Cequence Security and KPMG outline governance for AI agents

Cequence Security and KPMG in Singapore have produced a joint report on governing AI agents as they take consequential actions rather than only generating content. The work responds to data indicating that agents already act for customers, often without identifying themselves.

Agents now issue refunds, update records, and move money, so governing their actions as they happen has become a practical concern. Cequence tracked more than 250,000 agent visits across five industries during one week in October 2026, and about one in seven booked, bought, signed in, or managed an account for a customer.

Several findings concern identity. At one online marketplace, more visits claimed the Google-Agent name than all genuine agent visits tracked that week, and each failed at sign-in, which the report links to bulk testing of stolen passwords; Google was not involved. At a Tier 1 telecommunications carrier, unidentified agents signed in as the customer and passed multi-factor authentication.

Cequence recommends giving each agent a specific job translated into hard limits. It also calls for a separate control outside the agent to approve, escalate, or block each action in real time, because harmless-looking steps can combine into an unpermitted outcome. Blocked actions should point the agent to an allowed route. “An approval at step one shouldn't carry into step five,” said Shreyans Mehta, CTO and co-founder of Cequence Security.

In a controlled study using a Cequence research prototype, agents with only logins and fixed permissions attempted actions outside their job in 44% of runs. With defined jobs and every action checked against them, those attempts fell to 1%, task completion rose from 76% to 95%, and token use dropped about 35% per run.

“Organisations need governance that considers the agent's role, the context of each action, and the cumulative risk created across an entire task,” said Gerry Chng, Partner, Head of Cyber, KPMG in Singapore. The findings will be presented to senior business, technology, and policy leaders at a joint event at KPMG's office in Singapore on 19 November.