The published regimes are more consistent with each other than the products built to satisfy them are with any of the regimes. Four documents from three jurisdictions converge on a short list of artefacts. Read against the release notes, the shipped control planes are strong on stopping an action and weak on proving what happened, which is the opposite of what the guidance emphasises.
Between May and August 2026 four governance regimes published material on autonomous agents, and three vendor mechanisms shipped into general availability over roughly the same window. Read side by side, the Monetary Authority of Singapore's proposed AI Guidelines, the industry SAFR framework MAS convened, the UK NCSC's interim advice of 20 August 2026, and the UAE and US Marine Corps programme documents converge on a short list of things an operator is expected to hand over: a registered identity per agent, a record of the authority each action was taken under, a record of every escalation and the human decision that closed it, and enough of the tool-call sequence to reconstruct what happened without trusting the agent's own account.
No shipped product emits all four. AgentCore Policy went generally available on 3 March 2026 and produces an excellent access log: what was requested, by which principal, what was decided. That is not the reasoning path two of the four regimes explicitly ask for. Agent trajectories carry a 24-hour look-back and older events are deleted rather than archived, so a control expressed over a quarter is outside what the mechanism can see. And not one of the four documents states a retention period for any artefact. A record with no stated retention is an operational log, not evidence, and the distinction surfaces the first time one is requested after the fact.
Nine findings on what four published governance regimes demand of agent operators, and whether anything currently on sale can produce it. Each is labeled by evidence type. Regulator primary documents and vendor engineering documentation are graded separately from trade coverage and vendor-authored opinion, and the evidence that cuts against the argument is included rather than dropped.
Agent registration, distinct per-agent identity, pre-deployment validation, a trace of the tool-call sequence, an escalation record and a halt capability each appear in more than one regime. Not one of the four documents states a retention period for any of it. Four institutions, three jurisdictions, no evident coordination, and the same blank in the same place.
The proposed MAS Guidelines ask that information flow and decision-making paths be monitored, hedged with "where relevant". The document that specifies the per-action record in detail is SAFR, which states plainly that it "does not constitute regulatory guidance or supervisory expectations". The precise artefact sits in the document with no supervisory force.
The 20 August 2026 interim advice asks for chain of thought traces and transcripts, logs "protected from modification or deletion" and immutable where possible, a distinct identity per agent, and the ability to pull the plug including network access. It is a blog post the NCSC says formal guidance will supersede. Per unit of legal force, it is the most demanding document in the set.
Generally available since 3 March 2026 across thirteen regions, it intercepts every tools/list and tools/call at the Gateway, denies by default, and logs each decision to CloudWatch. What it retains is what was requested, by which principal, and what was decided. That establishes a control fired. It does not establish why the agent proposed the action or what it had read beforehand.
AWS's write-up shows a rate limit written over response events beaten by three concurrent transfers slipping past a $5,000 cap, because a policy summing responses sees nothing in flight. It also states that temporal conditions do not support Cedar's automated reasoning, so a policy set using them cannot be proven free of contradictions. Publishing both is to AWS's credit and neither is fixed by publishing it.
Agent trajectories carry a maximum look-back of 24 hours and older events are automatically deleted, not archived. There can be no more than one concurrent authorization request per session, and AWS recommends narrow session scope, which fragments a single business process across several unlinked trajectories. Any control expressed over a week, a quarter or a customer relationship is outside what the mechanism can see.
A meta-audit across three agent safety benchmarks, twelve environments and eight backbone models found that existing benchmarks systematically leave more than 20 percent of unsafe interaction patterns uncovered, and surfaced around 11 percent novel patterns using the same tools and environments. An agent that passes the suite has demonstrated that it passes the suite.
The UAE assessment sorts candidate government work by transaction volume, procedure clarity, documentation quality, data currency and existing automation level. Those are readiness tests, close to a classical process automation screen. Reversibility, blast radius and contestability of the decision do not appear in the published criteria, and the classification framework itself remains unpublished.
SAFR notes that the action trace and the action details are both agent-declared contents of the same envelope, and can be fabricated together by a sophisticated adversarial injection that maintains internal consistency while departing from the original task. Its answer is to authenticate the envelope against its origin. No shipped product found for this report does that authentication.
The report tabulates every evidence artefact named or clearly described across the MAS Guidelines, MAS SAFR, the NCSC's August 2026 interim advice, and the UAE and USMC programme documents. Hedged language such as "where relevant" is counted as present, which is generous to the regimes. The coding is mine and another reader would move a bar or two. Nobody would move the last one.
MAS requires it at paragraph 3.4 with attributes at 3.5. SAFR verifies the registry entry before any other check runs. The Marine Corps has a registry effort in build, framed explicitly as a response to shadow AI. The NCSC does not name a registry as such.
The most widely required artefact in the set
SAFR makes Agent Identity its first runtime component. The NCSC asks for an agent's own unique identity in a class, distinct from humans. The USMC says identity work is still needed. The MAS Guidelines do not state it.
Where the shipped access-model vendors are strongest
MAS requires it at paragraphs 4.14 and 4.18, with review by parties not involved in development. The NCSC wants a threat model and bounded pilots first. The UAE runs a 90-day service assessment. SAFR places it explicitly out of scope as a runtime-only framework.
Where the red-teaming coverage problem lands
SAFR carries a machine-readable mandate in every envelope. The NCSC implies it through least privilege without specifying it. MAS does not state it, and the public sector documents do not either. This is the artefact the whole per-action model rests on and the one furthest from being required.
Specified only in the document with no supervisory force
MAS asks that oversight decisions and interventions be documented and reviewed, at paragraph 4.10(d). SAFR logs the Escalate disposition with its basis and elapsed time. The NCSC wants named responsibility and the ability to intervene. Not stated in the UAE or USMC material.
Cheap to produce, rarely produced in reviewable form
MAS asks, where relevant, that reasoning processes, actions taken and tools used be monitored, at paragraph 4.23(a). SAFR preserves the action trace at the point of proposal. The NCSC asks for chain of thought traces and transcripts outright. This is the artefact no control plane currently emits.
The centre of the gap
SAFR specifies append-only and immutable once written. The NCSC wants logs protected from modification or deletion, immutable where possible. MAS does not state it. The integrity property is asked for more often than the authenticity of what goes into the log.
Integrity is specified; authenticity of the input is not
MAS asks that kill switches be considered for high risk materiality, at paragraph 4.23(b). SAFR's Deny disposition rejects before execution. The NCSC wants emergency shutdown including network access. This is the artefact the shipped products satisfy best, and it produces the least evidence.
Well covered by shipped tooling
Every one of these documents describes a record that exists to be consulted later. Not one says how much later. That is normal for a first pass at a new technology and it will not survive contact with a records management function, because every other financial and government record already has a schedule attached to it.
Expect it in version two, as years rather than hours
The second question is answerable more precisely than the first, because policy language semantics and documented operator limits are matters of record rather than interpretation. AWS has published unusually candid documentation on Amazon Bedrock AgentCore Policy and on Dogwood, the temporal policy language it open-sourced on 6 August 2026 under Apache 2.0. These are its own numbers, read for what they do to the evidence rather than to the enforcement.
No temporal control can be expressed over a week, a quarter or a customer relationship. Events outside the window are deleted, not archived, so the sequence cannot be reconstructed later even manually.
Rules out any control aligned to a reporting period
Serialises decisions within a session and pushes designers toward narrow sessions, which fragments a single business process across several unlinked trajectories. The narrower the session, the less any one trajectory can prove.
Design pressure working against reconstruction
Updating a control mid-flight discards the history the next decision would have read. Tightening a limit during an incident is exactly when this bites, and exactly when the record matters most.
The failure mode nobody tests for
A policy set using temporal conditions loses Cedar's automated reasoning, so it cannot be proven free of contradictions or over-permission. Review becomes manual, on exactly the policies that are hardest to reason about by hand.
AWS states this in its own write-up
If the Gateway execution role lacks the permission, LOG_ONLY mode can fail silently, so everything appears healthy while the engine was never evaluating. A control that looks configured, reports nothing wrong, and is not running is worse than no control, because it produces a clean record of an evaluation that did not happen.
Put an intentionally forbidden call in the test plan
It accepts timestamps as provided and does not validate them, the in-memory temporal engine has no eviction or size cap, event traces are lost on restart, and there is no event authentication mechanism. An unvalidated timestamp in an authorization decision is a forgeable input.
The evidentiary layer is the adopter's problem
The report also separates the vendor claims from the record. AWS says decisions made by temporal policies are logged with the full context behind them, which is true and narrower than it reads: full context means the policy that matched and the trajectory events it read, and that trajectory expires in a day. The zero standing privilege case, as argued by Britive's chief executive in August 2026, cites no data and names no measurement; the diagnosis is sound and the model is necessary and nowhere near sufficient, because an access model tells you what an identity was permitted to do rather than what it did or why. Five assumptions are stated with what fails if each is wrong, including the one that would invalidate the third section entirely if a UAE task classification taxonomy exists in Arabic or behind a portal I could not reach. The call is falsifiable and the condition is printed: I would change position if a major control plane shipped an authenticated action trace with a stated retention period.
This isn't a vendor summary. Every sentence is labeled by what stands behind it: verified fact, vendor claim, third-party estimate, my assessment, hypothesis, or scenario. Sources are numbered and clickable. Forward-looking sections use scenarios with observable tripwires, not forecasts. It's the same method behind every market assessment I write.
Twenty-seven pages, built from public sources with no client brief and no interviews. Read it in the browser or take the PDF.
Each report here answers a real question, directed and researched against public sources and evaluated against a stated assumption, then delivered as Word and PDF. If you're weighing a platform, sizing a category, or defending a number to a board, tell me the decision behind it and I'll tell you honestly whether a report is the right tool.
Commission an assessment