Cequence Security publishes AI agent governance report with KPMG

Cequence Security has published a report, developed with input from KPMG Singapore, on governing AI agents while they operate. The report addresses governance of agentic AI as agents move beyond generating content toward autonomously taking consequential actions.

AI agents now issue refunds, update records, and move money on behalf of organizations, and the report sets out how to govern those actions as they happen. In one week of October 2026, Cequence’s CQ Prime research team tracked more than a quarter million AI agent visits across five industries. About one in seven booked, bought, signed in, or managed an account for the customer.

Some agents never identify themselves. At a Tier 1 telecommunications carrier, such traffic grew from about 100 requests a day to as many as 32,000 within three weeks of a major consumer AI agent’s launch. Those requests signed in as the customer and passed multi-factor authentication. At one online marketplace, more visits claimed the Google-Agent name than all genuine agent visits tracked that week; Google was not involved.

The report recommends a specific job for each agent instead of open-ended authority, turned into hard limits so it cannot decide to do more. A separate control outside the agent would approve, escalate, or block each action in real time and direct the agent to an allowed route when it blocks one. Success is measured by legitimate work completed rather than actions blocked.

In a controlled study using a Cequence research prototype, agents with only logins and fixed permissions tried to act outside their job in 44% of runs. With defined jobs and every action checked against them, those attempts fell to 1%, and task completion rose from 76% to 95%. Cequence has established its regional headquarters in Singapore.

“Organizations need governance that considers the agent’s role, the context of each action, and the cumulative risk created across an entire task,” said Gerry Chng, Partner, Head of Cyber, KPMG in Singapore. The findings will be presented to senior business, technology, and policy leaders at a joint event at KPMG’s office in Singapore on Nov. 19.