Skip to main content

Agentic AI Demands Better Guardrails

Core idea: Give AI freedom within carefully defined boundaries.

The River and the Riverbank​

Steven Brovich used a powerful metaphor in his AWS leadership talk:

"Just like rivers, agents find their own path. If you tried to build a toll gate in the middle of a river, the river would find another way around. Your job is not to prescribe the route. Your job is to define the riverbank — what the outcome has to be — and let the water find its way."

This is the mental model shift that agentic AI demands. For 30 years, our entire operating model has optimized for determinism — runbooks, change advisory boards, SLAs with nines, predictable outputs for predictable inputs. The whole discipline was built around the idea that the system should do the same thing every time.

That was the right bet for 30 years. It's no longer the right bet.

Non-Determinism Is a Feature, Not a Bug​

Think about what you're actually asking an agent to do. You're asking it to handle cases you didn't anticipate, to adapt, to reason about the goal — not just follow the steps. That requires non-determinism.

A deterministic agent is a runbook. We already have runbooks. We don't need AI for that.

The operating model has to shift:

  • Old mindset: Tighten execution, measure steps
  • New mindset: Relax execution, tighten outcome measurement, build guardrails around what you actually care about

Set the outcome. Give the team the means. Resist the urge to manage the how.

Singapore's AI Governance Framework​

In January 2026 at Davos, Singapore launched the first state-backed governance framework specifically designed for autonomous AI agents. It distills to four dimensions:

  1. Risk assessment upfront — structured evaluation before deployment
  2. Human accountability chains — every agent action traced to a named human
  3. Technical guardrails throughout the lifecycle — security and permissions enforced at the infrastructure level
  4. End-user transparency — users must know they're interacting with an agent and understand its bounds

Five Things That Make This Framework Distinct​

  1. Agent identity management — Every agent has a verifiable identity before it can act. Not a nice-to-have — a prerequisite.
  2. Concrete testing frameworks — Built on AI Verify and the global AI assurance pilot from 2025. Operational today, not aspirational.
  3. Multi-agent coordination risk — When agents talk to other agents, what happens when they disagree, escalate, or find emergent behavior no one planned for? Singapore has thought this through.
  4. Voluntary but directional — Singapore doesn't compel compliance, but if you want to do business with the government or in regulated sectors, this is the de facto standard.
  5. Addresses the deskilling trap head-on — Organizations must show they're continuing to train the people who will take over in the future.

Policy as Infrastructure​

The critical architectural point: governance happens outside the LLM loop. You don't ask the agent nicely not to do something. You stop it at the gateway before the LLM ever sees the request.

This separates who writes the policy from who writes the agent:

  • Security team owns the policies
  • Engineering team owns the agents

Each one plays to their strength. This is what governance as infrastructure looks like — not a policy document, not a compliance checklist, but running code enforcing rules every request, every time.

The Four Questions Every Agent Must Answer​

Amazon's Agent Core and Singapore's framework converged on the same four questions:

  1. Who's the agent? Who authorized it?
  2. What is the agent allowed to do?
  3. Is the agent performing as expected?
  4. Can we audit what it did?

These four questions must be answerable before any agent acts.

What This Means for You​

  • Define the riverbank, not the route. Set clear outcome boundaries and let agents find their own path within them.
  • Enforce guardrails at the infrastructure level. Policy should be code, not prompts.
  • Maintain human accountability. Every agent action should be traceable to a named human.
  • Audit everything. If you can't see what your agents are doing, you can't govern them.
  • Don't try to make agents deterministic. If you want deterministic, use a runbook. If you want adaptive, use an agent — with guardrails.

Portions of this article are based on insights from Steven Brovich's talk "A leader's guide to advanced team structures in an agentic world" at AWS Events. You can watch the full talk here: A leader's guide to advanced team structures in an agentic world.

Last updated on