limitation: The Standard contract report path is compatibility reporting. Signed Proof Pack evidence has database append-only controls, but the catalogue is not externally anchored or absolutely immutable, and signed verification applies only to records carrying the current integrity metadata.

Reviewed control detail

Inspect the exact HaltState capability boundary behind the crosswalk.

The catalogue records below are reused without broadening their capability status, enforcement point, evidence, customer responsibility, or limitation.

HS-IDENT-001 Native control

Attribute a proposed action to a declared agent

Bind each guard request and evidence record to a stable agent label within the authenticated tenant context.

Enforcement point: Guard request ingestion and decision recording.
Evidence link: /haltstate/docs/guard-pattern
Customer responsibility: Provide a trustworthy agent label and protect the tenant credentials that establish request scope.
Control limitation: The agent label is caller-supplied attribution metadata, not cryptographic workload identity or proof of the human principal.

HS-ACTION-001 Native control

Declare the business action before its side effect

Submit the intended action and bounded context to HaltState before the protected system is changed.

Enforcement point: Immediately before the customer-owned tool or business action executes.
Evidence link: /haltstate/docs/guard-pattern
Customer responsibility: Wrap every protected side effect and remove unguarded execution paths.
Control limitation: The customer must place the guard call before every protected side effect and must not provide an unguarded bypass.

HS-DECIDE-001 Native control

Return a policy result under active governance

When the trial is active and policy loading succeeds, evaluate a declared action and return ALLOW, APPROVAL_REQUIRED, or DENY before execution.

Enforcement point: Between action declaration and the protected side effect.
Evidence link: /live/ /haltstate/docs/guard-pattern
Customer responsibility: Treat the returned decision as authority, execute only an allowed or later-approved action, and monitor trial state and policy availability.
Control limitation: Expired trials bypass governance and return allowed with governance inactive. A policy-load failure returns an empty policy set, and no matching policy defaults to ALLOW. Customers must not treat this control as fail-closed.

HS-APPROVAL-001 Native control

Hold a guarded action for human approval

Prevent execution while a selected action awaits an authorised decision.

Enforcement point: After an approval-required decision and before any customer-side execution.
Evidence link: /haltstate/docs/approval-lifecycle /live/
Customer responsibility: Persist the pending operation and prevent execution until an authorised approval is returned.
Control limitation: The customer worker must persist the pending business operation and retry only after an approved decision.

HS-REPORT-001 Native control

Receive a Standard contract execution report

Accept an authenticated Standard contract guard report, attempt to update a matching approval context, write an action-log entry, and emit a runtime event.

Enforcement point: After allowed execution succeeds or fails.
Evidence link: /live/
Customer responsibility: Report the final execution result accurately, retain the operation-to-report binding in the customer ledger, and verify durable receipt when that matters.
Control limitation: The Standard contract report remains compatibility reporting rather than a replay-safe durable receipt. Replay-safe outcome receipts are implemented and canary verified on the replay contract, which is not the default route for existing integrations.

HS-EVID-001 Native control

Create signed, tenant-verifiable Proof Pack evidence

The current signed Proof Pack integrity path uses a full-content digest, Ed25519 signature, tenant-scoped verification, hash-chain validation, and database append-only controls.

Enforcement point: After the governed workflow has a final decision and before the demonstrated refund execution is recorded.
Evidence link: /live/
Customer responsibility: Supply accurate redacted evidence, use authenticated tenant-scoped verification, inspect the assurance reported for each stored record, and retain records according to policy.
Control limitation: Signed verification applies only when the stored record reports the current integrity metadata. Current assurance does not claim HSM/KMS custody, external anchoring, immunity from database superusers, absolute immutability, or legal certification.

Public evidence and implementation detail

Review the demonstrated action boundary before designing the target architecture.

Live governed action feedInspect sanitized pre-execution refund decisions and reported outcomes. Guard integration patternReview customer instrumentation immediately before a protected side effect. Runtime Control CatalogueInspect capability status, evidence links, customer responsibility, and limitations.

Integration architecture

Separate the demonstrated native guard pattern from gateway design work.

Instrumented action guard

HaltState's verified pattern is customer instrumentation that calls the guard before a protected action. It supports a native-integration design, but the current request is not a complete authenticated Governance Envelope.

Gateway integration

SAFR also describes infrastructure interception for existing agents. A transparent gateway, envelope construction, identity authentication, and complete action coverage are customer-owned architecture and are not claimed as a currently verified HaltState capability.

Runtime readiness checklist

Turn the reference model into a bounded implementation plan.

Inventory in-scope actions.Name every financial side effect and place its checkpoint before execution.
Establish authoritative identity.Define agent registries, credentials, principals, mandates, and rejection behavior outside caller-supplied labels.
Model authority and controls.Assign policy owners, validity periods, revocation, thresholds, and complete no-match behavior.
Map all four dispositions.Define Deny, Escalate, Auto-Execute, and Observe behavior without treating one result as authority for a later action.
Engineer the record layer.Specify append-only storage, tamper evidence, linkage, retention, access, and independent verification.
Test failure and recovery paths.Exercise policy unavailability, reviewer backlog, timeouts, duplicates, downstream errors, reconciliation, and rollback.

Responsibility boundary

HaltState can support selected checkpoints; the institution owns the complete control system.

Agent attribution is caller supplied under tenant authentication and is not cryptographic workload identity or authoritative registry verification.
The current guard does not provide a complete authenticated Governance Envelope, action trace, mandate token, or origin attestation.
On the Standard contract, expired trials, policy-load failure, and no-match handling include paths that can default to ALLOW.
There is no distinct verified Observe disposition in the published HaltState decision contract.
Standard contract reporting is compatibility reporting. Signed Proof Pack evidence has database append-only controls, but is not an externally anchored or absolutely immutable audit log.
The institution owns legal and supervisory interpretation, controls governance, complete action coverage, reviewer operations, record retention, and recovery.

Deployment review

Singapore SAFR Runtime Readiness Sprint

Map a financial-agent workflow across identity, authority, pre-execution disposition, escalation, evidence, integration pattern, and institution-owned gaps.

Discuss the Singapore SAFR sprint

Primary sources

Official MAS paper and publication announcement

Last verified 27 July 2026. Official sources can change; confirm the current paper before making legal, supervisory, or deployment decisions.