Singapore's agentic AI framework asks for human approval checkpoints. Korea's AI Basic Act asks for documented oversight. Both assume you hold a list of decisions a machine, or a junior, may not take. Most departments have the policy and not the list.
An AI agent in a customer service team can now read a complaint, check the order history, decide that a refund is warranted and issue it. Each step was once a person's. The question that every governance framework in the region now asks, in its own words, is which of those steps may be the agent's and which may not. Singapore's framework calls the answer a set of action boundaries. Korea's statute calls it human management and supervision. Your department probably calls it a policy, and the policy probably says that a human remains accountable for AI-assisted decisions. That is a sentence. It is not a list.
Singapore's framework names examples of what belongs on the list. The Infocomm Media Development Authority launched its Model AI Governance Framework for Agentic AI on 22 January 2026 and published version 1.5 on 20 May. It sets out recommended practice for organisations that deploy agents, and Bird & Bird's client note describes compliance as voluntary. The framework says that the organisations that deploy agents, and the humans who oversee them, remain accountable for what the agents do. It asks organisations to define checkpoints or action boundaries that need human approval. It gives four examples: high-stakes actions and decisions, irreversible actions, outlier or atypical behaviour, and boundaries that users define for themselves, beyond those the organisation sets. The May version adds practices to guard against automation bias, such as monitoring human override rates and response times. The framework also says human oversight should be adapted to guard against automation bias and audited regularly to confirm it is still effective.
Korea has made oversight a documentation duty. The AI Basic Act came into force on 22 January 2026 with its enforcement decree. Operators of high-impact AI, in fields such as health care, employment decisions and loan assessments, must put measures in place for a risk management plan, explanations of outputs where technically feasible, user protection, human management and supervision, and documents that show the measures were taken. The Ministry of Science and ICT is operating a grace period of at least one year in which fact-finding investigations and administrative fines are generally deferred. The Act's administrative fines are capped at 30 million won. The duty to document is in the Act, and the Act is in force.
For anyone working with high-risk AI systems under EU law, Article 14 of the EU AI Act sets the design standard. A high-risk system must be provided to the deployer in such a way that the people assigned to oversee it are enabled, as appropriate and proportionate, to understand its capacities and limitations and to stay aware of their own tendency to over-rely on its output. They must also be enabled to interpret that output and to decide, in any particular situation, not to use the system or to disregard, override or reverse its output. This article gives no application dates for the high-risk rules. The list of what an overseer must be enabled to do is in Article 14(4) of the text.
Three regimes, three vocabularies, one assumption. Somewhere in the organisation there is a written statement of which decisions a system, or a person without the authority, may not take. The consultancies have noticed the gap too. BCG's 2026 work on what it calls the authorisation gap in agent governance observes that human controls assume judgment and accountability, application controls assume fixed behaviour, and agents have neither. BCG frames this as an authorisation problem, and notes that access to agents is being granted through controls designed for people and for conventional software. It is also, and first, a judgment problem: someone has to decide where the line goes, and someone has to be able to hold it.
AIRS-J/1 scores the holding of decision rights as dimension E1. A person at Level 2 acts within their authority without being prompted, and escalates the parts that need another party's approval, naming who that party is. Level 0 is acting outside authority, or delegating a decision that cannot be delegated, to a person or to an AI system, without acknowledging it. The refund agent that issues a refund outside its mandate, with no person having decided that it may, is a Level 0 behaviour by whoever set it running.
The second failure is the one your most careful people fall into. Level 1 in E1 includes escalating everything, using escalation to avoid deciding. The Standard's note is explicit: over-escalation is not safe behaviour, because it transfers the decision without transferring the reason. A team lead who routes every AI-assisted customer decision to you for sign-off has not protected the organisation. They have moved the decision to the person with the least context and the most to do, and added a queue. Both failure directions score 1 or 0.
Level 3 is where the list earns its keep. It requires the split between what is escalated and what is decided to be proportionate, with the basis stated. That is only possible if the person knows where the boundary is. A list makes the boundary knowable. Without it, every person draws their own line, and the organisation has as many policies as it has people.
For HR and L&D: E1 is the behaviour most directly shaped by a document the organisation already controls. If the list does not exist, no development programme can build the behaviour, because there is nothing for the person to act within.
The triggers that follow are drawn from the Singapore framework, the Korean statute's scope and the Standard's own stakes model. They are the conditions under which a decision stays with a named person.
Irreversible. The action cannot be undone at reasonable cost. A refund can be clawed back; a public statement cannot. A contract termination cannot.
High-stakes. The consequence, if wrong, is severe. The Standard records consequence in six families: people safety, financial loss, service continuity, information and privacy harm, trust and legitimacy, and environmental or community harm. Any decision with a credible pathway to the first, fourth or fifth of those belongs on the list.
Outlier. The case does not look like the cases the system was built on. An unusually large refund, a complaint that mentions a regulator, a customer who has contacted the organisation nine times. The system's confidence is least reliable where the case is least typical.
Affects an identifiable person. Hiring, lending, medical and access decisions about a named individual carry a duty that generic decisions do not, and Korea's statute names health care, employment and loan assessments among its high-impact fields.
Outside a stated authority. The decision exceeds what the person or system running it has been authorised to decide, in value, in scope or in kind.
Take the refund agent, which is the simplest case. It is illustrative, not a client. Before it is switched on, three lines have to be drawn, and no regulator will draw them for you.
The first line is value. Up to what amount may the agent refund without a person? The number is yours. The reasoning behind it is the part the Standard scores: a Level 2 answer states the amount and who approves above it. A Level 3 answer states why that amount, in terms of what the organisation can afford to get wrong a hundred times before anyone notices.
The second line is kind. Which refunds may it never issue, whatever the value? Refunds that imply fault, refunds to accounts flagged for fraud review, refunds where the complaint mentions injury or a regulator. These are the irreversible, outlier and identifiable-person triggers applied to one workflow.
The third line is reason. When the agent escalates a case to a person, what does it send with it? If it sends only the case, the person starts from nothing. If it sends the case with the agent's recommendation and the basis for it, the person can decide. This is the Standard's point about over-escalation, applied to a machine: escalation without the reason is not oversight, it is a queue.
A policy that says a human remains accountable is a sentence. A list of what the human must decide is a document.
For trainers and facilitators: the three lines are a forty-minute exercise. Give a group one AI-assisted workflow from their own work and ask them to draw value, kind and reason on one page. The disagreements inside the group are the point, because they show where the organisation currently has as many lines as it has people.
The highest level in E1 is not stricter compliance with the boundary. It is naming the condition under which the boundary should be reset for future cases, rather than only complying with it here. A person at Level 4 says: this refund limit was set when the agent was new; after a thousand cases with an override rate under some threshold and no fraud incidents, it should be reviewed upward. Or downward, if the override rate shows the agent is wrong more often than expected.
That is what turns a list from a control into a living document. The Singapore framework asks organisations to track the human override rate, the frequency at which humans reject or modify agent actions, to check that oversight is still effective. The same data on how often people overrule the system is also the evidence for moving the line. Without the list, there is no line to move, and without the monitoring, there is no evidence to move it on.
The regulators have asked for the list. The agent is already running. The lines are yours to draw, and the Standard scores whether your people can hold them.
Compare your list with the E1 anchor
AIRS-J/1 assesses how a person decides, not what they know. A result is not a measure of intelligence, personality, AI technical skill or domain expertise, and it is not a substitute for supervision, professional licensing or regulatory authorisation. This article is not legal advice. Regulatory summaries were checked against the official texts, or against the secondary sources named in the text, on 19 October 2026, and statuses change. The refund agent is illustrative and invented. The five triggers are a reading of the sources, not a regulatory checklist, and the Standard does not prescribe the content of any organisation's decision-rights list.
AIR APAC publishes these articles in the institution's voice. Every figure carries its source and its limit. All articles.
"Keep a human in the loop" is the most repeated line in AI governance. The loop breaks when the person rubber-stamps, has lost the skill, has no authority to stop, or has too much to check. Only one of those is fixed by training.
When a decision involves AI, many managers choose the most cautious option and call it prudence. The Standard scores that at Level 1. Maximal caution where the cost is low is as much a failure as minimal care where the harm is severe.
A tribunal held an airline to what its chatbot said. A consultancy's revised report disclosed its AI use, after errors were found in the first. The question in both was the same: who was entitled to know, and when.